Google Gemini 3.5 Flash AI Speeds Vulnerability Detection and Patching

Key Takeaways

• Google has launched Gemini 3.5 Flash Cyber, a new AI model specifically designed to accelerate the discovery, validation, and patching of software vulnerabilities.
• This specialized model, integrated with Google’s CodeMender agent, prioritizes speed and cost-efficiency over raw scale, making it practical for extensive code scanning.
• Initial testing shows 3.5 Flash Cyber outperforming larger, more expensive models in vulnerability detection across various benchmarks, including Chrome, Safari, and the V8 JavaScript Engine.
• The model is already finding critical flaws within Google’s internal systems, such as remote code execution (RCE) vulnerabilities in public APIs and memory corruption bugs.
• Google is implementing a controlled rollout, initially offering 3.5 Flash Cyber to governments and trusted partners via a limited-access pilot due to its “dual-use” potential.

Google has unveiled Gemini 3.5 Flash Cyber, a cutting-edge artificial intelligence model engineered to enhance the speed and efficacy of identifying, validating, and remediating software vulnerabilities. This specialized AI represents a strategic evolution in Google’s automated security research, building upon existing innovations like CodeMender, the company’s AI-powered code security agent.

As AI agents become increasingly adept at discovering security flaws, a critical race emerges: attackers could potentially exploit vulnerabilities faster than defense teams can deploy patches. Google’s response to this escalating challenge is not merely a more powerful model, but one that is both smarter and more economical.

Constructed on the foundational Gemini 3.5 Flash architecture, the 3.5 Flash Cyber variant sacrifices some raw computational scale in favor of heightened speed and cost-efficiency. This design choice makes it a viable solution for large-scale, frequent deployment in extensive codebases.

The essence of vulnerability hunting lies in its nature as a search problem. Scrutinizing vast amounts of code entails exploring an immense number of potential execution paths. Relying on a single, resource-intensive call to a very large AI model can create significant performance bottlenecks. CodeMender addresses this by orchestrating multiple invocations of 3.5 Flash Cyber. This allows sub-agents to analyze a far greater number of code paths in parallel before synthesizing a comprehensive, high-quality vulnerability report. This architecture makes the model particularly suitable for regular scans, time-sensitive development pipelines, and commit-level scanning at scale.

Gemini 3.5 Flash Cyber Performance

Google subjected the new model to rigorous internal testing:

• CyberGym Benchmark: When evaluated against the CyberGym benchmark, CodeMender, leveraging 3.5 Flash Cyber with up to five calls per report, achieved results comparable to significantly larger and more expensive cybersecurity models.
• Big Sleep Evaluation: In tests involving complex codebases like Chrome and Safari, 3.5 Flash Cyber demonstrated a marked improvement in performance compared to the mainline 3.5 Flash and 3.6 Flash models.
• Chrome Production Commit Scanning: The model was tested on undisclosed vulnerabilities within Chrome’s production commit scanning process, showing a substantial uplift in success rate over the standard Flash model, ensuring no data contamination.
• V8 JavaScript Engine Test: During an assessment of the V8 JavaScript Engine, 3.5 Flash Cyber successfully identified 55 unique, confirmed issues. This contrasts with 47 issues found by the mainline 3.5 Flash and 36 by Claude Opus 4.6. Notably, 3.5 Flash Cyber discovered 10 issues that neither of its competitors detected.

Google notes that less sophisticated models often get stuck repeatedly identifying the same flaw. In contrast, a more robust model like 3.5 Flash Cyber employs a broader search strategy, consistently uncovering new vulnerabilities as the number of invocations increases.

Beyond benchmark performance, 3.5 Flash Cyber is already actively deployed within Google’s internal codebases, including critical platforms such as Chrome, Android, Cloud, Ads, and YouTube. In a particularly significant instance, Google’s Cloud Vulnerability Research team utilized the model to pinpoint remote code execution (RCE) vulnerabilities in public APIs and a memory-corruption bug within a sensitive production service, all within a two-hour timeframe. The model subsequently generated a fully functional RCE exploit capable of bypassing common protections like ASLR (Address Space Layout Randomization) and W^X (Write XOR Execute).

Given its “dual-use” potential—meaning it could be leveraged for both defensive and offensive purposes—Google is implementing 3.5 Flash Cyber with careful consideration. Its initial availability will be restricted to a limited-access pilot program for governments and trusted partners through CodeMender, with a gradual expansion planned. Separately, the core functionalities of CodeMender are also being extended to enterprise clients via the Gemini Enterprise Agent Platform.

Google’s significant advantage in this domain is rooted in decades of robust security infrastructure. This includes OSV.dev, its comprehensive database containing over 700,000 open-source vulnerabilities, and more than 10 years of results from OSS-Fuzz. These resources provide the high-quality training data essential for teaching AI models how actual security professionals operate.

What You Should Do

• Stay Informed: Keep abreast of official announcements from Google regarding the broader availability and integration of Gemini 3.5 Flash Cyber into security tools.
• Evaluate AI Security Tools: As AI-driven vulnerability detection matures, assess how such tools could complement your existing security pipelines for faster, more comprehensive code analysis.
• Prioritize Patching: Continue to prioritize the rapid patching of identified vulnerabilities, regardless of how they are discovered, to minimize exposure to potential threats.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.