Google's new security model found 55 unique confirmed issues in the V8 JavaScript engine. Mainline Gemini 3.5 Flash found 47. Claude Opus 4.6 found 36. Then Google decided most people should not be allowed to use it.
Gemini 3.5 Flash Cyber launched on July 21, 2026 alongside Gemini 3.6 Flash and 3.5 Flash-Lite, and it is the strangest release of the three. It is not a general model, it is not priced on a public page, and you almost certainly cannot get it. Access runs through a limited pilot to governments and trusted partners via Google's CodeMender agent, with expansion promised over time and no date attached.
I find this release more interesting than either of its siblings, and not because of the benchmarks. It contains a technical argument about model size that contradicts most of what the industry has been saying, and a policy decision about who gets to hold a capable security tool that the whole field will be arguing about for years. Also one buried detail about competitor models that deserves far more attention than it got.
What Is Gemini 3.5 Flash Cyber?
Gemini 3.5 Flash Cyber is a specialized model built on Gemini 3.5 Flash and fine-tuned to find, validate, and patch software vulnerabilities. It is not a general-purpose assistant with a security personality, it is a narrow model tuned for one job, and Google trained it on material that reflects how security work actually happens.
The training data is the part I would highlight. Google leaned on OSV.dev, its open source vulnerability database holding more than 700,000 recorded vulnerabilities, plus over ten years of results from OSS-Fuzz, its continuous fuzzing infrastructure. That is a decade of real crashes, real patches, and real triage decisions, which is a materially different corpus from scraped code plus generic instruction tuning.
It shipped as the third model in a three-model release, and our Google Gemini and Google AI collection covers the other two, which are conventional general-purpose releases available to anyone with an API key.
The stated purpose is defensive: give frontline defenders a head start on finding and fixing critical vulnerabilities before attackers exploit them. It runs inside CodeMender, Google's security agent, which already scans Chrome, Android, Cloud, Ads, and YouTube codebases internally.
Flash Cyber is not a model that knows about security. It is a model shaped by a decade of watching security professionals fail and fix things.
What It Actually Found, With Numbers
The headline evaluation is the V8 JavaScript engine, where Gemini 3.5 Flash Cyber found 55 unique confirmed issues against 47 for mainline Gemini 3.5 Flash and 36 for Claude Opus 4.6. Confirmed is doing important work in that sentence, because unconfirmed findings are the bane of automated security tooling.
Beyond V8, Google reports that on its internal Big Sleep evaluation, which tests vulnerability discovery in complex codebases including Chrome and Safari, Flash Cyber significantly surpassed both mainline 3.5 Flash and the newer 3.6 Flash. On the CyberGym benchmark it reached competitive performance against significantly larger models when CodeMender invoked it up to five times per report.
The most concrete result is operational rather than benchmarked. Google's Cloud Vulnerability Research team used the system to uncover remote code execution vulnerabilities in public APIs and a memory corruption flaw in a sensitive production service, all within two hours. Two hours is the number that will get this deployed inside large enterprises, because it maps directly onto how security teams measure their own work.
A caveat worth stating plainly. Every one of these figures comes from Google evaluating Google's model, several on Google's internal benchmarks, and no independent third party has published a competing assessment. The V8 comparison against Claude Opus 4.6 is a vendor comparing itself to a rival on its own turf. I believe the direction, I would hold the precise margins loosely until outside researchers get access, which the restricted release makes difficult by design.
How CodeMender Uses It: The Small Model Argument
Flash Cyber is built small on purpose, because vulnerability discovery rewards many cheap attempts over one expensive attempt. CodeMender invokes the model repeatedly, up to five times per report in the CyberGym setup, to analyze vastly more code paths before producing a single consolidated vulnerability report.
The reasoning is about search space. Finding a vulnerability in a large codebase is not one hard reasoning problem, it is an enormous number of paths to check, most of which are boring. Google describes an immense execution search space, and against that shape of problem, the winning strategy is coverage, not depth on any single call. A lightweight model you can run hundreds of times beats a frontier model you can afford to run twice.
