Google’s Gemini 3.5 Flash Cyber model finds, validates, and patches vulnerabilities before exploitation and helps mitigate broader misuse, as part of a limited-access pilot program soon available to governments and trusted partners through CodeMender, Google DeepMind’s AI coding agent. CodeMender offers code scanning and remediation in preview via the Gemini Enterprise Agent Platform or as a core component of AI Threat Defense. The model is designed to identify vulnerabilities across large codebases requiring analysis of numerous code paths, and CodeMender invokes it multiple times to analyze execution paths, discover and validate vulnerabilities, and generate combined reports. Google evaluated Gemini 3.5 Flash Cyber on CyberGym and through Chrome’s production commit-scanning pipeline, where it achieved competitive performance against larger models on CyberGym and outperformed Gemini 3.5 Flash in evaluations by the Big Sleep team and Chrome’s pipeline. During testing on the V8 JavaScript engine, it found 55 unique confirmed issues, including 10 that Gemini 3.5 Flash and Claude Opus 4.6 did not detect. Google uses the model across internal codebases including Chrome, Android, Cloud, Ads, and YouTube. It uncovered remote-code-execution vulnerabilities in public APIs and a memory-corruption vulnerability in a sensitive production service within two hours, and generated a 100% reliable remote-code-execution exploit bypassing Address Space Layout Randomization and Write XOR Execute protections. Google also introduced Gemini 3.