Gemini 3.6 Flash, Gemini 3.5 Flash-Lite, and Gemini 3.5 Flash Cyber are three new AI models that Google DeepMind released on July 21, 2026. Gemini 3.6 Flash is the updated mid-tier “workhorse” model for coding, knowledge work, agents, and multimodal tasks. Gemini 3.5 Flash-Lite is a smaller, cheaper model built for high-throughput, low-latency jobs like document processing and agentic search. Gemini 3.5 Flash Cyber is a specialized cybersecurity model, fine-tuned to find, validate, and patch software vulnerabilities, and it’s only available to governments and trusted partners through a limited-access pilot.
In this article we’ll discuss what each of the three models does, how they perform against their predecessors on published benchmarks, what they cost, and why the security-focused Flash Cyber model is being handled so cautiously. We’ll also look at the bigger picture surrounding the launch, including the continued absence of Google’s delayed flagship model, Gemini 3.5 Pro, and Google’s confirmation that pre-training for Gemini 4 is already underway.
TL;DR Snapshot
This release is less about a single headline model and more about Google segmenting its lineup by workload. Gemini 3.6 Flash replaces 3.5 Flash as the default choice for most production work, and Google’s pitch centers on efficiency. The new model consumes 17% fewer output tokens than its predecessor while also being priced lower. Flash-Lite targets high-volume pipelines where cost and speed matter most, and Flash Cyber applies the Flash architecture to the narrow but high-stakes job of automated vulnerability discovery and patching inside Google’s CodeMender security agent.
Key takeaways include…
- Gemini 3.6 Flash is cheaper and more token-efficient than 3.5 Flash, priced at $1.50 per million input tokens and $7.50 per million output tokens (down from $9 per million output), while posting double-digit benchmark gains.
- Gemini 3.5 Flash-Lite costs just $0.30 per million input tokens and $2.50 per million output tokens, and Google reports that it jumped from 31% to 54% on Terminal-Bench 2.1 compared with the prior Flash-Lite.
- Gemini 3.5 Flash Cyber found 55 unique confirmed issues in Google’s V8 JavaScript engine test, versus 47 for standard 3.5 Flash and 36 for Claude Opus 4.6, but public access is currently restricted.
Who should read this: Developers, engineering leaders, security professionals, and AI enthusiasts who want to understand where Google’s model lineup is headed.
Gemini 3.6 Flash: A Cheaper, More Efficient Workhorse
The centerpiece of the release is Gemini 3.6 Flash, which succeeds Gemini 3.5 Flash as Google’s general-purpose mid-tier model. Google frames the update around doing more with fewer tokens. As 9to5Google reports, the model uses 17% fewer output tokens than 3.5 Flash on the Artificial Analysis Index, and takes fewer reasoning steps and tool calls to complete multi-step workflows. That efficiency compounds with a price cut, as output tokens now cost $7.50 per million instead of $9, with input priced at $1.50 per million.
The benchmark story is strong on paper. MLQ News reports that 3.6 Flash scores 49% on the DeepSWE coding benchmark, up from 37% for its predecessor, while OSWorld-Verified rose from 78.4% to 83.0%, and MLE Bench jumped from 49.7% to 63.9%. The same report notes that the knowledge cutoff advanced from January 2025 to March 2026, and that the model keeps a one-million-token input context window with a 64,000-token maximum output. It’s worth remembering that these are vendor-reported numbers, so teams will want to validate them against their own workloads to properly assess performance.
Availability for this new model is quite broad. Per TechTimes, developers can access 3.6 Flash through the Gemini API via Google AI Studio and Android Studio, plus Google Antigravity, while enterprises get it through the Gemini Enterprise Agent Platform, and consumers see it in the Gemini app. It even landed in third-party tools on day one, GitHub’s changelog confirms that it’s available in GitHub Copilot, though enterprise administrators need to enable a preview policy first.
Gemini 3.5 Flash-Lite: Built for High-Volume, Low-Latency Work
The second model, Gemini 3.5 Flash-Lite, is aimed at a different problem: workloads where you’re making enormous numbers of calls and every millisecond and fraction of a cent matters. Think classification, extraction, routing, agentic search, and document-processing pipelines. Pricing reflects that positioning at $0.30 per million input tokens and $2.50 per million output tokens, according to 9to5Google.
