Gemini 3.5 Flash Cyber: 55 V8 Bugs Found, 2026 Review
A 2026 vulnerability-hunting fine-tune from Google DeepMind, beating base Flash on real V8 engine bug-hunting inside CodeMender. Gated pilot, no public API.
The fine-tune trains on 700,000-plus cataloged OSV.dev vulnerabilities and more than 10 years of OSS-Fuzz results, then caps output at 65,536 tokens per response. It is not a consumer product: enrollment in Google's CodeMender pilot is required before anyone outside Google can run it.
In 2026, Google DeepMind released Gemini 3.5 Flash Cyber, a fine-tuned vulnerability-hunting variant of Gemini 3.5 Flash. V8 engine testing found 55 confirmed unique bugs versus 47 for base Flash and 36 for a leading rival coding model; it runs only inside the gated CodeMender pilot for governments and trusted partners.
Provider: Google DeepMind · Family: Gemini 3.5
More about Google DeepMind on HokAI
Context window: 1,048,576 tokens · Max output: 65,536
Input modalities: text, code · Output: text, code
About Gemini 3.5 Flash Cyber
Gemini 3.5 Flash Cyber is Google DeepMind's cybersecurity fine-tune of the Gemini 3.5 Flash foundation model, announced July 21, 2026 alongside Gemini 3.6 Flash and Gemini 3.5 Flash-Lite. Authored internally by Raluca Ada Popa and Four Flynn, the model was built to solve a specific asymmetry: AI-assisted attackers can now discover exploitable bugs faster than human defenders can patch them, so Google trained a lightweight model whose entire purpose is to find, validate, and patch vulnerabilities before adversaries do. The model is not a new architecture. It is Gemini 3.5 Flash with specialized fine-tuning on top, trained on the OSV.dev database of more than 700,000 open-source vulnerabilities, over 10 years of OSS-Fuzz fuzzing results, and real security-professional workflows paired with industry-standard tooling. That training focus is why Google frames it as a cost-efficient alternative to larger cybersecurity models rather than a bigger, more expensive one. Gemini 3.5 Flash Cyber ships exclusively inside CodeMender, Google DeepMind's AI code-security agent. CodeMender does not call the model once per task. It invokes 3.5 Flash Cyber repeatedly through parallel sub-agents, letting each one explore a different code path before the results are compiled into a single vulnerability report. That multi-invocation pattern is deliberate: Google found that scanning a codebase five times with a fast, cheap model beats one expensive pass with a larger one, and it avoids the repetitive-finding problem where a single model keeps re-reporting the same bug instead of casting a wider net. On benchmarks, the model outperformed its own base and a rival on real targets. On the CyberGym real-world vulnerability benchmark, CodeMender configured with up to five 3.5 Flash Cyber calls per report reached performance competitive with significantly larger cybersecurity models. On the Big Sleep evaluation against Chrome and Safari, two heavily scrutinized codebases, it significantly surpassed mainline 3.5 Flash and 3.6 Flash on hard-to-find critical vulnerabilities. In fixed-invocation testing against the V8 JavaScript engine, it found 55 unique confirmed issues versus 47 for mainline 3.5 Flash and 36 for Claude Opus 4.6, including 10 issues neither competitor caught. In Chrome production commit scanning it showed a clear success-rate uplift over mainline Flash on undisclosed vulnerabilities. The underlying 3.5 Flash foundation itself already tests strong on general benchmarks: 89% on MMLU, 92% on HumanEval, and 55.1% on SWE-Bench Pro, though Google has not published equivalent general-benchmark scores for the Cyber fine-tune specifically, only the cyber-domain evals above. The model inherits 3.5 Flash's 1,048,576-token context window and 65,536-token maximum output, which matters for scanning large monorepos and long commit histories in a single pass. Google's internal Cloud Vulnerability Research team used it to uncover remote-code-execution vulnerabilities in public APIs and memory-corruption bugs in production services within two hours, generating a fully reliable exploit that bypassed ASLR and W^X memory protections, evidence the model produces exploit-grade output, not just bug descriptions. Google deliberately restricted access rather than shipping it broadly. Gemini 3.5 Flash Cyber is available only through a limited-access pilot to governments and trusted partners via CodeMender, with plans to expand gradually. There is no public API endpoint, no self-serve pricing page, and no listed per-token rate, a direct consequence of the model's dual-use nature: the same capability that finds and patches a bug can generate a working exploit for it. Guardrails inside CodeMender's environment are configured to enable only defensive functions and to avoid the kind of model refusal that would otherwise block a defender's forensic analysis. Customers who want CodeMender's workflow without the restricted model can still use it on the Gemini Enterprise Agent Platform with standard, generally available Gemini models. Google's Frontier Safety Framework had already flagged the wider Gemini 3 series at the cyber alert threshold, which is why the sibling release, Gemini 3.6 Flash, shipped with enhanced CBRN and cyber-offense safeguards and stronger jailbreak resistance. 3.5 Flash Cyber sits inside that same governance regime: it is treated as a capability significant enough to require gated rollout rather than immediate general availability, with a stated intent to extend it toward red-teaming and end-to-end enterprise defense over time. Teams evaluating it should be clear on what they are actually getting: not a general chat or coding assistant, but a narrow, high-throughput vulnerability-discovery engine meant to run inside CodeMender's orchestration layer, priced and gated for organizations already doing large-scale, high-stakes vulnerability triage rather than individual developers.
