Google built a cyber-warfare AI that only governments can use

Google has built an AI model that can find security vulnerabilities in massive codebases, write working exploits to prove they are real, and generate patches to fix them — all autonomously, all within hours. And it has decided that only governments should be allowed to use it.

What Gemini 3.5 Flash Cyber Does

Released on July 21 alongside two general-purpose models, Gemini 3.5 Flash Cyber is not a chatbot. It is a specialised system built on top of Google's 3.5 Flash architecture, fine-tuned specifically for cybersecurity work: scanning code for vulnerabilities, validating those vulnerabilities by generating actual exploits in sandbox environments, and producing patches.

The model powers CodeMender, Google's AI security agent, which invokes Flash Cyber multiple times across a codebase to analyse different code paths simultaneously and produce consolidated vulnerability reports. In Google's own testing, the system found remote code execution flaws in public APIs and discovered a memory-corruption vulnerability in a sensitive production service — all within approximately two hours.

The performance numbers are notable. On Google's internal Chrome vulnerability pipeline, Flash Cyber found 55 unique security issues compared to 47 from the standard 3.5 Flash model and 36 from Anthropic's Claude Opus. On the Big Sleep security evaluation, it significantly outperformed both its parent model and the larger 3.6 Flash.

The Exploit Generation Problem

What makes Flash Cyber different from existing code-scanning tools is the exploit step. The model does not merely flag potential vulnerabilities — it builds working proof-of-concept exploits to verify they are real. In one documented case, the system generated a fully reliable remote code execution exploit that bypassed standard mitigation techniques.

This is the capability that forced Google's hand on access restrictions. A model that finds vulnerabilities is a defensive tool. A model that writes working exploits is, by definition, dual-use — and Google has acknowledged that explicitly.

Why Only Governments

Google DeepMind is restricting Flash Cyber to governments and trusted partners through a limited-access pilot programme. The stated rationale is to give frontline defenders — national cybersecurity agencies, military networks, critical infrastructure operators — the ability to find and patch vulnerabilities before they are exploited, while keeping the exploit-generation capability out of broader circulation.

The restriction makes Flash Cyber the first frontier AI model to be built for offensive security applications and simultaneously locked behind a government access gate. It sits in a category that did not exist a year ago: AI that is too dangerous for the private sector but too useful to withhold from the state.

The Three-Model Release

Flash Cyber was part of a broader July 21 launch that included Gemini 3.6 Flash, a general-purpose model priced at $1.50 per million input tokens, and Gemini 3.5 Flash-Lite, a lightweight variant for high-volume applications. Google also teased Gemini 4 but provided no timeline.

Notably absent from the release was Gemini 3.5 Pro, the large reasoning model the AI community has been waiting for since Google previewed its capabilities earlier this year. Google has not explained the delay, and each new Flash release without an accompanying Pro launch intensifies speculation about what is holding it back.

Google already uses Flash Cyber internally across Chrome, Android, Cloud, Ads, and YouTube security teams. The model's transition from internal tool to government product marks a new phase in how AI companies think about their most sensitive capabilities — not as products to sell broadly, but as strategic assets to share selectively with the state.