Gemini 3.5 Flash Cyber review, pricing and limits

Google fine-tuned Gemini 3.5 Flash on OSV.dev's 700,000-plus vulnerabilities and 10 years of OSS-Fuzz results, then limited it to a government and trusted-partner pilot inside CodeMender. A newer Google cyber model now surpasses it, so new evaluations should start there.

Gemini 3.5 Flash Cyber is Google DeepMind's July 2026 vulnerability-hunting fine-tune of Gemini 3.5 Flash. In Google's V8 engine testing it found 55 confirmed unique bugs, ahead of mainline Flash and a leading rival coding model. Access is limited to a CodeMender pilot, and a newer Google cyber model has since surpassed it.

Provider: Google DeepMind · Family: Gemini 3.5

More about Google DeepMind on HokAI

Context window: 1,048,576 tokens · Max output: 65,536

Input modalities: text, code · Output: text, code

About Gemini 3.5 Flash Cyber

Google DeepMind built Gemini 3.5 Flash Cyber as a cybersecurity fine-tune of Gemini 3.5 Flash, introducing it in a DeepMind post by Raluca Ada Popa and Four Flynn on July 21, 2026. Its job is narrow: find, validate and patch software vulnerabilities quickly and cheaply, at a time when AI-assisted attackers can locate bugs faster than defenders can fix them. It launched in the same week as Gemini 3.6 Flash and Gemini 3.5 Flash-Lite.

It is not a new architecture. Google says it is built on top of 3.5 Flash and trained with the help of OSV.dev, a vulnerability database spanning more than 700,000 open-source vulnerabilities, and more than 10 years of OSS-Fuzz results, so that it learns how real security professionals work with industry-standard tools. Google has not published a parameter count or an architecture description for the fine-tune itself.

The model is delivered through CodeMender, Google's code security agent, which calls it several times in parallel so sub-agents can explore more code paths before producing one report. Google's reasoning is that scanning a large codebase repeatedly with a fast, inexpensive model beats a single call to a large one, and that a weak model tends to re-report the same bug instead of casting a wider net.

Google's own numbers, all self-reported, carry the case. On CyberGym, a benchmark of real-world vulnerabilities, CodeMender configured with up to five 3.5 Flash Cyber calls per report reached performance Google calls competitive with significantly larger models, though the competitor figures on that chart are providers' own scores. On a Big Sleep team evaluation built around Chrome and Safari, it significantly surpassed mainline 3.5 Flash and 3.6 Flash. On the V8 JavaScript engine with a fixed number of invocations it found 55 unique confirmed issues, against 47 for mainline 3.5 Flash and 36 for Claude Opus 4.6, including 10 that neither caught. Google notes that newer Claude models than Opus 4.6 refuse the Chrome scanning tasks because of built-in guardrails, so they are absent from that comparison. Google's Cloud Vulnerability Research team reports that in two hours the model found remote code execution flaws in public APIs plus a memory-corruption bug in a sensitive production service, then produced what Google calls a fully reliable exploit that bypassed ASLR and W^X.

Access is deliberately gated. Google describes a limited-access pilot, exclusively for governments and trusted partners through CodeMender, expanding over time because the same skill that finds a bug can help write an exploit for it. No public API, price or enrollment form has been published, and a late-October search turned up no announcement that access has widened. Customers who want CodeMender's workflow without the gated model can use it with generally available Gemini models on the Gemini Enterprise Agent Platform.

Where it falls short: this is no longer Google's strongest cyber model. Gemini 3.8 Flash Cyber arrived in September 2026 through the Fairwind Program, and Google says it surpasses 3.5 Flash Cyber on CyberGym. A team weighing the two should treat 3.5 Flash Cyber as the earlier generation. Teams that want a gated cyber model from another lab can also compare GPT-5.6 Cyber. It is not a chat or coding assistant, and Google has published no general benchmark scores for the fine-tune; the figures it does publish are cyber-domain evaluations run by Google. Its base model's card lists a context window of up to 1M tokens and 64K output, but Google does not publish limits specific to the Cyber variant.

Pricing

Google has not published per-token pricing for this model. There is no self-serve API, and the gated CodeMender pilot is the only route in. Google's newer cyber model is gated as well, while mainline [Gemini 3.5 Flash](/hub/models/gemini-3.5-flash) is the sibling with public per-token pricing.

Key Features

• Multi-invocation vulnerability scanning: CodeMender calls the model repeatedly through parallel sub-agents (up to 5 per report in Google's CyberGym setup) instead of one expensive pass, exploring far more code paths before compiling a single report.
• OSV.dev and OSS-Fuzz-grounded training: Fine-tuned on Google's OSV.dev open-source vulnerability database and years of accumulated OSS-Fuzz fuzzing results, paired with real security-professional workflows.
• Context and output limits inherited from the base: The Gemini 3.5 Flash card lists up to 1M tokens of context and 64K tokens of output; Google does not publish separate limits for the Cyber variant.
• Exploit-grade validation: Produced a fully reliable remote-code-execution exploit bypassing ASLR and W^X memory protections during Google's internal Cloud Vulnerability Research testing, confirming findings are actionable, not speculative.
• Gated pilot deployment inside CodeMender: Runs only within CodeMender for governments and trusted partners, a limited-access rollout meant to mitigate broader misuse of a dual-use capability.

Pros

• Beat mainline Gemini 3.5 Flash and a leading rival coding model head-to-head on real V8 engine vulnerability discovery, catching confirmed bugs the others missed entirely, per Google's own internal testing.
• Multi-invocation design reaches CyberGym performance competitive with larger, costlier cybersecurity models at a fraction of the per-report cost.
• Already proven in production: Google's own Chrome, Android, Cloud, Ads, and YouTube teams used it internally before the public pilot announcement.

Cons

• No public API or self-serve pricing; access is gated to an invite-only pilot for governments and trusted partners.
• No published general-purpose benchmark scores specific to the Cyber fine-tune, only cyber-domain evals.
• The bug-finding capability doubles as an exploit generator, which is the reason Google gated rollout instead of shipping broadly.

Benchmarks

• v8 Engine Issues Found: 55 vendor-reported · 24 Oct 2026
• v8 Engine Issues Found Mainline Flash: 47 vendor-reported · 24 Oct 2026
• v8 Engine Issues Found Claude Opus 4.6: 36 vendor-reported · 24 Oct 2026

A benchmark is an exam, not the job. Scores transfer unevenly between tasks, so weigh the one closest to your workload and read every figure with its source.

Visit Gemini 3.5 Flash Cyber Official Page