Google Launches Gemini 3.5 Flash Cyber to Find and Patch Vulnerabilities at Scale

Google has unveiled Gemini 3.5 Flash Cyber, a lightweight cybersecurity model fine-tuned to detect, validate, and patch software vulnerabilities faster and more efficiently than mainline Flash models. The launch expands Google’s long-running investment in automated vulnerability discovery, building on tools like CodeMender, the company’s AI code security agent. The move addresses a pressing industry problem: […] The post Google Launches Gemini 3.5 Flash Cyber to Find and Patch Vulnerabilities at Scale appeared first on Cyber Security News.

Google has unveiled Gemini 3.5 Flash Cyber, a lightweight cybersecurity model fine-tuned to detect, validate, and patch software vulnerabilities faster and more efficiently than mainline Flash models. The launch expands Google’s long-running investment in automated vulnerability discovery, building on tools like CodeMender, the company’s AI code security agent. The move addresses a pressing industry problem: as AI agents grow more capable of finding vulnerabilities, attackers may find them faster than defenders can patch them. Google Launches Gemini 3.5 Flash Cyber 3.5 Flash Cyber is built on top of Gemini’s Flash architecture, chosen for its performance-to-cost ratio. Rather than relying on a single expensive call to a massive language model, CodeMender invokes 3.5 Flash Cyber multiple times per task, letting sub-agents analyze far more code paths before compiling a single high-quality vulnerability report. This architecture makes the model well-suited for scanning large codebases with many execution paths, and cheap enough to embed in frequent scans, commit pipelines, and time-sensitive release processes. Benchmark Performance Google evaluated 3.5 Flash Cyber across multiple benchmarks: CyberGym: Using up to five calls per report, the model achieved competitive results against significantly larger competitor models (self-reported scores). Big Sleep evaluation: Tested without safety guardrails on complex codebases like Chrome and Safari, 3.5 Flash Cyber significantly outperformed mainline 3.5 Flash and 3.6 Flash. Chrome production commit scanning: Using undisclosed, contamination-free vulnerabilities, the model showed a major uplift over mainline 3.5 Flash. Notably, newer competitor models like Opus 4.6 refused these tasks due to built-in safety guardrails. V8 JavaScript Engine testing: 3.5 Flash Cyber found 55 unique confirmed issues versus 47 for mainline 3.5 Flash and 36 for Claude Opus 4.6, including 10 vulnerabilities missed entirely by the other models. Google notes that weaker models often loop on the same finding repeatedly; a stronger model casts a wider net across unique issues, and performance continued improving as invocation counts scaled. Beyond benchmarks, 3.5 Flash Cyber is already active in CodeMender across Google’s internal codebases, including Chrome, Android, Cloud, Ads, and YouTube. In one notable case, Google’s Cloud Vulnerability Research team used the model to uncover remote code execution vulnerabilities in public APIs and a memory-corruption flaw in a sensitive production service, all within two hours. The model then generated a 100% reliable RCE exploit that bypassed standard mitigations including ASLR and W^X. Early testers at Wiz and Cloud CISO Security Engineering confirmed a substantial capability jump over mainline 3.5 Flash. Given the dual-use risk of AI-driven vulnerability discovery, Google is deploying 3.5 Flash Cyber cautiously. It will launch via a limited-access pilot through CodeMender, restricted to governments and trusted partners, expanding gradually over time. Separately, CodeMender’s core capabilities are rolling out more broadly through the Gemini Enterprise Agent Platform, giving general customers access to related vulnerability-detection tooling on generally available Gemini models. Google credits its security data infrastructure, including OSV.dev’s 700,000+ open-source vulnerability records and over a decade of OSS-Fuzz results, for training the model on real-world security workflows rather than synthetic examples, enabling it to operate industry tools and handle hours-long analysis independently. Cut SOC investigation blind spots and contain threats earlier to reduce response costs and business disruption with ANY.RUN. The post Google Launches Gemini 3.5 Flash Cyber to Find and Patch Vulnerabilities at Scale appeared first on Cyber Security News.