Google releases cost-effective AI model for hunting security vulnerabilities

Google has unveiled Gemini 3.5 Flash Cyber, an artificial intelligence model designed to rapidly detect and fix security flaws in code. The company frames it as an economical rival to expensive, specialized systems like Anthropic's Mythos.

A cheaper tool for vulnerability hunting#

Built from Gemini 3.5 Flash, the new model will initially roll out to government agencies and select partners through CodeMender, Google's security-oriented coding platform. The arrangement allows CodeMender to invoke the model repeatedly at high speed and minimal cost—a key advantage when scanning vast amounts of code for potential weaknesses. Anthropic's Mythos 5, by contrast, carries hefty pricing: roughly double the cost of Claude Opus 4.8.

Performance on the benchmark#

When tested on the CyberGym AI cybersecurity benchmark, 3.5 Flash Cyber demonstrated "competitive performance" against much larger models when called up to five times. More tellingly, it uncovered 55 distinct confirmed issues in the V8 JavaScript Engine—outpacing both Gemini 3.5 Flash (47 issues) and Opus 4.6 (36 issues). Notably, 10 of those vulnerabilities were found by no other model, suggesting the repeated invocation strategy helps locate new code paths and attack surfaces.

Industry context#

The move reflects broader competition in AI-powered security. Microsoft adopted Mythos for vulnerability discovery and experienced a record-breaking Patch Tuesday this month. China's Z.ai has also claimed its model can compete with Mythos. Google's entry signals how vendors are racing to develop faster, cheaper alternatives to the current market leader.