What Is Gemini 3.5 Flash Cyber? Google's Gated Vulnerability-Hunting Model, Explained

On July 21, 2026, Google DeepMind announced Gemini 3.5 Flash Cyber — the third and most unusual of three models it shipped that day, alongside the general-purpose Gemini 3.6 Flash and Gemini 3.5 Flash-Lite. It is not a general model you can chat with or call from an API. It is a code-security specialist: a model fine-tuned from Gemini 3.5 Flash to find, validate, and patch software vulnerabilities, running inside Google's CodeMender agent. And crucially, it is gated — available only to governments and “trusted partners” in a limited-access pilot, with no public availability, no self-serve signup, and no published price.

That makes it fundamentally different from its siblings, which are generally available and priced per token like any other model on a price sheet. Flash Cyber has no price sheet, because it has no public product to attach one to — it lives entirely inside a walled pilot program. This explainer goes deeper than the headline: what Flash Cyber actually is, which of its performance numbers are genuinely independent versus Google's own internal testing, how the access and pricing situation really works, and who — realistically — this model is even for.

TL;DR verdict. Gemini 3.5 Flash Cyber is a real, gated code-security model that runs inside CodeMender to find and patch software vulnerabilities. It is not GA, has no public API or pricing, and is restricted to governments and trusted partners. On the one third-party benchmark cited (CyberGym) it's reported at ~83.2%, tightly clustered with OpenAI's GPT-5.5-Cyber (85.6%) and Anthropic's Mythos 5 (83.8%) — Google's edge is framed as cost-efficiency, not a capability blowout. Most other benchmark claims, including the V8 issue-count figures, are Google's own internal evaluations.

Key takeaways

•  It's a code-security specialist, tuned to find, validate, and patch software vulnerabilities — not a SOC/threat-intel or malware-triage tool, and not a general chatbot.

•  It's gated, not GA. Access is limited to governments and trusted partners via the CodeMender platform; there is no public API and no published per-token price.

•  Fine-tuned from Gemini 3.5 Flash, and deployed as multiple parallel sub-agent calls per vulnerability report (Google mentions up to ~5), merged into one result. Context window is not disclosed.

•  One third-party benchmark. CyberGym ~83.2% (press-reported), vs GPT-5.5-Cyber 85.6% and Mythos 5 83.8%. Other results (Big Sleep, Chrome, V8) are Google's own internal evals.

•  Dual-use, deliberately. A model this good at finding exploitable bugs is dangerous if misused, so Google's main mitigation is access control, plus human approval before any patch and sandboxed validation of findings.

•  It's a different model from Sec-Gemini. Google's earlier, separate threat-intelligence model handles incident and root-cause analysis; Flash Cyber is narrowly about patching code vulnerabilities.

•  It's built for defenders, not developers. Intended users are frontline security teams, governments, and vetted enterprise partners doing vulnerability research at scale — explicitly not consumers or general app developers.

Most performance figures here are Google's own internal evaluations; only CyberGym is a genuine third-party benchmark, and even the specific 83.2% figure is better sourced to press analysis than to Google's verbatim text — cite it as “reported.” Do not describe Flash Cyber as generally available or quote a per-token price; it is gated and unpriced. Do not confuse it with Sec-Gemini, Google's separate 2025 threat-intel model.

What Gemini 3.5 Flash Cyber is

“Cyber” here means code and software security — specifically finding, confirming, and fixing vulnerabilities in source code. It is not a security-operations analyst, a threat-intel assistant, or a malware classifier, and it doesn't answer general questions the way a chat model does. It runs inside CodeMender, Google DeepMind's AI agent for automated code-security patching (first shown in October 2025), rather than being sold as a standalone chat or API product. That framing matters: Flash Cyber isn't a model you point at a codebase yourself, it's a component inside a larger, tightly controlled pipeline that Google operates on behalf of its pilot partners.

In practice, several Flash Cyber sub-agents run in parallel on a codebase — Google mentions as many as roughly five per vulnerability report — and their individual findings are merged into a single, consolidated report. That's an agentic, multi-call architecture rather than a one-shot chatbot exchange, which is a big part of why Google frames it as competitive against much larger models: the advantage comes from how it's orchestrated, not necessarily from raw model size. Before any fix ships, a human approves it, and the underlying vulnerability is validated in a sandbox — the model proposes and finds, but people and infrastructure gate what actually gets deployed.

