Google is taking an unusually cautious approach with its newest specialized model, Gemini 3.5 Flash Cyber, restricting access to governments and a small circle of trusted partners rather than releasing it broadly to developers or enterprises.
The model, built on top of Gemini 3.5 Flash and fine-tuned for finding, validating, and patching software vulnerabilities, is designed to work inside CodeMender, Google's code security agent. In this architecture, multiple 3.5 Flash Cyber agents operate in parallel to analyze code paths, discover flaws, and produce a single combined report. Google says this multi-agent setup allows the system to explore vastly more execution paths than a single call to a larger model could manage.
On the CyberGym benchmark, which tests AI agents against hundreds of real-world software vulnerabilities, CodeMender with 3.5 Flash Cyber achieved what Google describes as "competitive performance at the frontier" against significantly larger models. The company also tested it on Google's internal Chrome commit scanning pipeline, where it showed a "significant uplift" compared to the standard 3.5 Flash model.
The restricted release reflects a growing awareness among AI labs that models capable of finding and exploiting security flaws carry inherent dual-use risks. A tool that helps defenders patch vulnerabilities can, in principle, help attackers find them. Google's response is to gate access through a limited pilot program, with expansion planned only after further evaluation.
Separately, Google is bringing some of CodeMender's foundational capabilities to general customers through standard Gemini models and the Gemini API. This creates a two-tier system: broad access to defensive security features, and restricted access to the most capable vulnerability-hunting variant.
The decision places Google in a small but growing camp of AI companies that are voluntarily restricting access to certain model capabilities based on risk assessments, rather than releasing everything and relying on downstream safeguards. Whether this approach becomes standard practice or remains an exception will likely depend on whether the pilot program demonstrates that controlled access actually reduces misuse without crippling legitimate defensive applications.