Google announces three new Gemini models: 3.6 Flash, 3.5 Flash-Lite, and 3.5 Flash Cyber. The first is the general-purpose model, the second is the economy model for quick tasks, the third specializes in code security.

If you use Google models via API or in your IDE, the concrete news is the price. 3.6 Flash costs $1.50 per million input tokens and $7.50 per output, less than the previous generation. According to the Artificial Analysis Index it uses 17% fewer tokens for the same task, with peaks of 65% fewer on coding benchmarks like DeepSWE.

3.5 Flash Cyber is the most interesting update for security teams: a lightweight model trained to find and fix vulnerabilities, paired with CodeMender, Google’s code security agent. The Verge describes it as a cost-effective alternative to pricier security models like Anthropic’s Mythos.

3.6 Flash is already available in GitHub Copilot and on Amazon Bedrock.

In detail

What actually changes.

Google’s Flash series has always been the choice for those wanting quality at an accessible price. 3.6 Flash updates that promise: same quality tier as 3.5 Flash, but with fewer tokens spent and lower cost per token. For those running agents in production, where a task might require dozens of model calls, the difference adds up quickly.

The numbers should be read with caution. The 17% token reduction figure comes from the Artificial Analysis Index, an independent benchmark. The 65% figure on DeepSWE comes from Google itself and refers to a specific coding benchmark. Real savings will depend on your use case.

Flash Cyber and the model plus agent pattern.

3.5 Flash Cyber is the most interesting signal in the announcement, not for the model itself but how it’s positioned. Google doesn’t launch it as an isolated model: they pair it with CodeMender, an agent that orchestrates model calls to scan code, find vulnerabilities, and propose patches. It’s the same pattern we’ve seen work elsewhere: a specialized model governed by an agent infrastructure that decides when to call it, with what context, and how to verify the result.

The move is directly against Anthropic’s Mythos, the security model The Verge describes as more expensive. Google positions Flash Cyber as an accessible alternative for those without the budget for frontier models.

What we still don’t know.

Google hasn’t published independent benchmarks on Flash Cyber. It’s unclear which vulnerability datasets were used for training, or how comprehensive coverage is compared to a generalist model used with good security prompts. The Mythos comparison is declarative: until there are comparative tests, it remains a marketing claim.

Flash Cyber availability is limited to Google’s ecosystem (Gemini API, Vertex AI). If your infrastructure runs elsewhere, it’s not accessible yet.

The other two models.

3.5 Flash-Lite is the fastest model in the series: 350 tokens per second, according to the Artificial Analysis Index. For tasks where latency matters more than quality (classification, data extraction, routing), it’s a solid option.

Google also announces that Gemini 3.5 Pro is in testing with partners and Gemini 4 has begun pre-training. No dates for either.