Gemini 3.5 Flash Cyber: Google's Cyber AI Beats Claude, But You Can't Use It Yet

An AI that hunts security bugs faster than Anthropic's Claude, and almost nobody outside a government building gets to touch it. That's the strange deal Google just struck.

The company unveiled Gemini 3.5 Flash Cyber, a model built specifically to find and patch software vulnerabilities, but locked behind a pilot program for governments and vetted partners only.

Gemini 3.5 Flash Cyber lives inside CodeMender

Built on the Gemini 3.5 Flash foundation, the new model runs exclusively inside CodeMender, the code security agent Google DeepMind first introduced back in October 2025. CodeMender scans a codebase, tries to prove a flaw is actually exploitable inside a sandbox, then hands developers a patch to approve.

Per Google DeepMind's announcement, the logic is straightforward: instead of one expensive call to a giant model, CodeMender fires off multiple rapid calls to Flash Cyber to explore far more execution paths before compiling a single report.

The numbers Google is bragging about

On Chrome's V8 JavaScript engine, Google says Flash Cyber surfaced 55 confirmed unique vulnerabilities, versus 47 for standard 3.5 Flash and 36 for Anthropic's Claude Opus 4.6, including ten bugs no other model caught.

One caveat worth flagging: according to reporting on the benchmark, Google didn't test against Anthropic's newest release, Claude Mythos, partly because that model remains under restricted access for safety reasons rather than because it refuses this kind of task. That doesn't erase the win, but it does soften the bragging rights a bit.

Why Google keeps the keys

Raluca Ada Popa and Four Flynn, DeepMind's Gemini Security Lead and VP of security respectively, pointed to the tool's dual-use nature as the reason for caution. A model that finds flaws before attackers do can, in the wrong hands, do exactly the opposite job.

The move echoes OpenAI's own decision to gate its most powerful model, reserved (temporarily) for government agencies. Two rival labs, one shared instinct: the sharper the offensive-grade cyber capability, the smaller the guest list.

A decade of homework paying off

Google's edge comes from OSV.dev, its database of over 700,000 open-source vulnerabilities, plus more than ten years of OSS-Fuzz results feeding the training pipeline. Few competitors can match that data moat.

For most companies, direct access to Flash Cyber isn't happening anytime soon. Google says the pilot will expand gradually, eventually adding red-teaming features and full enterprise defense.

What is Gemini 3.5 Flash Cyber?

It's a Google DeepMind AI model built on Gemini 3.5 Flash and fine-tuned to find, validate, and patch software vulnerabilities at scale through the CodeMender security agent.

Who can access Gemini 3.5 Flash Cyber?

Currently only governments and select trusted partners through a limited-access pilot program, due to the technology's dual-use potential for both defense and offense.