Google’s Gemini 3.5 Flash Cyber becomes a vulnerability hunter
Google’s Gemini 3.5 Flash Cyber model finds, validates, and patches vulnerabilities before they can be exploited while helping mitigate broader misuse. It is part of a limited-access pilot program that will soon be available to governments and trusted partners through CodeMender, Google DeepMind’s AI coding agent, with broader access planned over time.
“CodeMender is our managed code security agent, and starting today, we’re bringing its code scanning and remediation capabilities directly to you in preview. CodeMender offers access to our generally available models via Gemini Enterprise Agent Platform, or it can be deployed as a core component of AI Threat Defense,” Michael Gerstenhaber, VP of Product Management, Gemini Enterprise, and Clemens Viernickel, Director of Product Management, Cloud AI, explained.
Lightweight models for code security
Finding complex software vulnerabilities requires analyzing many possible execution paths through a program. Using a single large language model for that task can slow analysis and limit scalability.
Gemini 3.5 Flash Cyber is designed to identify vulnerabilities across large codebases that require analysis of numerous code paths. CodeMender invokes the model multiple times to analyze execution paths, discover and validate vulnerabilities, and enable sub-agents to generate a combined report.
The model can be integrated into frequent security scans, time-sensitive release processes, and commit-scanning pipelines at scale.
Google evaluated Gemini 3.5 Flash Cyber on CyberGym, an evaluation developed by its Big Sleep team, and through Chrome’s production commit-scanning pipeline. The model achieved competitive performance against larger models on CyberGym and outperformed Gemini 3.5 Flash in evaluations conducted by the Big Sleep team and through Chrome’s production pipeline.
CyberGym evaluation (Source: Google)
During testing on the V8 JavaScript engine, it found 55 unique confirmed issues, including 10 that Gemini 3.5 Flash and Claude Opus 4.6 did not detect.
Google uses the model to identify and fix vulnerabilities across internal codebases, including Chrome, Android, Cloud, Ads, and YouTube.
Raluca Ada Popa, Head of Security & Privacy Research, Gemini Security Lead at Google DeepMind, and Four Flynn, VP, Security and Privacy at Google Deepmind said that the model uncovered remote-code-execution vulnerabilities in public APIs and a memory-corruption vulnerability in a sensitive production service within two hours. It also generated a 100% reliable remote-code-execution exploit that bypassed Address Space Layout Randomization and Write XOR Execute protections.
New Gemini models
Building on Gemini 3.5 Flash, Google introduced two additional models: Gemini 3.5 Flash-Lite and Gemini 3.6 Flash.
Gemini 3.5 Flash-Lite is designed for low-latency, high-throughput workloads such as agentic search and document processing. It supports configurable reasoning levels and includes built-in computer-use capabilities for agentic workflows.
Gemini 3.6 Flash is new model for coding, knowledge work, multimodal tasks, and agentic workflows. It uses fewer output tokens, reasoning steps, and tool calls than Gemini 3.5 Flash, reducing the cost of multi-step tasks while improving performance across coding, computer use, and knowledge-based benchmarks.
“3.6 Flash is shipping with enhanced Frontier Safety safeguards in the domains of Chemical, Biological, Radiological, and Nuclear (CBRN) and cyber offense misuses. These safeguards make the model substantially more resistant to jailbreaks. At the same time, the model has been trained to minimize refusals for beneficial uses,” Tulsee Doshi, Senior Director of Product Management, explained on behalf of the Gemini team.