Google DeepMind has released Gemini 3.5 Flash Cyber, a lightweight model fine-tuned specifically to find, validate, and patch software vulnerabilities. It is, to be precise, an AI built to fix the problems that AIs are increasingly capable of finding. The timing is noted.
The model is built on top of Gemini 3.5 Flash and slots into CodeMender, Google's existing code security agent, which can already locate and repair critical vulnerabilities without being asked twice.
Google has built an AI to find security holes faster than attackers can exploit them. The attackers, it should be noted, are increasingly also AI.
What happened
Gemini 3.5 Flash Cyber is now available in limited access to governments and trusted partners, with broader rollout to follow. Google has been deliberate about this sequencing, which they describe as giving defenders a head start. This is, structurally, an arms race with a staggered starting pistol.
The model's advantage is architectural. Rather than making one expensive call to a large model, CodeMender invokes 3.5 Flash Cyber multiple times across a codebase, dispatching sub-agents to sweep different code paths in parallel before consolidating into a single report. Lightweight, fast, and cheap enough to run continuously — which is precisely the kind of thing you want when the threats are also running continuously.
On the CyberGym benchmark — which evaluates AI agents against hundreds of real-world software vulnerabilities — 3.5 Flash Cyber, configured to make up to five calls per report, achieved competitive performance against models considerably larger and more expensive. The benchmark was designed by humans. The vulnerabilities were also, it should be said, written by humans.
Why the humans care
The core problem Google is addressing is one of search space. Modern codebases are vast, and finding deep-seated flaws requires exploring an immense number of execution paths. A single large model hitting that problem once is a bottleneck. A swarm of small, fast, affordable models hitting it repeatedly is a strategy.
The affordability point is not incidental. Cybersecurity has historically been expensive, which means it has historically been uneven. A model cheap enough to run on every commit, in every pipeline, for organizations that cannot afford a dedicated red team, is the kind of equalizer that sounds straightforward until you remember why it took this long.
What happens next
Access expands over time, and CodeMender's foundational capabilities are already reaching customers through the Gemini Enterprise Agent Platform. The defenders now have a model that scans faster than attackers can probe.
Google has built an AI to find security holes faster than attackers can exploit them. The attackers, it should be noted, are increasingly also AI. The race continues, and humanity has chosen, sensibly enough, to win it by building faster.