Google expands Gemini with cheaper models and a bug-hunter it keeps on a leash
Google LLC today launched three new Gemini Flash models and moved its CodeMender code-security agent into preview, part of a push to run artificial intelligence agents more cheaply and to automate the finding and fixing of software vulnerabilities.
The new models are Gemini 3.6 Flash, an updated version of the workhorse model Google positions for coding and knowledge work; Gemini 3.5 Flash-Lite, built for high-throughput tasks; and Gemini 3.5 Flash Cyber, a security-tuned model the company is restricting to governments and trusted partners.
Gemini 3.6 Flash is the centerpiece. Google said it uses up to 17% fewer output tokens than the previous 3.5 Flash on the Artificial Analysis Index and takes fewer reasoning steps and tool calls to complete multistep jobs. It’s priced at $1.50 per million input tokens and $7.50 per million output tokens, below the cost of 3.5 Flash.
The company reported gains across coding and knowledge benchmarks. It put the model at 49% on DeepSWE against 37% for 3.5 Flash, at 63.9% on the MLE Bench measure of machine-learning research against 49.7%, and at 83% on the OSWorld-Verified test of computer use against 78.4%. Computer use is now a built-in tool in the Gemini API and Gemini Enterprise. On GDPval-AA v2, a benchmark for knowledge work, Google scored the model at 1421 against 1349.
Early customers include legal AI company Harvey AI Corp. and financial research platform Hebbia Inc., which Google said used the model for document parsing, data analysis and report drafting.
“Gemini 3.6 Flash excels at document drafting and review in practice areas like capital markets and corporate M&A,” Niko Grupen, head of applied research at Harvey, said in a testimonial provided by Google. “Compared to its predecessor, Gemini 3.6 Flash showed strong gains in performance on our benchmarks and was notably more efficient, completing tasks 12% faster on average.”
Google said 3.6 Flash ships with expanded Frontier Safety safeguards covering chemical, biological, radiological and nuclear risks and cyber offense and has been trained to resist jailbreaks while cutting refusals of benign requests.
Gemini 3.5 Flash-Lite is the cheapest and fastest of the three. Priced at 30 cents per million input tokens and $2.50 per million output tokens, it delivers the highest throughput of the 3.5 series, according to Artificial Analysis. Google said it significantly outperforms the earlier 3.1 Flash-Lite on tests, including Terminal-Bench 2.1. On some coding and agentic evals such as SWE-Bench Pro and OSWorld-Verified, it beats the larger 3 Flash. The company is positioning it as a migration path for workloads running on its 2.5 and 3 Flash models and is rolling it out in Google Search.
The third model is aimed squarely at security. Gemini 3.5 Flash Cyber is fine-tuned to find, validate and patch software vulnerabilities and runs inside CodeMender. Google said that when CodeMender calls the model up to five times to produce a single report, it reaches competitive performance against much larger models on the CyberGym benchmark.
In testing by Google DeepMind’s Big Sleep team on complex codebases such as Chrome and Safari, the company said Flash Cyber outperformed its own 3.5 Flash and 3.6 Flash models as well as Anthropic PBC’s Claude Opus 4.6. On the V8 JavaScript engine, Google said the model found 55 unique confirmed issues, compared with 47 for 3.5 Flash and 36 for Claude Opus 4.6, including 10 that no other model caught. Google said it benchmarked against Claude Opus 4.6 rather than newer competitor models because those more recent releases perform worse at finding vulnerabilities, which it attributed to their safety guardrails.
In a separate exercise, Google’s Cloud Vulnerability Research team used the model to uncover remote code execution flaws in public application programming interface and a memory-corruption bug in a production service within two hours, then generated a working exploit that bypassed standard memory protections.
Citing the dual-use nature of vulnerability research, Google said it will make Flash Cyber available only to governments and trusted partners through CodeMender under a limited-access pilot.
CodeMender, the agent that runs the model, entered preview today. Built on Google DeepMind research, CodeMender works in three steps Google calls scan, verify and remediate. It first scans a repository for flaws such as memory corruption, injection and cryptographic weaknesses. It then tries to prove each one is real, building an exploit and running it in a sandbox the customer controls to weed out false positives.
If the exploit succeeds, the agent writes a patch and returns it as a code diff for the developer to approve. It supports C/C++, Go, Java, Python, Ruby, Rust and TypeScript. Google is not tying customers to one model. They can pick whichever fits the cost, speed and scanning depth a job needs, and the company said it will add support for third-party frontier models later this year. It’s available through the Gemini Enterprise Agent Platform and as a component of Google’s AI Threat Defense, where the company’s Wiz cloud-security platform enriches CodeMender’s findings in the Wiz Security Graph and triggers automated penetration testing. Google said Wiz will also be able to call CodeMender to scan code, a capability it described as coming soon.
CodeMender keeps a human in the loop. Developers approve patches before they are committed, though the agent can be wired into continuous integration pipelines for autonomous operation. Google said source code data is encrypted, isolated and not retained.
Early enterprise testers include Salesforce Inc., Robinhood Markets Inc. and Palo Alto Networks Inc. Iain Mulholland, chief information security officer at Salesforce, said CodeMender “brings AI into a critical part of the security lifecycle by accelerating the path from validated vulnerability to tested fix.” Scott Ponte, head of security operations at Robinhood, said the agent “consistently identified critical vulnerabilities that our other AI-enabled tools completely missed.”
Gemini 3.6 Flash and 3.5 Flash-Lite are available starting today through the Gemini API in Google AI Studio and Android Studio, with 3.6 Flash also in Google’s Antigravity coding tool and the Gemini Enterprise app. Both reach consumers through the Gemini app. Google said Gemini 3.5 Pro is now testing with partners ahead of a broader release and that its most ambitious pretraining run yet is under way for Gemini 4.
Image: SiliconANGLE/Ideogram
Support our mission to keep content open and free by engaging with theCUBE community. Join theCUBE’s Alumni Trust Network, where technology leaders connect, share intelligence and create opportunities.
15M+ viewers of theCUBE videos, powering conversations across AI, cloud, cybersecurity and more** 11.4k+ theCUBE alumni**— Connect with more than 11,400 tech and business leaders shaping the future through a unique trusted-based network.
About SiliconANGLE Media
theCUBE AIand theCUBE SuperStudios — with flagship locations in Silicon Valley and the New York Stock Exchange — SiliconANGLE Media operates at the intersection of media, technology and AI.
Founded by tech visionaries John Furrier and Dave Vellante, SiliconANGLE Media has built a dynamic ecosystem of industry-leading digital media brands that reach 15+ million elite tech professionals. Our new proprietary theCUBE AI Video Cloud is breaking ground in audience interaction, leveraging theCUBEai.com neural network to help technology companies make data-driven decisions and stay at the forefront of industry conversations.