Google rolls out lower-cost Gemini Flash models and CodeMender preview

Google launched three new Gemini Flash models and put its CodeMender security agent into preview, with its main new model priced at $1.50 per million input tokens and $7.50 per million output tokens. The release is aimed at lowering the cost of running AI agents while pushing more software vulnerability work into automated scan, exploit-validation and patch workflows.

The new lineup includes Gemini 3.6 Flash, Gemini 3.5 Flash-Lite and Gemini 3.5 Flash Cyber. Google did not disclose development costs, customer pricing for CodeMender or any revenue figures tied to Gemini Enterprise adoption.

Gemini 3.6 Flash is the general-purpose upgrade in the group. Google said the model uses up to 17% fewer output tokens than Gemini 3.5 Flash on the Artificial Analysis Index and needs fewer reasoning steps and tool calls for multistep tasks. That matters for customers running agents at scale, where output tokens and repeated tool calls can turn a nominally cheap model into a larger operating expense.

Google reported several benchmark gains for 3.6 Flash, including 49% on DeepSWE compared with 37% for 3.5 Flash, 63.9% on MLE Bench versus 49.7%, and 83% on OSWorld-Verified versus 78.4%. On GDPval-AA v2, a knowledge-work benchmark, Google said 3.6 Flash scored 1421 compared with 1349 for the prior model. Benchmarks are Google-reported and should be treated as directional until customers test the model on their own workloads.

The company said early users include Harvey AI and Hebbia, which used the model for tasks including document parsing, data analysis and report generation. Google also said 3.6 Flash includes expanded Frontier Safety controls for chemical, biological, radiological, nuclear and cyber-offense risks, along with training meant to reduce jailbreak success while avoiding unnecessary refusals.

Cheaper throughput and a restricted security model

Gemini 3.5 Flash-Lite is the low-cost option. Google priced it at 30 cents per million input tokens and $2.50 per million output tokens, and said Artificial Analysis found it had the highest throughput of the 3.5 series. Google is pitching it as a migration target for workloads currently on 2.5 and 3 Flash models, and said it is also being rolled out in Google Search.

The more sensitive launch is Gemini 3.5 Flash Cyber, a model trained for vulnerability discovery, validation and patching. Google said the model runs inside CodeMender and, when called up to five times for a single report, performs competitively with larger models on the CyberGym benchmark.

Google said DeepMind’s Big Sleep team tested Flash Cyber on codebases including Chrome and Safari. On the V8 JavaScript engine, Google said the model found 55 unique confirmed issues, compared with 47 for Gemini 3.5 Flash and 36 for Anthropic’s Claude Opus 4.6. Google said 10 of those issues were not found by the other models in the comparison.

Google also said its Cloud Vulnerability Research team used the model to find remote code execution issues in a public API and a memory-corruption bug in a production service within two hours, then generated an exploit that bypassed standard memory protections. Because that capability is dual-use, Google said Flash Cyber will be available only to governments and trusted partners through a limited-access CodeMender pilot.

CodeMender keeps developers in the approval loop

CodeMender scans repositories for issues such as memory corruption, injection flaws and cryptographic weaknesses, then attempts to prove findings by building an exploit and running it in a customer-controlled sandbox. If the finding is validated, the agent produces a code diff for developer approval. Google said it supports C/C++, Go, Java, Python, Ruby, Rust and TypeScript.

The agent is available through the Gemini Enterprise Agent Platform and as part of Google’s AI Threat Defense. Google said Wiz will enrich CodeMender findings in the Wiz Security Graph and will later be able to call CodeMender to scan code. The company also said it plans to add support for third-party frontier models later this year.

Google said source code data used by CodeMender is encrypted, isolated and not retained. Early enterprise testers named by Google include Salesforce, Robinhood and Palo Alto Networks. Gemini 3.6 Flash and 3.5 Flash-Lite are available through the Gemini API in Google AI Studio and Android Studio, with 3.6 Flash also available in Antigravity and the Gemini Enterprise app. Google said Gemini 3.5 Pro is being tested with partners and that training for Gemini 4 is underway.

This story draws on original reporting from SiliconANGLE.