On July 21, Google DeepMind released three Gemini models simultaneously: Gemini 3.6 Flash, Gemini 3.5 Flash-Lite, and a cybersecurity-specialist variant called Gemini 3.5 Flash Cyber. Each addresses a different use case, but Flash Cyber is the one that will generate discussion.
Gemini 3.5 Flash Cyber
Flash Cyber is fine-tuned specifically for vulnerability discovery and patching. Google tested it against the V8 JavaScript engine — Chrome's core — and the results were striking: it found 55 unique confirmed vulnerabilities, compared to 47 for standard Gemini 3.5 Flash and 36 for Claude Opus 4.6. Ten of those vulnerabilities were found exclusively by Flash Cyber; no other model identified them.
The model integrates with Google's CodeMender agent framework, an internal agentic system for automated code analysis. It is currently available to governments and trusted partners through a controlled rollout — not yet on Google AI Studio or Vertex AI for general access.
The framing here is deliberate. "AI finds security bugs" is a well-worn story, but testing against V8 specifically — a massively fuzzed, extremely well-audited engine — makes the benchmark harder to dismiss. V8 has had full-time security teams and millions of fuzzing hours thrown at it. Finding 55 novel vulnerabilities in it is not the same as finding bugs in a toy codebase.
Gemini 3.6 Flash
The workhorse update to the Flash line. Key changes according to 9to5Google's coverage:
- 17% fewer output tokens than 3.5 Flash, reducing costs for high-volume applications
- Computer-use accuracy on OSWorld-Verified improves from 78.4% to 83%
- Knowledge cutoff advances from January 2025 to March 2026
- Priced at $1.50 / $7.50 per million input/output tokens
The computer-use improvement is the headline spec. OSWorld-Verified is a standardized benchmark for GUI-driven agent tasks; an 83% score at this price point makes Gemini 3.6 Flash the most cost-efficient computer-use model Google has shipped.
Gemini 3.5 Flash-Lite
The smallest and cheapest of the three, positioned below Gemini 3.5 Flash for cost-sensitive workloads. Pricing details were not disclosed at launch.
The missing model
Notably absent: Gemini 3.5 Pro, which Google has teased for months and delayed twice. Google made no mention of it in the July 21 release. TechCrunch noted the omission directly in their headline. Whether the delay is a capability gap, a safety review, or a positioning decision relative to a forthcoming Gemini 4 is not clear.
For developers building AI pipelines, the practical upshot is straightforward: Gemini 3.6 Flash is the clear upgrade path from 3.5 Flash, the computer-use improvement is real, and Flash Cyber is worth watching once it exits its restricted rollout.