Google releases Gemini 3.5 Flash Cyber: a lighter AI to fix flaws faster

Google rolled out Gemini 3.5 Flash Cyber and CodeMender today, a new security model and agent built to help organizations spot, verify, and fix software vulnerabilities across large codebases. For now, Gemini 3.5 Flash Cyber is only being offered through a pilot program for governments and trusted partners.

The company is pitching Gemini 3.5 Flash Cyber as a lighter, cheaper option than heavier cyber models, one meant to move through large numbers of code paths quickly. In early internal testing, Google says it found remote code execution flaws and a memory-corruption bug in a production service in about two hours.

CodeMender is supposed to go a step further than simply flagging a possible issue. It can help determine whether a suspected bug is actually real, then suggest fixes, which could cut down the time between discovery and remediation.

Access is being kept tight for a reason. Tools that help defenders uncover weak points can also give attackers a head start, so Google is taking the same cautious route Anthropic and OpenAI have used with cyber-focused systems.

If you’re running security reviews at scale, this looks like something worth trying once access opens up more broadly. Still, it doesn’t remove the need for human review. False positives, hard-to-explain decisions, and simple over-trust are still very real problems.

That caution lines up with the broader picture. One survey found that 78% of professionals had seen automated tools miss critical bugs. Separate survey data says 78% of organizations now use AI in cybersecurity, but only 27% consider those deployments mature. If you want to get your hands on Gemini 3.5 Flash Cyber first, the entry point is that pilot for governments and trusted partners.