Google debuts lower-cost Gemini model for AI security work

Google is launching Gemini 3.5 Flash Cyber, an AI model built to find and help fix software security flaws at lower cost than larger cyber-focused systems. The release puts Google more directly in competition with models such as Anthropic’s Mythos, as major tech companies turn AI toward vulnerability discovery.

Google said in a Tuesday blog post that Gemini 3.5 Flash Cyber is based on Gemini 3.5 Flash and is intended as a cheaper, capable option for security work. The company said access will begin with governments and trusted partners through CodeMender, Google’s security-focused coding agent.

CodeMender can use the new model repeatedly at high speed and low cost, Google said. That setup lets AI agents examine more possible paths through software and look for more security issues, according to the company.

Google positions the model against larger rivals

Anthropic’s Mythos 5 is one of the main points of comparison. The model was released under Anthropic’s Project Glasswing initiative, and CNBC reported that it is expensive to run, costing twice as much as Claude Opus 4.8.

Reuters reported that Microsoft adopted Mythos for security checks. The Verge reported that Microsoft had its largest Patch Tuesday this month after using AI to find vulnerabilities.

Google is not the only company trying to challenge Anthropic in AI security. The Verge reported that China’s Z.ai has said its own model can compete with Mythos.

Benchmark results cited by Google

Google said Gemini 3.5 Flash Cyber delivered competitive results against much larger models on CyberGym, an AI cybersecurity benchmark, when called up to five times. The company said repeated use mattered because the model continued to uncover new code paths and vulnerabilities.

In testing on the V8 JavaScript Engine, Google said Gemini 3.5 Flash Cyber identified 55 unique confirmed issues. By comparison, Google said Gemini 3.5 Flash found 47, while Opus 4.6 found 36.

Google also said the new model found 10 issues that no other model in the comparison discovered. The company did not frame the launch as a broad public release, saying the first availability will be limited to governments and trusted partners using CodeMender.

The product reflects a growing focus on AI systems that can perform security research tasks, including scanning code and proposing patches. For Google, the pitch is that smaller and cheaper models can be useful if an agent can call them many times during a single investigation.

This story draws on original reporting from The Verge.