This quietly contradicts the default assumption of the past two years, that the answer to a hard task is always a bigger model. For search-shaped problems, the economics invert: capability per dollar times number of attempts beats raw capability. Fuzzing has worked this way for decades, and Flash Cyber is essentially the LLM version of that insight.
There is a broader lesson for anyone building agents that has nothing to do with security. If your task decomposes into many cheap checks rather than one deep judgment, a small tuned model called many times will usually beat a large model called once, at a fraction of the cost. Most teams reach for the biggest model available and never test the alternative architecture.
The same cost-per-attempt logic drives the rest of this release, which is why the sibling models were tuned for token efficiency. Our ranked analysis of the best AI models in 2026 tracks how that trade-off is playing out across every vendor.
The Detail Nobody Covered: Competitor Models Refused
Buried in Google's evaluation of its Chrome production pipeline is a line that deserves its own headline: newer competitor models refused the tasks due to safety guardrails. Not scored poorly. Refused.
Consider what that means in practice. A security team asks a frontier model to analyze a codebase for exploitable memory corruption, and the model declines because the request pattern-matches to offensive security. The safety training that stops a model from helping an attacker also stops it from helping the defender, because at the level of text, those two requests look nearly identical.
This is the central difficulty of defensive security AI and it does not have a clean solution. You cannot teach a model to find exploitable bugs for good people only, because the capability is the same capability. What you can do is what Google did: build the capable model, then control who holds it through access rather than through refusals.
My honest opinion is that this reframes the guardrails debate usefully. Refusal-based safety looks responsible and quietly transfers capability to whoever is willing to run an unaligned model, which in security is exactly the wrong population. Access-based safety is uglier, more paternalistic, and probably more effective. I do not love it. I have not heard a better proposal.
A model that refuses to help defenders has not removed the capability from the world. It has removed it from the defenders.
Why Google Locked It Down
Google restricted Flash Cyber because vulnerability discovery is inherently dual-use: the same model that helps a defender patch a flaw helps an attacker exploit it. Access is limited to governments and trusted partners through the CodeMender pilot, expanding over time, which Google frames as giving frontline defenders a head start while mitigating broader misuse.
The asymmetry argument is what justifies the decision. Defenders have to find and fix everything, attackers only need one working flaw. In principle, a capable automated finder helps defenders more, because they own the codebase, the build pipeline, and the ability to ship a patch. In practice, that advantage only holds if defenders get the tool first and at scale, which is precisely what a gated pilot with governments and large partners produces.
The uncomfortable part is who gets left out. Open source maintainers, small security teams, independent researchers, and the entire long tail of software that nobody is paid to protect. Those are the codebases with the least security investment and the most unfound bugs, and they are outside the pilot. Meanwhile the organizations most likely to already have strong security programs are inside it.
So the honest summary is that this is defensible and lopsided at the same time. Google is not wrong that unrestricted release would arm attackers. It is also true that restricted release concentrates a defensive advantage among governments and large enterprises, which is roughly where security capability was already concentrated. Gating does not create equity, it preserves the existing distribution.
Don't just use ChatGPT. Learn to build custom LLM agents, RAG pipelines, and full-stack Agentic AI apps in our intensive 6-week program.
Flash Cyber vs Claude Mythos
Flash Cyber is Google's answer to Anthropic's Claude Mythos, and the strategies differ sharply on both price and philosophy. Mythos is priced at 10 dollars per million input tokens and 50 dollars per million output, positioned as the most capable cyber model available. Google's approach is the opposite: a small, cheap, task-tuned model run many times.
Mythos also has a more dramatic access history. Anthropic launched it as a tightly restricted flagship, and it was subsequently made unavailable after the United States government cited national security concerns, before returning for select American organizations. Two vendors, two restriction models, both landing on the conclusion that this class of capability cannot ship openly.
