Google is taking on Anthropic’s expensive Mythos model with Gemini 3.5 Flash Cyber

If you’ve ever spent hours hunting down a single bug or vulnerability in a sprawling codebase, you know how incredibly tedious and frustrating it can be. To help tackle this growing problem, Google just announced Gemini 3.5 Flash Cyber. It’s a new, lightweight AI model built specifically to find, validate, and patch software vulnerabilities quickly.

As AI agents get better at finding vulnerabilities, those with malicious intent are discovering flaws faster than defenders can patch them. Up until now, the industry has leaned heavily on massive, compute-heavy AI models—like Anthropic’s rather expensive Mythos 5—to do deep security checks. Think of Gemini 3.5 Flash Cyber as the leaner, faster alternative.

By building on top of the already efficient 3.5 Flash model, Google is able to run it through its CodeMender security agent. Instead of relying on a single, expensive call to a giant model, CodeMender can ping 3.5 Flash Cyber multiple times at high speed and a much lower cost. This allows the AI to cast a wider net and scan vastly more code paths to find issues.

The proof is in the code

Google also has a huge advantage here, having trained this model on over 10 years of OSS-Fuzz results and its massive OSV.dev open-source vulnerability database. It is already actively working inside Google to secure Chrome, Android, YouTube, and Cloud.

When tested on the highly complex V8 JavaScript Engine, 3.5 Flash Cyber found 55 unique confirmed issues. That beats out both the mainline 3.5 Flash model and Anthropic’s Claude Opus 4.6. It even found 10 critical issues that the other models completely missed. In a real-world test, Google’s own Cloud Vulnerability Research team used it to uncover a remote code execution vulnerability in just two hours, saving them a ton of production time and resources.

Safety and availability

Because an AI that is exceptionally good at finding security flaws is inherently a dual-use technology (meaning the bad guys would love to use it, too), Google is playing it safe with the rollout. As part of a limited-access pilot, 3.5 Flash Cyber is launching exclusively to governments and trusted partners via CodeMender for now, with plans to expand over time.

The other big addition buried in this announcement is that Google is also rolling out Gemini 3.6 Flash, which brings improvements in coding and multimodal performance, alongside a new 3.5 Flash-Lite model designed to be the most cost-effective option in the 3.5 series.

If you manage large software deployments, this lightweight approach to AI security looks like a big step forward in keeping things locked down without breaking the bank.