Google has launched Gemini 3.5 Flash Cyber, a specialized AI model built to accelerate vulnerability discovery and remediation in software code. The model represents a cost-effective alternative to larger AI systems while maintaining the capability to analyze codebases at scale. Google is initially restricting access through a pilot program for government agencies and trusted partners via its CodeMender security agent, with plans for wider availability through the Gemini Enterprise Agent Platform.
The model addresses a growing challenge in cybersecurity where AI systems can discover vulnerabilities faster than defenders can patch them. Flash Cyber has been fine-tuned specifically for security tasks, allowing it to locate, verify, and remediate flaws more effectively than standard Gemini models. Rather than relying on single queries to a large language model, CodeMender invokes Flash Cyber multiple times, enabling sub-agents to examine significantly more code paths before producing consolidated reports.
Benchmark testing demonstrates competitive performance against larger cybersecurity models. Using the CyberGym benchmark with hundreds of real-world vulnerabilities, CodeMender configured with up to five model calls achieved results comparable to significantly larger systems. In testing on the V8 JavaScript engine, Flash Cyber identified 55 unique confirmed vulnerabilities compared to 47 for Gemini 3.5 Flash and 36 for competing models, including 10 issues missed by both alternatives. The model also outperformed standard versions during Google's internal Big Sleep evaluation testing vulnerability discovery in Chrome and Safari.
Google is already deploying Flash Cyber internally across Chrome, Android, Cloud, Ads, and YouTube. In one case, the Cloud Vulnerability Research team used the model to identify remote code execution vulnerabilities in public APIs and a memory corruption flaw in a production service within two hours. The model generated a fully reliable exploit capable of bypassing Address Space Layout Randomization (ASLR) and Write XOR Execute (W^X) protections. Early feedback from external testers at Wiz and Cloud CISO Security Engineering indicated significant capability improvements over previous models.
Organizations should monitor Google's announcements regarding broader availability of Flash Cyber through the Gemini Enterprise Agent Platform. Security teams currently using CodeMender or participating in Google's security research programs may gain early access through the pilot program. The model's speed and lower operating costs make it suitable for continuous code scanning, software launch processes, and commit-scanning pipelines, particularly for organizations managing large or complex codebases.
Source: https://thecyberexpress.com/gemini-3-5-flash-cyber-ai-cybersecurity-model/