Google shipped three new Gemini models this week. Two are open to every developer right now. The third — Gemini 3.5 Flash Cyber — just found 55 confirmed vulnerabilities in Chrome’s V8 JavaScript engine, including 10 issues that neither mainline Gemini Flash nor Claude Opus 4.6 caught. You cannot use it. It is restricted to governments and trusted partners only. That tension is worth understanding.
What Gemini 3.5 Flash Cyber Does
Flash Cyber is built on Gemini 3.5 Flash and fine-tuned specifically to find, validate, and patch security vulnerabilities at scale. It is not a general-purpose coding model repurposed for security. Google trained it on OSV.dev (over 700,000 open-source vulnerability records) and more than a decade of OSS-Fuzz results — the fuzzing data from running automated security tests across Chromium, Linux, and hundreds of major open-source projects.
The result is a model that can read millions of lines of production code, run autonomous, multi-hour analysis sessions, and generate patches rather than just vulnerability reports.
The V8 Benchmark: Numbers That Matter
During testing on Chrome’s V8 JavaScript engine — at a controlled, fixed number of invocations — three models competed against the same codebase:
- Gemini 3.5 Flash Cyber: 55 unique confirmed vulnerabilities
- Gemini 3.5 Flash (mainline): 47
- Claude Opus 4.6: 36
Ten of those 55 issues were found by Flash Cyber alone. Neither of the other two models identified them.
V8 is not a synthetic benchmark environment. It is the JavaScript engine in Chrome, Node.js, Deno, and every Electron application. Vulnerabilities in V8 affect real users at browser scale. Finding 53% more of them than Anthropic’s flagship Opus, at a lower cost per token, is a result worth taking seriously.
How CodeMender Makes It Scale
Flash Cyber does not run in isolation. It operates inside CodeMender, Google DeepMind’s security agent launched in October 2025. The architecture is deliberately multi-agent:
- CodeMender invokes Flash Cyber up to five times per vulnerability report
- Each invocation explores different code paths and execution contexts
- Sub-agents combine findings, deduplicate results, and validate exploitability
- A separate critique agent compares the original and patched code to prevent regressions
Before this week’s announcement, CodeMender had already contributed 72 security patches upstream to open-source projects, analyzing codebases as large as 4.5 million lines of code. Flash Cyber is now the engine driving that pipeline.
Why You Cannot Use It
Google’s stated reason is direct: “dual-use nature of the technology.” A model that identifies and validates exploitable vulnerabilities faster than defenders can patch them is also a model that identifies exploitable vulnerabilities faster than attackers can be stopped.
This is not hedging. Google’s earlier Big Sleep AI agent found a SQLite vulnerability that was actively being exploited in the wild. It also discovered high-severity out-of-bounds write bugs in V8 and a use-after-free in Chrome’s ANGLE engine. The line between “AI security research tool” and “attack capability” collapsed within one model generation.
The CyberGym benchmark (1,507 real-world vulnerabilities across 188 projects) puts this in context: even the best AI agents currently succeed on only about 22% of tasks. Flash Cyber is meaningfully better on V8. Restricting it to frontline government defenders gives patchers a structural head start before this capability widens further.
What Developers Get Right Now
The other two models announced alongside Flash Cyber are available immediately via the Gemini API and Google AI Studio:
- Gemini 3.6 Flash: $1.50 per million input tokens, $7.50 per million output — suitable for agents and long-horizon coding tasks
- Gemini 3.5 Flash-Lite: $0.30/$2.50 — designed for high-volume, latency-sensitive workloads
Neither is Flash Cyber. For vulnerability coverage now, the practical open-source stack includes Semgrep for fast pattern-based static analysis, Trivy for container and IaC scanning, GitHub Advanced Security (CodeQL) for semantic analysis on public repos, and OSS-Fuzz for qualifying open-source projects — the same fuzzing data that trained Flash Cyber in the first place.
The Larger Pattern
Flash Cyber fits a clear trajectory: Big Sleep found bugs in 2024. CodeMender patched them autonomously in 2025. Flash Cyber now finds significantly more of them, cheaper, in 2026. Each step narrowed the gap between AI security research and AI security product.
The gating decision reflects where that gap currently sits. When it closes further — and based on the velocity of the last 18 months, it will — the question of who gets access to these tools first will matter considerably more than it does today. Your V8 bugs are not waiting for Flash Cyber access. Your CI pipeline should not be either.