It is fine-tuned from Gemini 3.5 Flash. Google has not disclosed a context-window size or multimodal capabilities specific to Flash Cyber, which is itself a data point: unlike the generally available Flash models, there's no spec sheet to check. Its intended users are frontline defenders, governments, and vetted enterprise partners doing vulnerability research and patch triage at scale — explicitly not consumers or general developers, and explicitly not a product you can add to your own stack by signing up.

Benchmark deep-dive: what the numbers mean

There is exactly one third-party benchmark in the record, and it's worth understanding what it actually tests. CyberGym is an academic benchmark — built by a group that includes UC Berkeley's Dawn Song — that evaluates agents against more than 1,500 documented vulnerabilities across 188 real open-source projects. That's a meaningfully realistic test bed: real code, real historical bugs, not synthetic puzzles. Press coverage puts Flash Cyber at about 83.2% on CyberGym, versus OpenAI's GPT-5.5-Cyber at 85.6% and Anthropic's Mythos 5 at 83.8%. That's a tight three-way cluster, not a runaway lead for anyone — which is exactly why Google's own messaging leans on cost-efficiency rather than raw score. Notably, Google's blog only makes the qualitative claim of “competitive performance against significantly larger models”; the precise 83.2% figure comes from press analysis of the announcement, not from Google's own verbatim text or a public leaderboard entry you can check yourself.

The V8 result is a different kind of number, and it's entirely Google's own metric. On a test against the V8 JavaScript engine, Google reports Flash Cyber found 55 unique confirmed issues, compared with 47 for standard Gemini 3.5 Flash and 36 for Claude Opus 4.6 — including 10 issues no other model caught. That's a striking-sounding comparison because it names a specific rival model and a specific count, but it's an internal Google test run on Google's own infrastructure against Google's own chosen target. No outside party ran this evaluation, published its methodology for replication, or verified the counts independently. It's a real result Google says it observed — but it's a vendor claim, not an audited one, and the distinction matters more here than in most benchmark reporting.

The “Big Sleep” evaluation follows the same pattern at an even lower resolution. Testing against complex, real-world codebases like Chrome and Safari, Google says Flash Cyber “significantly surpassed” mainline Gemini 3.5 Flash and 3.6 Flash — but that's a qualitative claim with no exact numbers attached, let alone a third party checking the comparison. Stack all three results side by side and a pattern emerges: the one number with outside provenance (CyberGym) shows a tight, unremarkable cluster; the two flashier-sounding wins (V8, Big Sleep) are both Google grading its own model against Google's own chosen baselines.

That pattern isn't unique to Google, but it's harder to correct for here than usual, because Flash Cyber is gated. With an open or even API-accessible model, independent researchers can eventually rerun a benchmark and confirm or dispute a vendor's number — that's how inflated claims typically get caught. With Flash Cyber, that check largely can't happen: outside researchers simply don't have access to run their own CyberGym pass, their own V8 sweep, or any other test against the actual model. Even CyberGym's third-party pedigree only covers the benchmark's design, not an independent re-run of Flash Cyber against it — the score itself still traces back to Google's disclosure. Until access widens beyond the current pilot, every performance claim about this specific model — independent-sounding or not — ultimately rests on trusting Google's own account.

Don't confuse it with Sec-Gemini

Google has more than one “security” model, and they're easy to mix up. Sec-Gemini (announced around April 2025) is a separate, earlier experimental model aimed at threat-intelligence workflows — root-cause and incident analysis, integrated with Google Threat Intelligence and the OSV database. If your interest is SOC/threat-intel use cases, Sec-Gemini — not Flash Cyber — is the relevant line. Flash Cyber is narrowly about finding and fixing code vulnerabilities, and it lives inside CodeMender.

Access, pricing, and how to actually get security-model capability

The access story is simple, if unhelpful for most readers: there isn't one. Flash Cyber is not sold, not listed with a price, and not reachable through any API key you can request. The only way in is being a government agency or a vetted “trusted partner” admitted to the CodeMender pilot — there's no self-serve signup, no waitlist form that guarantees entry, and no published price sheet, because there is no public product to price. Google has said access will expand over time, but it has not attached a timeline or a GA date to that statement, so “eventually” is the most specific answer currently on record.

That's a sharp contrast with Flash Cyber's own siblings. Gemini 3.6 Flash and Gemini 3.5 Flash-Lite, announced the same day, are both generally available and priced per token like any other commercial model. Flash Cyber sits in a different category entirely — closer to an internal Google capability that happens to have been publicly disclosed than to a product line. Budget is not the constraint here; even a well-funded enterprise with no security-research relationship to Google has no path to a Flash Cyber API key today.

