Google Ships Gemini 3.6 Flash and Flash Cyber

The short version: Google released two broadly available Flash models and announced one deliberately restricted cybersecurity model. Gemini 3.6 Flash targets higher-quality agentic work with fewer tokens; 3.5 Flash-Lite targets speed and volume; 3.5 Flash Cyber is designed to find and patch vulnerabilities inside Google’s CodeMender system.

Which new Gemini models did Google launch?

The July 21 release splits the Flash family into three jobs rather than presenting one model as the answer to every workload.

Model	Intended role	Google-listed API price	Availability
Gemini 3.6 Flash	Coding, knowledge work, multimodal analysis, and agentic workflows	$1.50 / 1M input; $7.50 / 1M output tokens	Gemini API, AI Studio, Android Studio, Antigravity, Gemini Enterprise, and the Gemini app
Gemini 3.5 Flash-Lite	High-throughput document processing, agentic search, and lower-latency tasks	$0.30 / 1M input; $2.50 / 1M output tokens	Gemini API, AI Studio, Android Studio, Gemini Enterprise, Gemini app, and a Google Search rollout
Gemini 3.5 Flash Cyber	Finding, validating, and patching software vulnerabilities through CodeMender	Not publicly listed	A forthcoming limited pilot for governments and trusted partners

Google DeepMind announced the models on X. Screenshot captured July 24, 2026.

What changed in Gemini 3.6 Flash?

Google positions 3.6 Flash as a more efficient replacement for 3.5 Flash. It says the new model uses 17% fewer output tokens on the Artificial Analysis Index, takes fewer reasoning steps and tool calls, and costs less per token than its predecessor.

The company also reports gains on several task suites: 49% versus 37% on DeepSWE, 63.9% versus 49.7% on MLE-Bench, and 83.0% versus 78.4% on OSWorld-Verified. These figures are useful directional signals, but they are vendor-selected benchmark results. They do not establish that every production workload will become 17% cheaper or more accurate.

Token efficiency matters for agents because a single user request can trigger planning, tool calls, code execution, retries, and sub-tasks. A model that finishes a workflow with fewer output tokens and fewer loops can reduce both cost and latency. Buyers should measure cost per successful task, however—not price per token in isolation.

What is Gemini 3.5 Flash-Lite for?

Flash-Lite targets workloads where throughput matters more than maximum reasoning depth: processing large document queues, extracting structured data, agentic search, translation, and generating many candidate outputs.

Google cites 350 output tokens per second on the Artificial Analysis Index and says the model outperforms 3.1 Flash-Lite across agentic tasks. It also supports configurable thinking levels, which let developers trade more reasoning for higher latency and cost when a task requires it.

At $0.30 per million input tokens and $2.50 per million output tokens, Flash-Lite is the cheaper of the two general models. The operational question is whether its error and retry rate stays low enough that the apparent token savings survive in production.

What is Gemini 3.5 Flash Cyber?

Flash Cyber is a specialized version of 3.5 Flash fine-tuned to detect, validate, and remediate software vulnerabilities. Google says multiple Flash Cyber agents work together inside CodeMender to produce one combined report and reach competitive results on the CyberGym benchmark.

This is also the most consequential part of the launch. A model that can find and patch vulnerabilities can help defenders, but the same capability can be used to discover exploitable weaknesses. Google therefore is not putting Flash Cyber into the public Gemini API. It says access will be limited to governments and trusted partners through a forthcoming CodeMender pilot.

That restricted rollout is a product decision and a safety control. It is not proof that misuse is impossible: the real test will be how Google vets users, constrains targets, logs actions, separates discovery from exploitation, and responds when the system identifies a high-impact zero-day.

Are Google’s benchmark claims independently verified?

The answer is mixed. Google references third-party benchmark suites and the Artificial Analysis Index, but the launch post chooses the comparisons and reports several results itself. That is different from a blind, independent evaluation covering all three models.

Claim type	How to read it
Price and access	Concrete launch terms published by Google; still check current regional and platform availability before deployment.
Artificial Analysis measurements	Third-party index results cited by Google, useful for relative speed and token use.
Task benchmark scores	Vendor-reported snapshots that should be reproduced against your prompts, tools, and acceptance criteria.
Cyber performance	High-level CodeMender and CyberGym claims; public operational evidence is limited because the model is restricted.

Which model should a team test first?

• Start with 3.6 Flash when the workflow requires coding, document reasoning, multimodal interpretation, or repeated tool use.
• Test 3.5 Flash-Lite for high-volume extraction, search, routing, translation, or candidate generation where latency and unit economics dominate.
• Treat Flash Cyber as unavailable unless your organization qualifies for Google’s restricted program.

Run both general models on a representative task set and record successful completion rate, human correction time, number of tool calls, total input and output tokens, latency, and retries. The lowest model price can lose once failures and rework are included.

Why does this launch matter?

The signal is not just that another model generation arrived. Google is segmenting agent infrastructure around three scarce resources: reasoning quality, throughput, and controlled cyber capability. It is also competing on cost per completed workflow rather than raw benchmark leadership alone.

For developers, the immediate opportunity is measurable: swap a production sample to 3.6 Flash and Flash-Lite, then compare whole-task economics. For security teams, Flash Cyber raises a more difficult question: as vulnerability discovery accelerates, can patching, disclosure, access controls, and incident response keep pace?