The strategic contrast is the interesting bit. Anthropic built the most capable thing it could and restricted it heavily. Google built something deliberately modest and made it economical enough to run across entire codebases continuously, then restricted distribution anyway. If the small-model-many-invocations thesis holds, Google's approach scales into routine engineering practice while Mythos remains a specialist instrument for high-stakes work.
Neither company is competing on availability, which tells you something. When two rivals with opposite technical philosophies both conclude that a capability must be gated, the gating is probably not a marketing decision.
For how these vendors compare on their general-purpose models, where the competition is much more open, our comparison of Gemini 3.5 Flash against GPT-5.5, Claude, and DeepSeek covers the mainline benchmarks and pricing.
Can You Get Access, and What to Do If Not
Almost certainly not, unless you are a government or an established Google security partner. Access runs through the CodeMender limited-access pilot, with expansion promised over time and no published application process, pricing page, or timeline. If you are a normal engineering team, plan as though this model does not exist for you in 2026.
What you can use instead is the foundational CodeMender capability that general Gemini models provide through the Gemini Enterprise Agent Platform. That is not the specialized fine-tune, and the benchmark gaps in this article are exactly the gap you give up, but it is real and available.
More practically, most teams have not exhausted the security value of general models plus conventional tooling. Concrete steps that do not require a pilot invitation:
- Run OSS-Fuzz or a comparable fuzzer against your own codebase, since it is free, it is the data source behind this model, and most teams have never set it up.
- Monitor OSV.dev for vulnerabilities in your dependencies, because the majority of exploitable risk in a typical application arrives through packages rather than your own code.
- Use a general model for code review with narrow, specific prompts about memory safety, input validation, and authentication logic, which stays well inside what mainline models will do.
- Fix the findings you already have. Most organizations have a backlog of known unpatched issues that no AI model needs to discover.
If you want to build the review-and-analysis side yourself rather than wait for access, the gen-ai-experiments cookbook collection has agent patterns you can point at a repository and adapt for structured code review in an afternoon.
The honest framing: an unpatched known vulnerability is a worse problem than an undiscovered one, and no model solves that for you.
What This Means for AI Security in 2026
Flash Cyber marks the point where AI security tooling split into two tiers: general models everyone can use, and specialized security models that require permission. That split is likely permanent, and it will shape defensive security economics for the rest of the decade.
Three consequences worth tracking. First, vulnerability discovery is becoming continuous rather than periodic, because a model cheap enough to run across a whole codebase repeatedly changes scanning from an event into a background process. Second, the gap between organizations with access and without will widen, and it maps onto existing size and geography advantages. Third, we should expect more task-specific fine-tunes, since Flash Cyber is a demonstration that a small tuned model beats a large general one on a narrow job at a fraction of the cost.
The question nobody has answered is what happens on the other side. Attackers are not waiting for a pilot invitation, and open-weight models keep improving. If defensive capability is gated while offensive capability diffuses through models nobody controls, the asymmetry that justifies gating erodes. Google's approach buys defenders time, and time is genuinely valuable, but it is not a permanent solution and I do not think anyone at Google believes it is.
For most readers, the practical takeaway is smaller than the policy debate. You will not get this model. You can adopt the idea behind it: run cheap checks constantly rather than expensive checks occasionally. That is available to everyone right now.
Frequently Asked Questions
What is Gemini 3.5 Flash Cyber?
Gemini 3.5 Flash Cyber is a specialized Google model built on Gemini 3.5 Flash and fine-tuned to find, validate, and patch software vulnerabilities. Released July 21, 2026, it was trained using OSV.dev, which holds more than 700,000 open source vulnerabilities, plus over ten years of OSS-Fuzz results. It runs inside Google's CodeMender security agent.
How do I get access to Gemini 3.5 Flash Cyber?
Access is restricted to governments and trusted partners through a limited-access CodeMender pilot, with expansion promised over time. There is no public pricing page, application process, or timeline. General Gemini models provide foundational CodeMender capabilities through the Gemini Enterprise Agent Platform, which is the realistic alternative for most teams.
What is Google CodeMender?
