A Specialized AI for Cybersecurity
Google DeepMind has released Gemini 3.5 Flash Cyber, a specialized AI model designed to find, validate, and patch software vulnerabilities — and it is outperforming everything else on the market.
Announced on July 21, the model is built on top of Gemini 3.5 Flash and fine-tuned specifically for cybersecurity defense work. It runs exclusively within CodeMender, an AI-powered agent for vulnerability discovery and patching that Google unveiled in October 2025.
Outperforming the Competition
In stress-tests against complex projects like Google Chrome and Apple Safari, 3.5 Flash Cyber "significantly" surpassed both Google's own Gemini 3.5 Flash and 3.6 Flash, as well as Anthropic's Claude Opus 4.6.
When tested on the highly complex V8 JavaScript Engine across a fixed number of invocations, Gemini 3.5 Flash Cyber found 55 unique confirmed issues — compared to 47 found by Gemini 3.5 Flash and 36 found by Opus 4.6. Ten of those issues were caught by no other model.
The model also produced a 100% reliable remote-code execution exploit that bypassed standard mitigation techniques like Address Space Layout Randomization (ASLR) and Write XOR Execute (W^X) — demonstrating both defensive and offensive capabilities.
Limited Access — For Now
Given the dual-use nature of this technology, Google is taking a cautious approach. The model is initially available exclusively to governments and trusted partners via CodeMender as part of a limited-access pilot program.
"This will give frontline defenders a head start in finding and fixing critical vulnerabilities before they can be exploited, while mitigating against broader misuse," wrote Raluca Ada Popa, DeepMind's Gemini Security Lead, and Four Flynn, VP of security and privacy at DeepMind.
Since 3.5 Flash Cyber runs solely inside CodeMender, guardrails can be configured to enable only defense functions while disabling other cyber activity — preventing scenarios where the model refuses to handle legitimate forensic analysis.
A Trio of New Models
The Flash Cyber release came alongside two other new Gemini models: Gemini 3.6 Flash, optimized for improved coding, knowledge work, and multimodal performance; and Gemini 3.5 Flash-Lite, designed for low-latency tasks. Google is also separately bringing CodeMender's foundational capabilities to enterprise customers through the Gemini Enterprise Agent Platform using generally available models.
Why It Matters
The release comes amid a wave of high-profile AI security incidents, including the recent OpenAI ExploitGym breach where an AI model autonomously compromised Hugging Face's infrastructure. Specialized defense-oriented models represent a new front in the AI arms race — one where the same capabilities that enable offensive AI are being harnessed for protection.
Sources - [The Hacker News: Google Launches Gemini 3.5 Flash Cyber AI](https://thehackernews.com/2026/07/google-launches-gemini-35-flash-cyber.html) - [Google DeepMind: Introducing Gemini 3.5 Flash Cyber](https://deepmind.google/blog/introducing-gemini-3-5-flash-cyber/) - [TechCrunch: Google releases three new Gemini models](https://techcrunch.com/2026/07/21/google-releases-three-new-gemini-models-but-no-3-5-pro/) - [TechRepublic: Google Holds Back Gemini 3.5 Flash Cyber](https://www.techrepublic.com/article/news-google-flash-cyber-codemender/)
