Version 2

Google released Gemini 3.6 Flash and 3.5 Flash-Lite on July 21, 2026, deprecating 3.5 Flash just two months after its Google I/O debut [2][1]. A cybersecurity-specialized variant, 3.5 Flash Cyber, was announced July 17 and restricted to governments and trusted partners due to its ability to autonomously find and exploit production vulnerabilities [3]. The Verge and CyberNews positioned Flash Cyber as a cheaper alternative to larger dedicated AI security models, naming Mythos as a reference point [4][5]. Gemini 3.5 Pro remains unshipped, held back by coding performance shortfalls, with multiple outlets now offering theories on the delay [8][9][10][11].

Google is cycling through Flash models faster than typical product timelines while a coding quality shortfall keeps its Pro-tier model from shipping. Flash Cyber's framing as a cheaper entry in the AI security model market — against larger dedicated models — suggests Google sees commercial opportunity there, though the model can generate working exploits and relies on access controls rather than capability limits as its safeguard.

Google released three new Gemini models on July 21, 2026, reorganizing its Flash tier and introducing a restricted cybersecurity variant. Gemini 3.6 Flash replaces 3.5 Flash — which had been the centerpiece of Google I/O just two months earlier — claiming 17% fewer output tokens while improving on benchmark areas where 3.5 Flash underperformed, including DeepSWE coding (49% vs. 37%) and OSWorld computer use (83.0% vs. 78.4%) [1]. Gemini 3.5 Flash-Lite, released the same day, targets high-volume latency-sensitive workloads, reaching 350 output tokens per second while outperforming Gemini 3 Flash on SWE-Bench Pro (54.2% vs. 49.6%) [1]. Ars Technica noted the unusual pace of 3.5 Flash's deprecation and argued Google's intense focus on token efficiency for enterprise cost reasons may have contributed to the original coding shortfall that 3.6 Flash was built to address [2].

Four days before the Flash releases, Google announced Gemini 3.5 Flash Cyber, trained specifically for offensive and defensive security work. In internal evaluations, it found 55 unique confirmed vulnerabilities in Chrome's V8 JavaScript engine, compared to 47 by mainline 3.5 Flash and 36 by Claude Opus 4.6 [3]. In a two-hour test on Google's own production systems, it uncovered remote code execution vulnerabilities in public APIs and a memory-corruption flaw in a sensitive service, then generated a functional RCE exploit bypassing both ASLR and W^X mitigations [3]. Google is limiting the model to governments and trusted partners through its CodeMender platform, treating access controls rather than capability reduction as the appropriate safeguard. The Verge and CyberNews framed the model as a cheaper alternative to larger dedicated AI security models, specifically naming Mythos as a cost comparison point [4][5].

Running alongside the Flash releases is the unresolved delay of Gemini 3.5 Pro, which had been expected to launch in June. Bloomberg reported that Google held the model back because coding performance fell short of internal targets, and Alphabet's share price fell on that report [6][7]. Multiple outlets have since published analysis and theories on the delay [8][9][10][11], though Google's own public communications have addressed the Pro situation only briefly and without specifics. Separately, Google disclosed it has begun what it called its most ambitious pre-training run yet for Gemini 4, with no timeline or capability claims attached [1].