So what do teams actually do if they want AI help finding and fixing vulnerabilities in their own code right now? For the overwhelming majority who aren't inside the pilot, the practical route is running general-purpose frontier models — the kind that are GA and priced — against the same kind of work: code review, vulnerability triage, patch drafting, with your own human review and sandboxing around them. That's a materially different tool than a purpose-built specialist trained specifically for this task, but it's the accessible option. Aggregators like OrcaRouter, which sits behind 200+ models on one OpenAI-compatible endpoint, are how most teams assemble that kind of general-model security workflow today rather than waiting on a gated pilot they may never be admitted to.

Who it's for

Vetted defenders inside the pilot. If you're a government agency or an organization Google has already admitted as a trusted partner, Flash Cyber is a genuinely purpose-built tool: it runs inside CodeMender's discover-validate-approve-patch workflow, its parallel sub-agent architecture is designed for scanning real codebases at scale, and Google's own testing suggests it's competitive with — or on some internal metrics ahead of — larger general models on this specific job. For this narrow audience, the value proposition is real even if some of the supporting numbers are self-reported.

Everyone else — which is nearly everyone. If you're a typical engineering team, a security consultancy without a Google partnership, or an individual researcher, Flash Cyber simply isn't an option regardless of how well-suited your use case sounds. There's no application process guaranteed to work and no price you could pay to unlock it. Your realistic path to AI-assisted vulnerability work today is a generally available frontier model — routed through something like OrcaRouter if you want flexibility across providers — combined with your own review discipline, since none of those general models come with CodeMender's built-in human-approval and sandbox-validation guardrails.

Teams deciding whether to wait. If your organization is exploring a partnership path with Google specifically to get access, it's worth planning around the fact that no GA date exists — treat any current security workflow as needing to run on generally available models in the meantime, and revisit if and when Google's pilot expands. Betting a roadmap on gated access with no announced timeline is a risk most teams shouldn't take on.

FAQ

Can I use Gemini 3.5 Flash Cyber?

Not unless you're a vetted government or trusted partner. It's a limited-access pilot inside CodeMender, with no public API, no self-serve access, and no published pricing. Google says access will expand over time but has given no GA date.

What does it actually do?

It finds, validates, and patches software vulnerabilities in source code, running as parallel sub-agents whose findings are merged into a report. A human approves any patch, and vulnerabilities are validated in a sandbox before being reported.

How does it compare to OpenAI's and Anthropic's cyber models?

On the one shared third-party benchmark (CyberGym), the three are tightly clustered: Flash Cyber ~83.2%, Anthropic Mythos 5 83.8%, OpenAI GPT-5.5-Cyber 85.6%. Google positions its edge as cost-efficiency rather than top raw score. All three are gated to vetted organizations.

What are its specs?

It's fine-tuned from Gemini 3.5 Flash. Google has not published its context window, multimodality, or parameter count for Flash Cyber specifically.

Is it dangerous / dual-use?

Google acknowledges the dual-use risk — a model good at finding exploitable bugs could be misused offensively — and cites access gating as its primary mitigation, alongside human approval of patches and sandboxed validation of findings.

Is the CyberGym score independently verified?

CyberGym itself is a genuine third-party academic benchmark. But the specific 83.2% figure attributed to Flash Cyber comes from press reporting on Google's announcement rather than from Google's own verbatim text or a live public leaderboard entry, and because the model is gated, no outside party can currently re-run it themselves. Treat the number as reported, not as independently confirmed.

When will Flash Cyber become generally available?

Google hasn't said. It has stated that access will expand over time beyond the current pilot of governments and trusted partners, but no GA date or timeline has been published, so there's nothing concrete to plan around yet.

Bottom line

Gemini 3.5 Flash Cyber is a narrow, serious tool: a code-security model that hunts and patches vulnerabilities inside CodeMender, gated to governments and trusted partners. It's genuinely capable on the one independent benchmark available, but sits in a tight cluster with OpenAI's and Anthropic's cyber models rather than pulling ahead, and nearly all of its standout numbers are Google's own internal evals. If you're not a vetted partner, you can't use it — and for general security-adjacent work on your own code, accessible frontier models remain the practical route. The comparisons below line it up against its two real rivals.