Google has launched Gemini 3.5 Flash Cyber, a specialized cybersecurity model fine-tuned to find, validate, and patch software vulnerabilities faster and more efficiently than mainline Gemini Flash models.
The release marks a significant expansion of Google’s automated security research efforts, building on tools like CodeMender, the company’s AI-driven code security agent.
As AI agents grow more capable at discovering vulnerabilities, defenders face a critical challenge: attackers may find flaws faster than security teams can patch them. Google’s answer isn’t a bigger model, but a smarter, cheaper one.
Built on the Gemini 3.5 Flash foundation, 3.5 Flash Cyber trades raw scale for speed and cost-efficiency, making it practical for large-scale deployment.
This matters because vulnerability hunting is fundamentally a search problem: scanning massive codebases means exploring an enormous number of execution paths, and relying on a single expensive call to a large model creates a bottleneck.
CodeMender solves this by invoking 3.5 Flash Cyber multiple times, letting sub-agents analyze far more code paths in parallel before compiling a single, high-quality vulnerability report. This design makes the model well-suited for frequent scans, time-sensitive launch pipelines, and commit-level scanning at scale.
Gemini 3.5 Flash Cyber
Google tested the model extensively:
- CyberGym benchmark: Using up to five calls per report, CodeMender with 3.5 Flash Cyber achieved competitive results against significantly larger, costlier cybersecurity models.
- Big Sleep evaluation: On complex codebases like Chrome and Safari, 3.5 Flash Cyber significantly outperformed mainline 3.5 Flash and 3.6 Flash.
- Chrome production commit scanning: Tested on undisclosed vulnerabilities (ensuring no data contamination), the model showed a major success-rate uplift over mainline Flash.
- V8 JavaScript Engine test: 3.5 Flash Cyber found 55 unique confirmed issues, versus 47 for mainline 3.5 Flash and 36 for Claude Opus 4.6, including 10 issues neither competitor caught.
Google notes that weaker models often loop on the same finding repeatedly, while a stronger model like 3.5 Flash Cyber casts a wider net and keeps discovering new vulnerabilities as invocation counts scale up.
Beyond benchmarks, 3.5 Flash Cyber is already active in Google’s internal codebases, including Chrome, Android, Cloud, Ads, and YouTube. In one notable case, Google’s Cloud Vulnerability Research team used the model to uncover remote code execution flaws in public APIs and a memory-corruption bug in a sensitive production service, all within two hours.
The model then generated a fully reliable RCE exploit that bypassed protections like ASLR and W^X.
Given its dual-use potential, Google is deploying 3.5 Flash Cyber cautiously. It will initially be available through a limited-access pilot to governments and trusted partners via CodeMender, expanding gradually.
Separately, CodeMender’s core capabilities are also reaching enterprise customers through the Gemini Enterprise Agent Platform.
Google’s advantage stems from decades of security infrastructure: OSV.dev, its database of over 700,000 open-source vulnerabilities, and more than 10 years of OSS-Fuzz results, providing the high-quality training data needed to teach AI models how real security professionals actually work.
The Privilege Paths Attackers See That You Don’t: BeyondTrust Pathfinder Platform Does It for You -> Get Free Identity Security Assessment
The post Gemini 3.5 Flash Cyber With Automated Faster Vulnerability Detection and Patch Capabilities appeared first on Cyber Security News.