Google has unveiled a lightweight artificial intelligence model designed to identify and patch software vulnerabilities faster than traditional security teams can manage them. The new tool, called Gemini 3.5 Flash Cyber, represents a shift in how organizations might defend against the growing speed of AI-powered threat discovery. As AI systems become increasingly capable of finding security flaws, defenders need equally capable tools to keep pace.

Why Is Speed in Vulnerability Detection Becoming Critical?

The cybersecurity industry faces a fundamental timing problem: artificial intelligence can now discover software vulnerabilities faster than human security teams can validate and fix them. Google has been investing in automated vulnerability discovery for years through a tool called CodeMender, which can detect and fix critical software flaws. However, the company recognized that a more scalable and affordable approach was needed to handle the volume of vulnerabilities that modern AI systems can uncover.

Gemini 3.5 Flash Cyber was specifically fine-tuned to locate, verify, and remediate vulnerabilities more effectively than Google's standard Flash models. The key advantage is cost and speed. Because the model is lightweight, it can run continuously across large codebases without the expense of larger AI systems, making it practical for scanning code during software launches and commit-scanning pipelines at scale.

How Does Gemini 3.5 Flash Cyber Actually Work?

Rather than relying on a single call to a large language model, CodeMender invokes Flash Cyber multiple times, allowing sub-agents to inspect significantly more code paths before generating a consolidated report. This approach allows the system to explore vast execution search spaces across complex codebases more thoroughly than single-pass analysis. Google evaluated the model using the CyberGym benchmark, which measures AI agents against hundreds of real-world software vulnerabilities.

In testing, Gemini 3.5 Flash Cyber demonstrated competitive performance against significantly larger cybersecurity models. When configured to call the model up to five times before producing a final report, CodeMender achieved results comparable to much larger systems. The model also outperformed Gemini 3.5 Flash and 3.6 Flash during Google's internal Big Sleep evaluation, which tested vulnerability discovery in complex projects such as Chrome and Safari without safety guardrails.

What Do Real-World Test Results Show?

Google tested Gemini 3.5 Flash Cyber on the V8 JavaScript Engine, a critical component used in web browsers. The results were striking: Flash Cyber discovered 55 unique confirmed vulnerabilities, compared with 47 for Gemini 3.5 Flash and 36 for Opus 4.6. Notably, 10 of those vulnerabilities were missed by both competing models. In Chrome's production commit-scanning pipeline, where vulnerabilities remained undisclosed to prevent benchmark contamination, Flash Cyber delivered a significant improvement over Gemini 3.5 Flash.

Google's Cloud Vulnerability Research team used the model to identify remote code execution vulnerabilities in public APIs and a memory-corruption flaw within a sensitive production service in just two hours. The model also generated a 100% reliable remote code execution exploit capable of bypassing Address Space Layout Randomization (ASLR) and Write XOR Execute (W^X), advanced security protections that make exploitation significantly harder.

Steps to Implement Vulnerability Detection at Scale

• Pilot Program Access: Organizations can request access through CodeMender, Google's code security agent, which is initially available to governments and trusted partners. Broader availability is planned over time.
• Continuous Code Scanning: Deploy the model to scan code continuously during development, software launches, and commit-scanning pipelines rather than relying on periodic security reviews.
• Multi-Call Architecture: Configure the system to invoke the model multiple times across different code paths before generating a final vulnerability report, increasing detection coverage.
• Integration with Enterprise Platforms: CodeMender's core capabilities will be made available through generally available Gemini models on the Gemini Enterprise Agent Platform for broader organizational use.

What Does This Mean for Cybersecurity Teams?

The release of Gemini 3.5 Flash Cyber highlights a broader shift in cybersecurity strategy. Rather than trying to outspend attackers on security infrastructure, organizations are increasingly turning to AI-powered defense tools that can match the speed and scale of AI-powered attacks. Google noted that early feedback from security firms Wiz and Cloud CISO Security Engineering testers indicated a significant capability improvement over Gemini 3.5 Flash.

The model's dual-use nature, however, means Google is being cautious about availability. Because the same technology could theoretically be used to discover vulnerabilities for malicious purposes, the company is initially limiting access through a pilot program. This reflects a broader tension in AI security: the same tools that help defenders also have potential offensive applications.

Google highlighted resources such as OSV.dev, which tracks more than 700,000 open-source vulnerabilities, and over a decade of OSS-Fuzz data as key training assets supporting its cybersecurity models. These datasets represent years of real-world vulnerability research that the model learned from, making it more effective at identifying novel flaws in production systems.

The timing of this release is significant. As adversaries increasingly use AI to accelerate their own attack capabilities, the cybersecurity industry is racing to deploy AI-powered defenses that can keep pace. Gemini 3.5 Flash Cyber represents one approach to that challenge: a lightweight, cost-effective model designed specifically for the vulnerability discovery and remediation task that has become the bottleneck in modern security operations.