What’s notable is how much capability Google claims to have packed into the budget tier. The same 9to5Google report lists a jump on Terminal-Bench 2.1 from 31% to 54% versus the March-era 3.1 Flash-Lite, long-context performance on GDM-MRCR v2 rising from 60.1% to 72.2%, and a real-world task execution score on GDPval-AA v2 of 1140 versus 642. Google even claims the new Lite model beats the older full-size Gemini 3 Flash on some tests, including SWE-Bench Pro (54.2% vs. 49.6%) and OSWorld-Verified (74.0% vs. 65.1%). If those numbers hold up in practice, the gap between “cheap model” and “capable model” will have shrunk considerably, which would significantly change the economics of building AI products at scale.
Gemini 3.5 Flash Cyber: A Security Model with a Locked Door
The third model is the most unusual. Gemini 3.5 Flash Cyber is built on top of 3.5 Flash and fine-tuned specifically to find, validate, and patch software vulnerabilities. It runs inside CodeMender, Google DeepMind’s AI code security agent, which The Hacker News notes was first unveiled in October 2025. The design logic is that vulnerability hunting is a search problem. Instead of one expensive call to a giant model, CodeMender invokes the lightweight Flash Cyber many times at high speed and low cost, letting sub-agents explore far more code paths before compiling a single report.
The results Google shared are striking. The Hacker News reports that when tested on the V8 JavaScript engine across a fixed number of invocations, Flash Cyber found 55 unique confirmed issues, compared with 47 for standard Gemini 3.5 Flash and 36 for Claude Opus 4.6. Help Net Security adds that Google’s Cloud Vulnerability Research team used the model to uncover remote-code-execution vulnerabilities in public APIs, and a memory-corruption flaw in a sensitive production service within two hours. The model is already at work on Google’s own code bases, including Chrome, Android, Cloud, Ads, and YouTube, per Google DeepMind’s announcement.
That power is exactly why access is restricted. A tool that finds vulnerabilities for defenders can find them for attackers too. In Google DeepMind’s blog post, the company writes that “given the dual-use nature of this technology, we have taken an intentional approach” to deployment, limiting the model to governments and trusted partners through a CodeMender pilot, with access potentially expanding over time. Enterprise customers can still get CodeMender’s core scanning and remediation capabilities through generally available Gemini models on the Gemini Enterprise Agent Platform.
The Elephant in the Room: Where’s Gemini 3.5 Pro?
The launch also drew a lot of attention for what wasn’t in it. Gemini 3.5 Pro, the flagship model Google announced at Google I/O in May 2026 with a promised June release, still hasn’t shipped. MLQ News notes that the deadline passed without updates, and that Google is working to improve the model’s capabilities, particularly in coding, after a late-June training data update produced disappointing results.
Meanwhile, Google is already looking past the 3.x generation entirely. According to TechTimes, the announcement confirmed that Google has started its most ambitious pre-training run yet, for Gemini 4. The message here is that the new Flash tier releases are where Google can ship fast and iterate, while the frontier work continues behind closed doors.
Frequently Asked Questions
Gemini is Google DeepMind’s family of AI models. The lineup spans multiple tiers including Pro models sit at the top for the hardest tasks, Flash models that serve everyday tasks, and Flash-Lite models that handle high-volume, cost-sensitive workloads.
CodeMender is Google DeepMind’s AI-powered code security agent, first unveiled in October 2025. It scans code bases to discover, validate, and patch software vulnerabilities, and it’s the delivery vehicle for the new Gemini 3.5 Flash Cyber model.
Tokens are the chunks of text that AI models read and generate, and API pricing is based on them. A model that uses fewer output tokens to complete the same task costs less to run, which is why Google’s claim that 3.6 Flash uses 17% fewer output tokens is a meaningful selling point for developers.
Dual-use describes technology that can serve both beneficial and harmful purposes. A model that helps defenders find and patch vulnerabilities could also help attackers find flaws to exploit, which is why Google is limiting Flash Cyber to governments and trusted partners rather than releasing it publicly.
Not as of the writing of this article. It’s only available through a limited-access pilot for governments and trusted partners via CodeMender. Most teams can instead access CodeMender’s core vulnerability-detection capabilities, powered by generally available Gemini models, through the Gemini Enterprise Agent Platform.
Google hasn’t given dates for either. Gemini 3.5 Pro remains in partner testing after missing its promised June 2026 release, and Gemini 4 has only just entered pre-training, so a public launch is likely still well off.
Other Enterprise AI Articles You May Be Interested In
OpenAI AI Models Hacked Hugging Face: Full Breakdown
Meta AI Layoffs Lawsuit: 26 Employees Allege Discrimination
Nvidia Bets Big on Japan: Inside the New Robotics and Physical AI Partnerships
Microsoft Becomes First Hyperscaler to Adopt 3M EBO Technology
What Is Grok 4.5? Everything to Know About xAI’s Latest AI Model
