Google's small Gemini Flash Cyber outfinds larger models on bugs

Google DeepMind released Gemini 3.5 Flash Cyber, a version of its small Flash model fine-tuned to find, confirm, and patch software vulnerabilities. The pitch is that a cheap model you can call many times beats a single expensive call for security work, because you can spread many agents across a large codebase. On the V8 JavaScript engine, Flash Cyber found 55 unique confirmed issues against a fixed number of tries, compared with 47 for the general Gemini 3.5 Flash and 36 for Claude Opus 4.6, and 10 of its findings were ones the other models missed. Google says it trained the model on data from OSV.dev, which tracks more than 700,000 open-source vulnerabilities, and a decade of OSS-Fuzz results, teaching it to drive standard security tools over projects like Chromium. In one two-hour run it surfaced remote code execution and memory corruption flaws in Google Cloud APIs.

Because the same skill that finds bugs can be used to exploit them, Google is not opening this up. Flash Cyber will be available only to governments and trusted partners through its CodeMender agent at first, expanding later, while the general Gemini models keep the broader CodeMender features. No pricing was given. The announcement is on the DeepMind blog.

Why it matters

If you maintain a large or high-value codebase, a specialized model that outperforms frontier general models on vulnerability finding, and does it cheaply enough to run at scale, is worth watching for your own security pipeline. The restricted rollout also tells you Google reads offensive misuse as a real risk, so defenders will get it before you can buy it off the shelf.