Google on Tuesday launched Gemini 3.5 Flash Cyber, an AI model designed specifically to find and fix security flaws in software. It is built on Google's existing Gemini 3.5 Flash technology and is meant to be a cheaper alternative to larger, more expensive AI security systems like Anthropic's Mythos. Google calls it a "cost-efficient and highly capable alternative" to those models (The Verge).

The model will first be available to governments and trusted partners through CodeMender, Google's tool for security-focused code analysis. CodeMender can run the model many times at high speed and low cost, which Google says lets it scan more of a program's code and catch vulnerabilities that a single look-over might miss (The Verge).

The key idea here is that instead of using one very powerful and expensive AI model to scan your code once, you use a smaller, cheaper model and run it five times. Think of it like proofreading an essay: reading it once with full concentration versus reading it five times, each time looking for a different type of error. Google is betting the second approach catches more.

Google reports that Flash Cyber matched the performance of much larger models on a cybersecurity test called CyberGym when called up to five times. The company ran it against the V8 JavaScript engine, a widely used piece of software, and the results offer some concrete evidence. Flash Cyber identified 55 confirmed issues. The base Gemini 3.5 Flash model found 47, and Anthropic's Opus 4.6 found 36. Ten of the issues Flash Cyber found were not discovered by any other model tested (The Verge). Google did not say how many total bugs existed in the test, so it is hard to judge what the model might have missed.

Google is aiming this directly at Anthropic's Mythos lineup. Anthropic's Mythos 5 costs $10 per million input tokens and $50 per million output tokens, twice the cost of Claude Opus 4.8. Microsoft has already adopted Mythos for its security checks (The Verge). Google's pitch is that Flash Cyber can be run repeatedly at a fraction of that cost, making it more affordable to scan large amounts of code.

The broader context is a shift in how AI security tools compete. Early AI vulnerability scanners relied on the biggest, most powerful models available, paying a premium for raw capability. Google's approach flips that thinking: use a smaller model, tune it for security work, and run it many times over the same code. If a smaller model called five times can match a larger model called once, the cost of automated security scanning drops dramatically. That matters for organizations with large, constantly changing codebases where scanning costs add up fast.

There are open questions Google's announcement does not answer. The test results are self-reported. The V8 test covered confirmed issues, but Google did not disclose how many false alarms the model produced across all its calls. And the initial rollout is limited to governments and trusted partners, so outside experts cannot yet verify the claims.

Still, the V8 results suggest a model built for a specific task can find bugs that larger, general-purpose models miss, not just the same ones. The ten issues Flash Cyber found that no other model caught are the most interesting detail. If that holds up under wider testing, it would mean specialization changes what the AI actually finds, rather than just finding the same things faster.

If this approach scales, it could make continuous, thorough security scanning affordable enough that large organizations can check their entire codebases, not just the most critical parts. Google is betting that running a specialized model many times can replace using a massive model once. The V8 results are early evidence that the bet may pay off.