Google Launches Gemini 3.5 Flash Cyber, a Lightweight AI Engine for Faster Vulnerability Detection

Google has introduced Gemini 3.5 Flash Cyber, a specialized cybersecurity model fine-tuned from its 3.5 Flash foundation to find, validate, and patch software vulnerabilities faster and more cheaply than mainline large language models.

The release, rolled into Google’s CodeMender code security agent, signals a strategic pivot toward efficient, high-volume vulnerability hunting rather than relying solely on massive, expensive AI systems.

Google frames the release around what it calls the “search space problem”: uncovering deep-seated flaws in sprawling codebases demands exploring an enormous number of execution paths, something a single call to a costly frontier model struggles to do efficiently.

Google Launches Gemini 3.5 Flash Cyber

By invoking 3.5 Flash Cyber multiple times, CodeMender’s sub-agents can canvass far more code paths before consolidating findings into one high-quality report, making the model ideal for frequent scans, time-sensitive launch checks, and commit-scanning pipelines at scale.

On the CyberGym benchmark, which tests AI agents against hundreds of real-world software vulnerabilities, CodeMender configured to call 3.5 Flash Cyber up to five times per report achieved performance competitive with significantly larger cybersecurity models, based on provider-reported competitor scores.

In a separate, guardrail-free stress test built by Google’s Big Sleep team targeting complex codebases like Chrome and Safari, 3.5 Flash Cyber substantially outperformed mainline 3.5 Flash and 3.6 Flash.

When run against Chrome’s production commit-scanning pipeline using undisclosed vulnerabilities to avoid contamination, 3.5 Flash Cyber again showed a marked uplift over standard 3.5 Flash, with newer competitor models like versions beyond Opus 4.6 reportedly declining the tasks due to built-in safety refusals.

On the V8 JavaScript engine specifically, the model surfaced 55 unique confirmed issues versus 47 for mainline 3.5 Flash and 36 for Claude Opus 4.6, catching 10 flaws the other models missed entirely.

Beyond benchmarks, 3.5 Flash Cyber is already active inside CodeMender across Google’s internal codebases, including Chrome, Android, Cloud, Ads, and YouTube.

In one case, Google’s Cloud Vulnerability Research team used the model to uncover remote code execution flaws in public APIs and a memory-corruption bug in a sensitive production service within just two hours, generating a fully reliable exploit that bypassed ASLR and W^X mitigations.

Testers from Wiz and Cloud CISO Security Engineering have reportedly confirmed the capability jump over standard 3.5 Flash.

Because the same capability that finds bugs for defenders could help attackers weaponize them, Google is limiting initial access to governments and trusted partners through a pilot program tied to CodeMender, with plans to expand access over time.

Separately, CodeMender’s core capabilities are becoming broadly available to enterprise customers through the Gemini Enterprise Agent Platform, decoupling general vulnerability-fixing tools from the more sensitive, high-powered Cyber model.

Google is also leaning on its existing security infrastructure to sharpen the model, drawing on OSV.dev’s database of over 700,000 open-source vulnerabilities and more than a decade of OSS-Fuzz results to train it on real-world, rather than synthetic, security workflows.

This positions 3.5 Flash Cyber less as a one-off product launch and more as an evolving layer atop Google’s decade-long automated vulnerability discovery program, extending tools like CodeMender and Big Sleep into a faster, cheaper operational tier for defenders everywhere.