CodeMender is Google's security agent that uses AI models to find and fix vulnerabilities in code. It invokes Flash Cyber multiple times, up to five per report in benchmark settings, to analyze many more code paths before producing one consolidated vulnerability report. CodeMender already scans Google's Chrome, Android, Cloud, Ads, and YouTube codebases.
Is Gemini 3.5 Flash Cyber better than Claude Opus 4.6?
On Google's V8 JavaScript engine evaluation, yes: Flash Cyber found 55 unique confirmed issues against 36 for Claude Opus 4.6 and 47 for mainline Gemini 3.5 Flash. That result comes from Google testing its own model, and no independent third-party evaluation has been published, so treat the margin as directional rather than settled.
How is Flash Cyber different from Claude Mythos?
Anthropic's Mythos is a large, expensive flagship cyber model priced at 10 dollars per million input tokens and 50 dollars per million output. Flash Cyber is small, task-tuned, and designed to be run many times cheaply across large codebases. Both are access-restricted, and Mythos was temporarily pulled after the United States government raised national security concerns before returning for select American organizations.
Why is Gemini 3.5 Flash Cyber restricted?
Because vulnerability discovery is dual-use: the capability that helps a defender patch a flaw also helps an attacker exploit it. Google restricted access to governments and trusted partners to give frontline defenders a head start while limiting broader misuse. The trade-off is that open source maintainers, small teams, and independent researchers are excluded.
What vulnerabilities has Gemini 3.5 Flash Cyber found?
Google's Cloud Vulnerability Research team used it to uncover remote code execution vulnerabilities in public APIs and a memory corruption flaw in a sensitive production service, all within two hours. It also found 55 unique confirmed issues in the V8 JavaScript engine, and Google reports it has been used across internal Chrome, Android, Cloud, Ads, and YouTube codebases.
Can Gemini 3.5 Flash Cyber be used by attackers?
That risk is exactly why Google gated it. The model is not publicly available, so it cannot be accessed directly by the general public. Google noted that some competitor models refused security analysis tasks entirely due to safety guardrails, which illustrates why access control rather than refusal training is the approach Google chose for defensive security work
The only comprehensive program designed to take you from basic prompting to building interactive Artifacts, custom integrations, and deploying production-ready code with Claude Code.
Recommended Blogs
- Gemini 3.5 Flash Review
- Best AI Models 2026 Ranked
- Gemini 3.5 Flash vs GPT-5.5
- GPT-5.4 Review and Benchmarks
- Gemini 3.1 Flash Lite Speed Test
- GPT-5.4 vs Gemini 3.1 Pro
- Gemini Omni Video Model
Resources & Community
Join our community of 70,000+ AI enthusiasts and learn to build powerful AI applications! Whether you're a beginner or an experienced developer, Build Fast with AI helps you understand and implement AI in your projects.
- Website: buildfastwithai.com
- LinkedIn: Build Fast with AI
- Instagram: @buildfastwithai
- Founder Twitter: @satvikps
- Twitter: @BuildFastWithAI
Agentic AI Launchpad 2026
A structured 6-week cohort program that takes you from AI basics to building and deploying real-world agentic AI systems. Includes live sessions, expert mentorship, project reviews, and a builder community network.
Ready to go from learning to building? Join the next cohort: Agentic AI Launchpad 2026
Free AI Resources
Access free tools, workshops, and micro-learning to keep building:
- AI Workshops: Free resources, upcoming events & past recordings
- Unrot: Learn AI in 5 minutes a day (free micro-learning app)
The models that change your security posture are not always the ones you can buy. Subscribe to Build Fast with AI for the analysis behind each release, not just the spec sheet.
References
- Introducing Flash Cyber (Google DeepMind)
- Flash Cyber model page (Google DeepMind)
- Three-model launch announcement (Google)
- AI to find and fix vulnerabilities (The Hacker News)
- Flash Cyber as vulnerability hunter (Help Net Security)
- Find, validate and patch vulnerabilities (GBHackers)
- Gemini lineup and Mythos rival (CNBC)
