Gemini 3.5 Flash Cyber: an AI that finds and patches CVEs

Google shipped a model built to do one job: find the security holes in your code, prove they're real, and write the patch. Gemini 3.5 Flash Cyber, released July 21, is fast, cheap, and disturbingly good at it — in one test it surfaced a remote-code-execution flaw in a production service within two hours. There's a catch that matters for every small operator: you can't buy it yet. It's gated to governments and "trusted partners." The lesson isn't to wait for the tool. It's to own the boring pipeline you can run today.

What actually happened

Per Google DeepMind's announcement, Gemini 3.5 Flash Cyber is a lightweight model fine-tuned from Gemini 3.5 Flash that "finds, validates, and patches vulnerabilities before they can be exploited." It was one of three Flash models Google released that day — TechCrunch noted the still-missing Gemini 3.5 Pro — and it's the one aimed squarely at security teams.

The results are real. Per Help Net Security, on Google's own V8 JavaScript engine it flagged 55 confirmed issues, 10 of which competing models missed, and within two hours "uncovered remote-code-execution vulnerabilities in public APIs and a memory-corruption vulnerability in a sensitive production service." It runs inside CodeMender, Google's managed code-security agent, and is pitched for "frequent security scans, time-sensitive release processes, and commit-scanning pipelines at scale."

Two things about availability. First, it's a limited-access pilot, "soon available to governments and trusted partners through CodeMender," with broader access "later." Second, Google is already running it internally across Chrome, Android, Cloud, Ads, and YouTube. The best version of this capability ships to the platform owner first and to you last.

Why it matters for your business

A model that autonomously writes exploit code to verify a bug and then generates the patch is a genuine shift in defense. It's also a genuine shift in offense — the same capability class shortens the attacker's path from "there might be a bug here" to "here's the working exploit." You don't get to opt out of that half.

So the durable move isn't waiting for a gated Google model. It's owning the unglamorous pipeline that closes your window: automated dependency scanning on every build, commit-time checks, and a patch process measured in hours, not weeks — built on tools you can actually access today. When the frontier vuln-hunters do reach the mid-market, they plug into that pipeline and make it faster. If you don't have the pipeline, a smarter scanner just finds more holes you're too slow to fix. The advantage was never the model. It's the machinery around it — and that's the part you own.

Sources: Google DeepMind — Introducing Gemini 3.5 Flash Cyber, Help Net Security — Google's Gemini 3.5 Flash Cyber becomes a vulnerability hunter, TechCrunch — Google releases three new Gemini models, but no 3.5 Pro.