$ cat wiki/models/gemini-3-5-flash-cyber.md
Gemini 3.5 Flash Cyber
modelupdated 2026-07-22created 2026-07-22
Spec
| Attribute | Value |
|---|---|
| Developer | Google DeepMind |
| Released | 2026-07-21 (limited pilot) |
| Announced | 2026-07-21 |
| Context window | unknown (Flash-family; likely 1M) |
| Pricing | No public pricing |
| License | proprietary |
| Availability | Restricted — governments and trusted partners only, via CodeMender pilot |
Benchmarks
Chrome V8 JavaScript engine vulnerability finding:
| System | Chrome V8 Vulns Found |
|---|---|
| Gemini 3.5 Flash Cyber (this model) | 55 |
| Gemini 3.5 Flash (base) | 47 |
| Anthropic Claude Opus 4.6 | 36 |
| Issues found by Cyber but not by either competitor | 10 |
Use Cases
- Large-scale automated vulnerability scanning
- Software dependency analysis and patch suggestion
- Cybersecurity red-teaming (government and trusted enterprise)
- Integration with security agent pipelines (CodeMender)
Key Differentiators
- Purpose-built for security: fine-tuned from the base Gemini 3.5 Flash checkpoint specifically to detect, validate, and suggest fixes for software vulnerabilities
- Dual-use rationale for access restriction: Google explicitly restricts this model because its capabilities are directly applicable to both defense and offense; "detecting is describing" in vulnerability space
- Integrated into CodeMender: Google's CodeMender security agent (launched October 2025) calls this model "multiple times at high speed and low cost" to scan wide code paths
- Outperforms base Flash: 55 vs. 47 unique Chrome V8 vulnerabilities — a 17% improvement by restricting the training distribution to security tasks
- Outperforms Claude Opus 4.6: despite being a lighter Flash-tier model, the specialization yields more discoveries than a frontier-tier general model
Access
Limited-access CodeMender pilot for governments and trusted partners only. No self-serve API. Broader rollout planned over time. Dual-use justification: same capability that defends also attacks.
Related
- Google DeepMind — developer
- Gemini 3.6 Flash — general-purpose sibling, released same day
- Gemini 3.5 Flash-Lite — high-throughput sibling, released same day
- AI-Enabled Cyberattacks — the threat landscape this model addresses
- AI Governance — dual-use model restriction rationale
Sources
- DeepMind blog (Flash Cyber, July 21): https://deepmind.google/blog/introducing-gemini-3-5-flash-cyber/
- The Hacker News: https://thehackernews.com/2026/07/google-launches-gemini-35-flash-cyber.html
- Google Blog: https://blog.google/innovation-and-ai/models-and-research/gemini-models/gemini-3-6-flash-3-5-flash-lite-3-5-flash-cyber/