Gemini 3.5 Flash Cyber release notes

Google DeepMind has released Gemini 3.5 Flash Cyber, a lightweight model fine-tuned specifically to find, validate, and patch software vulnerabilities. By prioritizing efficiency and speed over raw model size, the model enables defenders to scan larger codebases and analyze more execution paths more quickly than is possible with larger, more expensive models.

High-Efficiency Vulnerability Discovery

Gemini 3.5 Flash Cyber addresses the "search space problem" in code security, where finding deep-seated flaws requires exploring an immense number of execution paths. Because the model is lightweight and affordable, it can be invoked multiple times by agents like CodeMender to analyze vastly more code paths before producing a single high-quality report.

This architecture allows the model to be integrated into:

• Frequent security scans
• Time-sensitive launch processes
• Commit scanning pipelines at scale

Performance Benchmarks

Gemini 3.5 Flash Cyber demonstrates competitive performance against larger models across several specialized evaluations:

CyberGym Benchmark

On the CyberGym benchmark, which evaluates AI agents against real-world software vulnerabilities, CodeMender configured to call 3.5 Flash Cyber up to five times for a single report achieved performance competitive with significantly larger models.

Big Sleep Evaluation

In an independent evaluation by Google’s Big Sleep team focusing on critical vulnerabilities in complex codebases like Chrome and Safari, 3.5 Flash Cyber significantly surpassed the performance of mainline 3.5 Flash and 3.6 Flash models.

Chrome Production Commit Scanning

In tests on Google Chrome’s production commit scanning pipeline, 3.5 Flash Cyber showed a significant uplift over 3.5 Flash. The report notes that more recent competitor models (post-Opus 4.6) refused tasks due to built-in safety guardrails.

V8 JavaScript Engine Testing

When tested on the V8 JavaScript Engine, 3.5 Flash Cyber discovered 55 unique confirmed issues across a fixed number of invocations, compared to 47 found by mainline 3.5 Flash and 36 found by Claude Opus 4.6. This included 10 issues that neither of the other two models identified.

Real-World Application and Deployment

Gemini 3.5 Flash Cyber is already being used within Google's internal codebases, including Android, Chrome, Cloud, Ads, and YouTube.

In one instance, Google’s Cloud Vulnerability Research team used the model to uncover remote code execution vulnerabilities in public APIs and a memory-corruption vulnerability in a sensitive production service within two hours. The model subsequently generated a 100% reliable remote-code execution exploit that bypassed standard mitigations such as Address Space Layout Randomization (ASLR) and Write XOR Execute (W^X).

Access and Availability

Due to the dual-use nature of the technology, Google is deploying 3.5 Flash Cyber through a limited-access pilot program. It will be available exclusively to governments and trusted partners via CodeMender.

Separately, the foundational capabilities of CodeMender are being made generally available to customers through the Gemini Enterprise Agent Platform.