Google expands Gemini with cheaper models and a bug-hunter it keeps on a leash
Published by AINave Editorial • Reviewed by Ramit
Google has expanded its Gemini model lineup with three new Flash variants and a preview of CodeMender, an agent designed to automate vulnerability discovery and patching. For builders shipping AI-powered products or workflows, the updates offer cheaper token pricing, higher throughput options, and a security-focused model, albeit one with heavy access restrictions.
What happened
Google announced three new models today. Gemini 3.6 Flash is the centerpiece, positioned for coding and knowledge work. Google claims it uses up to 17% fewer output tokens than the previous 3.5 Flash on the Artificial Analysis Index and takes fewer reasoning steps to complete multistep jobs. Pricing is $1.50 per million input tokens and $7.50 per million output tokens, below 3.5 Flash costs.
The company reported benchmark gains for 3.6 Flash: 49% on DeepSWE (up from 37%), 63.9% on MLE Bench (up from 49.7%), 83% on OSWorld-Verified (up from 78.4%), and a GDPval-AA v2 score of 1421 (up from 1349). Computer use is now a built-in tool in the Gemini API and Gemini Enterprise.
Gemini 3.5 Flash-Lite is the cheapest and fastest of the three, priced at 30 cents per million input tokens and $2.50 per million output tokens. Google positions it as a migration path for workloads on 2.5 and 3 Flash models and is rolling it out in Google Search.
Gemini 3.5 Flash Cyber is a security-tuned model that runs inside CodeMender. In testing on the V8 JavaScript engine, Google said Flash Cyber found 55 unique confirmed issues, compared with 47 for 3.5 Flash and 36 for Claude Opus 4.6, including 10 that no other model caught. Citing dual-use risks, Google is restricting Flash Cyber to governments and trusted partners through a limited-access pilot.
CodeMender, the agent that powers Cyber, enters preview today. It works in three steps: scan, verify, and remediate. It scans a repository for flaws, builds an exploit in a customer-controlled sandbox to confirm each one, and then writes a patch as a code diff for developer approval. It supports C/C++, Go, Java, Python, Ruby, Rust, and TypeScript. A human review step is enforced before patches are committed. Early enterprise testers include Salesforce, Robinhood, and Palo Alto Networks.
Why AI builders should care
The pricing changes give builders immediate options for cost-sensitive and high-throughput workflows. Gemini 3.6 Flash is cheaper than its predecessor while claiming better coding and agentic performance. Gemini 3.5 Flash-Lite opens a path for scaling low-latency tasks at a fraction of the cost of larger models.
For security teams building automated workflows, CodeMender represents a concrete step toward AI-driven vulnerability discovery that still requires human approval. The agent can be wired into CI pipelines for more autonomous operation, and Google says it will add support for third-party frontier models later this year, reducing lock-in concerns.
Practical implications
| Model | Input Price (per million tokens) | Output Price (per million tokens) | Key Use Case |
|---|---|---|---|
| Gemini 3.6 Flash | $1.50 | $7.50 | General coding, knowledge work, agents |
| Gemini 3.5 Flash-Lite | $0.30 | $2.50 | High-throughput, cost-sensitive tasks |
| Gemini 3.5 Flash Cyber | Not publicly listed | Not publicly listed | Vulnerability discovery (restricted access) |
CodeMender's workflow is noteworthy: it scans repositories, validates findings with an exploit in your own sandbox, and returns a patch as a code diff. Developers must approve the change before it lands. The agent is available through the Gemini Enterprise Agent Platform and as part of Google's AI Threat Defense.
Caveats
All benchmark and performance claims come from Google-provided material and may reflect specific testing conditions. The 17% fewer output tokens claim is based on the Artificial Analysis Index, not on your own workloads. Real-world savings will vary.
Gemini 3.5 Flash Cyber is restricted to governments and trusted partners under a limited-access pilot. Most commercial builders will not be able to use it directly in the near term.
Google also noted that the latest competitive models from Anthropic performed worse at vulnerability finding than older versions, which it attributes to their safety guardrails. This raises questions about whether safety features in newer models will conflict with security-focused use cases across the industry.
