Introducing Gemini 3.5 Flash Cyber
DeepMind Blog · 2026-07-17
Google DeepMind introduces Gemini 3.5 Flash Cyber, a lightweight cybersecurity-specialized model that found 55 unique vulnerabilities in V8 versus 47 by mainline Flash and 36 by Claude Opus 4.6, available only to governments via CodeMender.
Appears in
Extraction
Topics: cybersecurity-aivulnerability-detectionai-agentsgemini-modelsresponsible-deployment
Claims
- Gemini 3.5 Flash Cyber found 55 unique confirmed vulnerabilities in V8 JavaScript Engine compared to 47 by mainline 3.5 Flash and 36 by Claude Opus 4.6 across a fixed number of invocations.
- When configured to invoke the model up to five times per report, CodeMender using 3.5 Flash Cyber achieved competitive performance against significantly larger cybersecurity models on the CyberGym benchmark.
- In 2 hours, 3.5 Flash Cyber uncovered remote code execution vulnerabilities in Google's public APIs and a memory-corruption vulnerability in a sensitive production service.
- The model's lightweight architecture enables frequent scans and commit scanning pipelines at scale, unlike expensive single-call approaches with large models.
- 3.5 Flash Cyber will be exclusively available to governments and trusted partners via CodeMender as a limited-access pilot, with broader access planned over time.
Key quotes
3.5 Flash Cyber significantly surpassed mainline 3.5 Flash and 3.6 Flash on the Big Sleep Evaluation focused on critical and hard-to-find vulnerabilities in Chrome and Safari.
In just 2 hours, the model uncovered remote code execution vulnerabilities in public APIs and found a memory-corruption vulnerability in a sensitive production service. It then generated a 100% reliable remote-code execution exploit that bypassed standard mitigation techniques like Address Space Layout Randomization (ASLR) and Write XOR Execute (W^X).
Given the dual-use nature of this technology, we have taken an intentional approach to how we deploy 3.5 Flash Cyber.