Pricing
Google has not published per-token pricing for this model. There is no self-serve API; enrollment requires invitation into the CodeMender pilot, restricted to governments and vetted enterprise partners.
Key Features
- Multi-invocation vulnerability scanning: CodeMender calls the model repeatedly through parallel sub-agents (up to 5 per report in Google's CyberGym setup) instead of one expensive pass, exploring far more code paths before compiling a single report.
- OSV.dev and OSS-Fuzz-grounded training: Fine-tuned on Google's OSV.dev open-source vulnerability database and years of accumulated OSS-Fuzz fuzzing results, paired with real security-professional workflows.
- 1,048,576-token context window: Inherits the Gemini 3.5 Flash context window, enough to hold large monorepos or long commit histories for a single scanning pass.
- Exploit-grade validation: Produced a fully reliable remote-code-execution exploit bypassing ASLR and W^X memory protections during Google's internal Cloud Vulnerability Research testing, confirming findings are actionable, not speculative.
- Gated pilot deployment inside CodeMender: Runs exclusively within CodeMender's sanctioned defensive environment for governments and trusted partners, with guardrails configured to prevent both misuse and mid-investigation refusals.
Pros
- Beat mainline Gemini 3.5 Flash and a leading rival coding model head-to-head on real V8 engine vulnerability discovery, catching confirmed bugs the others missed entirely, per Google's own internal testing.
- Multi-invocation design reaches CyberGym performance competitive with larger, costlier cybersecurity models at a fraction of the per-report cost.
- Already proven in production: Google's own Chrome, Android, Cloud, Ads, and YouTube teams used it internally before the public pilot announcement.
Cons
- No public API or self-serve pricing; access is gated to an invite-only pilot for governments and trusted partners.
- No published general-purpose benchmark scores specific to the Cyber fine-tune, only cyber-domain evals.
- The bug-finding capability doubles as an exploit generator, which is the reason Google gated rollout instead of shipping broadly.
Benchmarks
- mmlu: 89
- humaneval: 92
- swe bench pro: 55.1
- v8 engine issues found: 55
- v8 engine issues found mainline flash: 47
- v8 engine issues found claude opus 4 6: 36
Frequently Asked Questions
How much does Gemini 3.5 Flash Cyber cost per 1M tokens?
No public pricing exists for this model. Enrollment happens through Google's invite-only CodeMender pilot, open only to vetted government and enterprise partners, so there is nothing to compare against mainline Gemini 3.5 Flash's public per-token rate.
How does Gemini 3.5 Flash Cyber compare on benchmarks vs Claude Opus 4.6?
It edged out Claude's comparable coding model head-to-head on real V8 engine bug-hunting and Chrome production commit scanning, per Google's own published testing, though neither vendor has released directly comparable general-purpose benchmark scores for an apples-to-apples read beyond those cyber-specific evals.
Is Gemini 3.5 Flash Cyber open source or proprietary?
It is fully proprietary and closed-weight. Beyond that, access itself is restricted: it is not available through Google's standard Gemini API at all, only through an invite-only pilot inside CodeMender for governments and vetted trusted partners.
Does Gemini 3.5 Flash Cyber train on user data?
Google has not publicly disclosed a data retention or training policy specific to Gemini 3.5 Flash Cyber. Given its restriction to a gated government and enterprise pilot, expect terms to be negotiated per-partner rather than governed by a public consumer policy.
Who is Gemini 3.5 Flash Cyber best for and who should avoid it?
It fits government cybersecurity agencies and enterprise security teams already vetted into Google's CodeMender pilot, running large-scale commit-level vulnerability triage. Everyone else should avoid it entirely since there is no public access; use mainline Gemini 3.5 Flash, Claude Opus 4.6, or a general coding model instead for anything outside the sanctioned pilot.