Gemini 3.6 Flash, 3.5 Flash-Lite and 3.5 Flash Cyber: Google's security model is the one to watch

Google DeepMind released three Gemini models on 21 July 2026. Two are cheaper, faster workhorses anyone can use today. The third finds and patches security vulnerabilities, and Google is keeping it behind a gate.

The three at a glance

Gemini 3.5 Flash Cyber

This is the interesting release, and Google’s own framing tells you why. The company says AI models have reached the point where they find security vulnerabilities faster than existing systems can fix them. Flash Cyber is built to close that gap from the defensive side.

What it actually is

Flash Cyber is Gemini 3.5 Flash, fine-tuned for three jobs: discovering vulnerabilities, validating that they are real, and producing patches. It runs inside CodeMender, the code-security agent DeepMind unveiled in October 2025.

The design choice worth understanding is why Google built this on a small, cheap model. Scanning a codebase the size of Chrome with a large flagship model is slow and expensive, so you do it rarely. A cheap model changes the economics: CodeMender calls Flash Cyber repeatedly, up to five times for a single report, running several subagents in parallel across different execution paths and then consolidating what they find. Breadth of coverage comes from volume of calls.

Google notes that basic security models tend to get stuck in loops, finding the same issue over and over while missing others. The multi-agent structure is the answer to that.

The numbers

Google’s Big Sleep team, the vulnerability research group behind its AI bug-hunting work, built an independent evaluation on complex, security-critical software including Chrome and Safari. On the V8 JavaScript engine, across a fixed number of invocations:

Ten of Flash Cyber’s findings appeared in no other model’s results. On CyberGym, a public benchmark that tests AI agents against real-world software vulnerabilities, Flash Cyber scored 83.2 percent against 85.6 percent for OpenAI’s GPT-5.5-Cyber, a considerably larger model.

Read the benchmarks carefully

Two caveats deserve attention, and Google states both openly.

The Big Sleep vulnerabilities were held back from public disclosure, which keeps the evaluation clean of training-data contamination for Google’s models and its competitors. That is good practice, and it also means nobody outside Google can reproduce the result.

The second is more revealing. Google notes that competitor models released after Opus 4.6 decline to perform these tasks because of built-in safety guardrails, so they were left out of the comparison. The scoreboard is therefore drawn from the models willing to hunt for exploitable bugs. That is a real finding about where the industry sits on dual-use capability, and it complicates any straightforward reading of the rankings.

Why it is locked down

Raluca Ada Popa, DeepMind’s Gemini Security Lead, and Four Flynn, its vice president of security and privacy, wrote that the dual-use nature of the technology shaped how it is being deployed. Flash Cyber goes out through a limited-access pilot, exclusively to governments and trusted partners via CodeMender, expanding over time. The stated aim is to give frontline defenders a head start on finding and fixing critical vulnerabilities while limiting broader misuse.

A model that reliably locates exploitable flaws in Chrome is valuable to whoever holds it. Google is betting that a controlled rollout tilts the balance toward defence.

DeepMind has told reporters it plans to extend the model into red-teaming and end-to-end enterprise defence.

Gemini 3.6 Flash

The headline general-purpose release, and the story here is efficiency. Google says 3.6 Flash consumes about 17 percent fewer output tokens than 3.5 Flash on the Artificial Analysis Index, with reductions of up to 65 percent reported on the DeepSWE benchmark, while taking fewer reasoning steps and tool calls through multi-step workflows.

Performance moved up alongside the cost coming down:

• DeepSWE: 49 percent against 37 percent for 3.5 Flash
• MLE-Bench: 63.9 percent against 49.7 percent
• OSWorld-Verified: 83.0 percent against 78.4 percent, the best score in Google’s comparison table
• GDPval-AA v2: 1421 against 1349

Output runs at roughly 304 tokens per second. The knowledge cutoff advances from January 2025 to March 2026, which is a meaningful jump for anyone building on current libraries. Computer use is now a built-in client-side tool through the Gemini API and Gemini Enterprise.

For agent builders paying per token on loops that run continuously, a 17 percent token reduction stacked on a price cut from $9 to $7.50 per million output tokens is the practical headline.

Gemini 3.5 Flash-Lite

The cheapest and fastest of the three, aimed at agentic search, document processing and other high-volume work. Against the 3.1 Flash-Lite it replaces, the gaps are wide: 54 percent against 31 percent on Terminal-Bench 2.1, 72.2 percent against 60.1 percent on GDM-MRCR v2, and 1140 against 642 on GDPval-AA v2.

It also beats the older 3 Flash on SWE-Bench Pro (54.2 percent against 49.6) and OSWorld-Verified (74.0 against 65.1), which is a small model outperforming a previous generation’s larger one. Thinking levels are configurable across minimal, low and higher, so the same model covers cheap high-volume execution and multi-step subagent work.

The gap in the middle

Google introduced Gemini 3.5 Pro at I/O in May 2026 and said it would arrive the following month. It has now slipped past that by some margin, with Google saying only that it is testing with partners and will ship when ready. In the same announcement the company said it has begun what it calls its most ambitious pre-training run yet, for Gemini 4.

So the shape of the day is three solid additions at the cheap, fast end of the range while the frontier model stays out of sight.

What this means if you are building

If you run agents at volume, 3.6 Flash is a straightforward upgrade: better scores, fewer tokens, lower price. If your workload is high-throughput document or search work, Flash-Lite is now hard to argue with on cost.

Flash Cyber you almost certainly cannot have, and that is the point worth sitting with. The most capable security model Google has built is being handed to governments and vetted partners first. Whatever you think of that decision, it is now the pattern: as capability sharpens, distribution narrows.