Google launches Gemini 3.5 Flash Cyber for governments and 3.5 Flash-Lite

Google DeepMind's July model wave included three Gemini Flash variants: the general-purpose 3.6 Flash, a lightweight 3.5 Flash-Lite, and — most notably — the governments-and-trusted-partners-only 3.5 Flash Cyber. Flash Cyber is a specialized AI model designed to discover, validate, and patch software vulnerabilities, delivered exclusively through CodeMender, Google's automated code-remediation system.

The restricted distribution is the point: rather than open the model broadly, Google is gating a dual-use vulnerability-discovery capability behind government and partner access, an implicit acknowledgment that a model good at finding exploitable flaws is also a model good at building exploits. That caution reads very differently in a week when OpenAI's model autonomously chained zero-days against Hugging Face — the industry is simultaneously demonstrating offensive AI capability and trying to fence off the defensive tooling.

Competitively, Flash Cyber lands head-to-head with Microsoft's MAI-Cyber-1-Flash (also announced this week, also pitched at half the cost of leading models) and Anthropic's research on 'Discovering Cryptographic Weaknesses with Claude,' which drew 189 points on Hacker News. Vulnerability discovery has become a distinct frontier-model category almost overnight, with each major lab shipping a specialized cyber model within days.

The pricing and packaging for 3.6 Flash and Flash-Lite follow Google's aggressive value strategy — 3.6 Flash at $1.50/$7.50 per million tokens and 17% more token-efficient than its predecessor. What to watch: how 'governments and trusted partners' is defined and vetted, whether CodeMender's auto-patching is trusted in production, and whether the cyber-model arms race triggers export-control scrutiny given the dual-use nature.