Google Launches Gemini 3.5 Flash Cyber, a Lightweight AI Model Built for Vulnerability Detection

Google has unveiled Gemini 3.5 Flash Cyber, a specialized lightweight artificial intelligence model built for cybersecurity, derived from the 3.5 Flash foundation and fine-tuned to quickly identify, validate, and patch software vulnerabilities. Integrated with CodeMender, Google's code security agent, this model provides a cost-effective and scalable alternative to expensive, large-scale cybersecurity models currently available in the market. Recognizing the dual-use implications of this technology, Google has adopted a controlled distribution strategy. Gemini 3.5 Flash Cyber will be available exclusively to governments and trusted partners through CodeMender in a limited-access pilot program, with gradual expansion planned. This measured approach ensures frontline security defenders gain priority access to discover and remediate critical vulnerabilities before exploitation, while mitigating broader misuse risks. The model's strength lies in its ability to analyze multiple code paths through repeated invocations, overcoming the bottlenecks inherent in single-call approaches with expensive large language models. Performance evaluations across various benchmarks, including CyberGym, demonstrate that Gemini 3.5 Flash Cyber achieves competitive results against significantly larger models, even when configured for multiple calls per analysis. In rigorous internal stress tests on complex codebases such as Chrome and Safari, the model substantially outperformed mainline 3.5 Flash and 3.6 Flash variants. When tested on the V8 JavaScript Engine, Gemini 3.5 Flash Cyber identified 55 confirmed unique vulnerabilities compared to 47 found by mainline 3.5 Flash and 36 by Claude Opus 4.6, uncovering 10 vulnerabilities that neither competing model detected. Real-world deployment already demonstrates measurable impact. Google Cloud's Vulnerability Research team used Gemini 3.5 Flash Cyber to proactively secure systems in record time, uncovering remote code execution flaws in public APIs and memory corruption issues in a critical production service within just 2 hours. The model generated 100% reliable exploits that successfully bypassed standard mitigations like ASLR and W^X protections.