Google DeepMind has released Gemini 3.5 Flash Cyber, an AI model specialized in software vulnerabilities for the security agent CodeMender. In a test on the V8 JavaScript engine, the model identified 55 confirmed vulnerabilities, outperforming the in-house Flash model and Anthropic’s Claude Opus 4.6. Access is initially limited to governments and selected partners chosen by Google.
CodeMender scans significantly more code paths with the model
CodeMender is Google’s AI agent introduced in October 2025 that automatically detects and fixes security vulnerabilities in software. Until now, the system primarily relied on individual, costly queries to large language models. With Gemini 3.5 Flash Cyber, CodeMender can call the leaner model many times in quick succession and at low cost, allowing it to check significantly more code paths in parallel before consolidating the individual results into a single report.
Google describes the idea behind it as a response to a search space problem: vulnerabilities often hide in rare code paths that can only be reliably found through repeated, broad scanning. The Google DeepMind experts responsible for security, Raluca Ada Popa and Four Flynn, explain that the model runs exclusively within the isolated environment of CodeMender. This allows the defensive function to be used without making the underlying attack capabilities freely accessible.
Unlike Google’s large Gemini models, Flash Cyber is intentionally kept compact - that is precisely what makes the many parallel queries affordable. According to the company, the combination of speed and low cost will also allow continuous checking of individual code commits, rather than limiting scans to rare, resource-intensive runs.
V8 test shows more hits than Claude Opus 4.6
In an internal comparison test on Google’s open-source JavaScript engine V8, Gemini 3.5 Flash Cyber found 55 clearly confirmed vulnerabilities. The regular Gemini 3.5 Flash achieved 47 hits in the same test, while Anthropic’s Claude Opus 4.6 found 36. According to Google, ten of the identified issues were not detected by any of the comparison models.
On the specialized benchmark CyberGym, which measures AI agents against hundreds of real software vulnerabilities, the smaller model reportedly reaches a level that competes with significantly larger security models. In another internal evaluation called Big Sleep, which focuses on critical vulnerabilities in complex software such as the browsers Chrome and Safari, Flash Cyber reportedly outperformed both the regular 3.5 Flash and the newer 3.6 Flash model by a wide margin. In Chrome’s production pipeline, the model delivered a noticeable improvement over 3.5 Flash, while some competing models now refuse such tasks for safety reasons.
Google’s own Cloud Vulnerability Research team also deployed the system productively: it found several critical vulnerabilities in public APIs and internal services within two hours and generated a reliably functioning exploit that bypassed protections such as ASLR and W^X. The figures come from Google’s own tests and have not been independently verified.
Access remains limited to governments for now
Google is initially opening Gemini 3.5 Flash Cyber only as part of a limited pilot program for governments and selected partners through CodeMender. The company justifies the restriction with the dual-use nature of the technology: the same capabilities that reveal vulnerabilities for defenders could, per the same report, also be misused for attacks. Google has not given a fixed timeline for a broader release, only announcing that it will “expand the circle over time,” including features for red-teaming.
Companies without pilot access, including in Germany and the rest of the EU, can use CodeMender’s basic functions through the generally available Gemini Enterprise Agent Platform - though regular, larger Gemini models are used there instead of the specialized Cyber variant. Google has not yet disclosed prices for Flash Cyber itself. The launch also comes at a time when Google’s flagship model Gemini 3.5 Pro, originally slated for the second quarter of 2026, is further delayed due to weak programming performance - while the leaner Flash line keeps getting new features quickly.
What matters now is whether Google widens access before comparable open models hand attackers similar capabilities for free. Defenders only really benefit from tools like Flash Cyber if they become available at least as fast as the attack tools they are meant to counter.
