Google Launches Gemini 3.5 Flash Cyber, a Special AI Model for Tracking Code Security Bugs

Gemini 3.5 Flash Cyber, a cost-effective cyber-specialized artificial intelligence model. (photo; x @Google)

Google DeepMind officially launched Gemini 3.5 Flash Cyber, a cost-effective cyber-specialized artificial intelligence model. This model is built on the 3.5 Flash architecture and integrated into Google's CodeMender security platform to find, validate, and patch software security holes before they are exploited by hackers.

The process of finding and fixing security bugs in large-scale software projects is often a resource-draining job. Although large-scale AI models are capable of scanning code quickly, their operating costs tend to be expensive and the process is slow to run repeatedly on millions of lines of code. The presence of Gemini 3.5 Flash Cyber is specifically designed to overcome these obstacles in conjunction with the launch of the Gemini 3.6 Flash and Gemini 3.5 Flash Lite models.

Based on the 3.5 Flash architecture, this lightweight model offers high speed with low token costs. This allows the cybersecurity team to continuously scan complex code bases without triggering a spike in server costs.

In its operation on the CodeMender security platform, the system can call Gemini 3.5 Flash Cyber several times in a rapid sequence. This multiple agent scheme allows the system to explore dozens of alternative execution paths on a project simultaneously before compiling a single clean final report.

In internal testing on complex systems such as Google Chrome's V8 JavaScript engine, Gemini 3.5 Flash Cyber managed to find 55 unique confirmed security holes. This achievement surpasses the standard 3.5 Flash model which found 47 holes and competitor models such as Claude Opus 4.6 from Anthropic which found 36 holes.

During intensive testing in the real world, Google Cloud's vulnerability research team used this model to find a remote code execution vulnerability in a public API. The model also successfully identified a critical-level memory corruption bug in a production service in just two hours.

Aware of the potential for double risks from AI-based bug tracking tools that can be misused by irresponsible parties, Google implements a limited distribution approach. The company distributes Gemini 3.5 Flash Cyber through a limited access pilot program exclusively for governments and trusted partners via the CodeMender platform.

This access restriction is intended to give the defense team an advantage in patching security gaps before they can be exploited, while the general defense capabilities of CodeMender can still be accessed by corporate customers through the Gemini Enterprise Agent Platform.