Google DeepMind has joined the race to develop AI-powered cybersecurity solutions with the launch of Gemini 3.5 Flash Cyber, a lightweight model designed to identify, validate, and remediate software vulnerabilities. It is also significantly more cost-effective to operate than its much larger rivals, Mythos and OpenAI’s Daybreak.
“Finding security vulnerabilities is only part of the battle. Fixing them takes time and resources,” wrote Google’s Vice President of Security, Heather Adkins, while congratulating the Google DeepMind team on the release of the new model.
Google’s security chief praised the launch of Gemini 3.5 Flash Cyber.
Google also introduced two updated Flash models on Tuesday: Gemini 3.6 Flash, a faster, smaller, and more cost-efficient model for coding, and Gemini 3.5 Flash-Lite, which is now considered the fastest model in the Gemini family, delivering up to 350 tokens per second.
Google said the “cost-effective and high-performance” Gemini 3.5 Flash Cyber is built on Gemini 3.5 Flash and was specifically designed to power CodeMender, the company’s AI-powered security tool introduced last October.
CodeMender, which now uses Gemini 3.5 Flash Cyber to scan code, generate exploits, and create patches, was integrated into the broader Gemini Enterprise Agent Platform in May.
“As AI agents become increasingly capable of finding vulnerabilities faster than defenders can fix them, addressing this global challenge requires a high-performance, affordable, and scalable approach,” Google DeepMind said.
According to an announcement published Tuesday on the DeepMind website, the dual-purpose system combines advanced cybersecurity capabilities with lower operating costs, allowing organizations to deploy multiple AI agents simultaneously to scan large codebases and investigate vulnerabilities.
Google also claims that internal testing showed Gemini 3.5 Flash Cyber performs competitively against significantly larger AI systems despite its smaller size. In some cases, it even identified vulnerabilities that competing models failed to detect.
Google says Gemini 3.5 Flash Cyber is particularly well suited for vulnerability research when an AI agent must scan large codebases and analyze a vast number of execution paths.
To evaluate its capabilities, Google tested the model across multiple benchmarks using CyberGym, a framework that measures AI agents against hundreds of real-world software vulnerabilities. According to the company, the model’s speed enables a measurable improvement in vulnerability discovery.
“CodeMender calls Gemini 3.5 Flash Cyber multiple times, allowing agents to analyze significantly more code paths to identify and validate vulnerabilities. Sub-agents then consolidate the findings into a single high-quality report,” Google said.
In one benchmark involving the V8 JavaScript engine, Gemini 3.5 Flash Cyber identified 55 confirmed vulnerabilities, compared with 47 found by the more general-purpose Gemini 3.5 Flash. The model also discovered 19 more vulnerabilities than the 36 identified by Claude Opus 4.6 during testing. Google further claimed that Gemini 3.5 Flash Cyber uncovered 10 vulnerabilities that none of the other evaluated systems detected.
The company also said the cybersecurity-focused model outperformed standard Gemini Flash models on Chrome commit analysis and Big Sleep evaluations while remaining significantly less expensive to operate.
Google said Gemini 3.5 Flash Cyber will initially be available through its CodeMender AI security agent to government agencies, trusted testing partners, and selected security researchers before a broader public rollout. The phased release mirrors the initial deployment of Anthropic’s powerful Mythos and Fable models, whose wider availability was delayed due to national security concerns.
“This will give defenders a head start in identifying and fixing critical vulnerabilities before they can be exploited, while helping prevent misuse,” Google said.
Separately, Google announced that it is also making the core capabilities of CodeMender publicly available through the preview version of its Gemini Enterprise Agent Platform.
