Thought Leadership
Google DeepMind has introduced Gemini 3.5 Flash Cyber, a specialized AI model designed to identify and fix vulnerabilities in source code for governments and trusted partners.
Google DeepMind has unveiled the specialized AI model Gemini 3.5 Flash Cyber, designed to identify, verify, and propose fixes for security vulnerabilities in software source code. The system is based on Gemini 3.5 Flash and is being made available to governments and selected partners through a limited pilot program via the CodeMender AI agent. Its lightweight architecture is designed to allow CodeMender to scan source code paths at high frequency and with low execution costs.
Test Results Across Complex Software Projects
In internal evaluations conducted by Google DeepMind, the model outperformed other language models in detecting previously unknown vulnerabilities. When tested against the V8 JavaScript engine, Gemini 3.5 Flash Cyber identified 55 confirmed security issues with a fixed number of queries, compared with 47 issues found by Gemini 3.5 Flash and 36 by Anthropic Claude Opus 4.6. Ten of these vulnerabilities were discovered exclusively by the new specialized model. The system was also tested on complex codebases such as Google Chrome and Apple Safari.
Controlled Access and Safeguards Against Misuse
Because technologies for automated vulnerability discovery can have potentially dual-use applications, Google is restricting access to the model. Security leaders Raluca Ada Popa and Four Flynn described the deployment strategy as follows:
“As part of a limited-access pilot program, 3.5 Flash Cyber will be exclusively available to governments and trusted partners through CodeMender, with access expanding over time. This gives frontline defenders a head start in finding and fixing critical vulnerabilities before they can be exploited, while helping to limit broader misuse.”
Raluca Ada Popa and Four Flynn, Google security leaders
Because the model runs exclusively within the CodeMender environment, targeted safeguards can be activated to prevent malicious activity while still enabling defensive security analysis.
(ll)
