Google has pulled back the curtain on Gemini 3.5 Flash Cyber, a lightweight model purpose-built for cybersecurity that is already finding real vulnerabilities inside the company's own most critical codebases. In internal testing on the V8 JavaScript engine, the model found 55 unique confirmed issues across a fixed number of invocations. Mainline Gemini 3.5 Flash found 47, and Anthropic's Claude Opus 4.6 found 36, including 10 issues that neither of the other two models caught.
Gemini 3.5 Flash Cyber is built on top of the 3.5 Flash architecture and fine-tuned specifically for vulnerability discovery, validation, and patching. It is deployed as the engine inside CodeMender, Google's code security agent, which invokes the model multiple times in parallel to scan vast code paths and produce a single combined report. That architecture allows the system to cast a wider net than a single expensive call to a large frontier model.
On the CyberGym benchmark, which tests AI agents against hundreds of real-world software vulnerabilities, CodeMender powered by 3.5 Flash Cyber reached competitive performance at the frontier. The model was also stress-tested by Google's vulnerability research teams on production commit-scanning pipelines for Chrome, Android, Cloud, Ads, and YouTube. In one striking example, the Cloud Vulnerability Research team used the model to find remote code execution vulnerabilities in public APIs and a memory-corruption flaw in a sensitive production service, then generated a fully reliable exploit that bypassed ASLR and W^X protections, all within two hours.
Google is deliberately restricting access. Gemini 3.5 Flash Cyber will be available only to governments and trusted partners through CodeMender as part of a limited-access pilot program. The company said the dual-use nature of the technology makes broad release irresponsible at this stage. The goal is to give frontline defenders a head start in fixing critical flaws before they can be exploited.
Beyond the immediate vulnerability-finding capabilities, the model's low cost and high speed make it suitable for integration into frequent scans, time-sensitive launch processes, and commit-scanning pipelines at scale. For organizations already grappling with the reality that AI can find flaws faster than humans can fix them, Google is betting that a specialized, efficient model is the right countermeasure.