Google restricts Gemini 3.5 Flash Cyber as CodeMender enters preview for select enterprises
Gemini 3.5 Flash Cyber found 55 confirmed issues in V8 engine, outperforming Claude Opus 4.6
Google DeepMind has introduced Gemini 3.5 Flash Cyber, a specialized model tuned for vulnerability discovery, validation, and automated patching. The model is built on Gemini 3.5 Flash and is currently deployed internally across Chrome, Android, Google Cloud, Ads, and YouTube codebases via CodeMender. Access is strictly limited to governments and trusted partners, with no standalone API or public release date set. CodeMender itself enters preview for select enterprise customers, but only for evaluation — not commercial use.
The model's performance in Google's CyberGym benchmark shows 55 confirmed issues in the V8 JavaScript engine, compared to 47 for standard Gemini 3.5 Flash and 36 for Claude Opus 4.6. However, Google has not published false-positive rates, patch-acceptance rates, or independent production testing results. The restricted rollout accounts for dual-use risks — the same technology that helps defenders could aid attackers, as highlighted by Google's own AI-assisted zero-day exploit demonstration in May 2026. Enterprises evaluating CodeMender must verify pricing, external evidence, code-handling rules, and ensure isolated environments with human review.
- Gemini 3.5 Flash Cyber found 55 confirmed vulnerabilities in V8 engine, outperforming Claude Opus 4.6 (36) and standard Gemini 3.5 Flash (47).
- Access is restricted to governments and trusted partners; no standalone API or public release date announced.
- CodeMender preview is for enterprise testing only, with code snippets sent to Google cloud but full repository not uploaded, and session data retained up to 7 days.
Why It Matters
Specialized AI for vulnerability discovery could transform security workflows, but restricted access and unverified production metrics delay enterprise adoption.