Google has introduced Gemini 3.5 Flash Cyber, an AI model aimed at finding and fixing software vulnerabilities faster and at lower cost than compute-heavy security models such as Anthropic’s Mythos.
In a Tuesday blog post, Google described the model as a lower-cost alternative to larger AI systems for cybersecurity work. The model is built on Gemini 3.5 Flash and will initially be available to governments and trusted partners through CodeMender, Google’s security-focused coding agent.
For security teams, the pitch is workload math. Vulnerability research often rewards repetition: run another pass, explore another branch, test another code path, then try again when the first attempt stalls. Google says CodeMender can call Gemini 3.5 Flash Cyber repeatedly at high speed and low cost, which lets its agents examine more possible paths through a codebase and surface more bugs.
How Google says it works
CodeMender is the orchestration layer here. Gemini 3.5 Flash Cyber supplies the model behavior, while CodeMender uses it to inspect code and generate patches. Google says the new model is tuned for security tasks rather than positioned as a general-purpose frontier model wearing a tiny hacker hoodie.
The company’s benchmark claims are specific, and they should be read as company-reported results. Google says Gemini 3.5 Flash Cyber delivered “competitive performance” against much larger models on the CyberGym AI cybersecurity benchmark when it was invoked up to five times.
Google also says the model found 55 “unique confirmed issues” in the V8 JavaScript engine. By Google’s comparison, standard Gemini 3.5 Flash found 47, while Anthropic’s Opus 4.6 found 36. Google says Gemini 3.5 Flash Cyber identified 10 issues that no other tested model found, and that repeated calls kept exposing new code paths and vulnerabilities.
The Mythos comparison
Anthropic’s Mythos 5 is the obvious yardstick. The model was released under Anthropic’s Project Glasswing initiative and is positioned for high-end security analysis. It is also expensive to run: CNBC reported that Mythos costs twice as much as Claude Opus 4.8.
Microsoft has adopted Anthropic’s Mythos for security checks, according to Reuters. The company had its largest Patch Tuesday this month after using AI to find vulnerabilities, according to The Verge. That gives Google a clear reason to show it can do similar security work without forcing every scan through the most expensive model available.
Google is not alone in chasing that space. China’s Z.ai has claimed that its own model can compete with Mythos. Google’s answer is a smaller, cheaper model that can be used more often, at least for partners allowed into the first rollout.
The useful question for defenders is whether repeated cheaper passes find real bugs quickly enough to beat a few costly runs from a larger model. Google’s V8 numbers suggest that is the case in at least one test. Wider use in real security pipelines will show whether Gemini 3.5 Flash Cyber is a practical tool or another benchmark trophy with a product page attached.
This story draws on original reporting from The Verge.
