Google launches Gemini 3.5 Flash Cyber to find and fix software vulnerabilities faster

Google launches a cheaper alternative to large AI security models like Mythos

Google is launching an AI security model dedicated to quickly finding and patching security vulnerabilities. In a blog post on Tuesday, Google describes Gemini 3.5 Flash Cyber as a "cost-efficient and highly capable alternative" to larger, more expensive AI systems, such as the one offered by Anthropic's Mythos. The new model is built upon Gemini 3.5 Flash and will be available first to governments and trusted partners via CodeMender, Google's security-focused coding agent. As noted by Google, CodeMender can call upon 3.5 Flash Cyber "multiple times at high speed and low cost," allowing the AI agents to scan more code paths and find vulnerabilities. Anthropic's Mythos 5 is a powerful AI security model released as part of the company's Project Glasswing initiative. The compute-heavy model is expensive to use, costing twice as much as Claude Opus 4.8. Microsoft, which adopted Mythos for its security checks, had its biggest Patch Tuesday this month after using AI to find vulnerabilities. Other companies, like Google, are racing to keep up, while China's Z.ai claims its model can compete with Mythos. Google says 3.5 Flash Cyber achieved "competitive performance" compared to "significantly larger models" on the CyberGym AI cybersecurity benchmark when called upon up to five times. It also identified 55 "unique confirmed issues" in the V8 JavaScript Engine, compared to 47 found by Gemini 3.5 Flash and 36 by Opus 4.6. Google adds that 3.5 Flash Cyber found 10 issues that no other model discovered, noting that the model continued to find new code paths and vulnerabilities after being invoked multiple times.

Google Launches Gemini 3.5 Flash Cyber AI to Find and Fix Software Vulnerabilities

Google's DeepMind on Tuesday announced the release of Gemini 3.5 Flash Cyber, a specialized artificial intelligence (AI) model built atop 3.5 Flash that's designed to discover, validate, and patch vulnerabilities quickly and efficiently. According to the tech giant, the model will be exclusively available to governments and trusted partners via CodeMender as part of a limited-access pilot program. CodeMender is an AI-powered agent for vulnerability discovery and patching that was unveiled by the company in October 2025. The lightweight model, per DeepMind, is both cost-efficient and highly capable alternative to large, costly cybersecurity-focused models. CodeMender can call upon 3.5 Flash Cyber "multiple times at high speed and low cost," allowing the AI agent to scan more code paths and find vulnerabilities. The release of 3.5 Flash Cyber comes alongside Gemini 3.6 Flash and 3.5 Flash-Lite, which are optimized for improved coding, knowledge work, and multimodal performance and low-latency tasks, respectively. "Given the dual-use nature of this technology, we have taken an intentional approach to how we deploy 3.5 Flash Cyber," Raluca Ada Popa, DeepMind's Gemini Security Lead, and Four Flynn, vice president of security and privacy at DeepMind, said in a blog post shared with The Hacker News ahead of publication. "As part of a limited-access pilot program, 3.5 Flash Cyber will be exclusively available to governments and trusted partners via CodeMender, expanding over time. This will give frontline defenders a head start in finding and fixing critical vulnerabilities before they can be exploited, while mitigating against broader misuse." In evaluations conducted by the AI research laboratory, 3.5 Flash Cyber has been found to outperform Gemini 3.5 Flash and 3.6 Flash when it comes to unearthing new vulnerabilities in codebases. Additional stress-testing of the model on complex projects like Google Chrome and Apple Safari has revealed it to have "significantly" surpassed Gemini 3.5 Flash, 3.6 Flash, and Anthropic Claude Opus 4.6. "3.5 Flash Cyber consistently discovered more unique vulnerabilities compared with 3.5 Flash and Claude Opus 4.6," it pointed out. "When tested on the highly complex V8 JavaScript Engine across a fixed number of invocations, Gemini 3.5 Flash Cyber found 55 unique confirmed issues, compared to 47 found by Gemini 3.5 Flash and 36 found by Opus 4.6, including 10 issues that no other model caught." Like in the case of Anthropic and OpenAI, Google has put 3.5 Flash Cyber to the test to uncover remote code execution vulnerabilities in public APIs and a memory-corruption vulnerability in a sensitive production service. The model is also said to have produced a 100% reliable remote-code execution exploit that bypassed standard mitigation techniques like Address Space Layout Randomization (ASLR) and Write XOR Execute (W^X). Google said it's separately bringing CodeMender's foundational capabilities directly to customers with generally available Gemini models through the Gemini Enterprise Agent Platform. "By powering CodeMender with 3.5 Flash Cyber, we're providing a highly capable, scalable, and affordable architecture designed to help more defenders secure software," it added.

Google releases Gemini 3.5 Flash Cyber: a lighter AI to fix flaws faster

Pilot access is limited to governments and trusted partners Google rolled out Gemini 3.5 Flash Cyber and CodeMender today, a new security model and agent built to help organizations spot, verify, and fix software vulnerabilities across large codebases. For now, Gemini 3.5 Flash Cyber is only being offered through a pilot program for governments and trusted partners. The company is pitching Gemini 3.5 Flash Cyber as a lighter, cheaper option than heavier cyber models, one meant to move through large numbers of code paths quickly. In early internal testing, Google says it found remote code execution flaws and a memory-corruption bug in a production service in about two hours. CodeMender is supposed to go a step further than simply flagging a possible issue. It can help determine whether a suspected bug is actually real, then suggest fixes, which could cut down the time between discovery and remediation. Access is being kept tight for a reason. Tools that help defenders uncover weak points can also give attackers a head start, so Google is taking the same cautious route Anthropic and OpenAI have used with cyber-focused systems. If you're running security reviews at scale, this looks like something worth trying once access opens up more broadly. Still, it doesn't remove the need for human review. False positives, hard-to-explain decisions, and simple over-trust are still very real problems. That caution lines up with the broader picture. One survey found that 78% of professionals had seen automated tools miss critical bugs. Separate survey data says 78% of organizations now use AI in cybersecurity, but only 27% consider those deployments mature. If you want to get your hands on Gemini 3.5 Flash Cyber first, the entry point is that pilot for governments and trusted partners.