Introducing Gemini 3.5 Flash Cyber

The dedicated post says 3.5 Flash Cyber is fine-tuned to find, validate and patch vulnerabilities more effectively than mainline Flash. CodeMender can invoke it multiple times and merge a report; Google reports competitive CyberGym results and more unique issues on V8 than 3.5 Flash or Claude Opus 4.6.

Google says the Cloud Vulnerability Research team found RCE and memory-corruption issues in two hours and generated a reliable exploit that bypassed ASLR and W^X. Access is limited to governments and trusted partners via CodeMender.

This is Google DeepMind’s own model post, so benchmark tables, unique-issue counts and internal findings are vendor-reported. Competitor CyberGym scores are described as provider self-reports.

Signal Desk's read: the search-space argument is sound. Vulnerability hunting is a coverage problem, and a cheaper model that can be run many times may beat one large call. The same property is why Google is restricting access.

The two-hour internal exploit story is a capability demonstration, not a customer SLA. Buyers should treat it as evidence of dual-use power and of Google’s choice to keep the model inside a defender-controlled agent.

A general CodeMender capability is also being offered on Gemini Enterprise with generally available models. Training draws on OSV.dev and OSS-Fuzz history.