Google's Gemini 3.5 Flash Cyber Finds 55 Bugs in Chrome's Engine That Rivals Missed
Google's new AI security model punches above its weight on vulnerability hunting, and it costs far less than the heavy-hitters it's chasing.
Key points
- Google launched Gemini 3.5 Flash Cyber as a low-cost AI model built specifically to find and fix software security flaws.
- The model found 55 confirmed vulnerabilities in V8, the JavaScript engine inside Google's Chrome browser, compared to 47 found by the older Gemini 3.5 Flash.
- Ten of those 55 bugs were unique discoveries: no other AI model spotted them.
- Flash Cyber is available first to governments and trusted partners through CodeMender, Google's security-focused coding tool.
- Anthropic's rival security model, Mythos 5, costs twice as much to run as Claude Opus 4.8.
Software vulnerabilities, the hidden flaws in code that hackers exploit to break into systems, cost organisations billions every year. Finding them fast and cheaply matters enormously. Google thinks it has a new answer.
On Tuesday, Google announced Gemini 3.5 Flash Cyber, an AI model fine-tuned specifically for cybersecurity work. It plugs into CodeMender, Google's AI coding agent, which is software that can carry out multi-step programming tasks on its own. Together, they scan code at speed, hunting for weaknesses before attackers can.
The numbers are striking. Against V8, the JavaScript engine that powers Chrome and countless other apps, Flash Cyber found 55 confirmed unique issues. The standard Gemini 3.5 Flash found 47. Anthropic's Claude Opus 4.6 found 36. Flash Cyber also scored competitively on the CyberGym benchmark, an industry test designed to measure how well AI systems handle cybersecurity challenges, when given up to five attempts per task.
Google's key design choice was repetition at scale. CodeMender can call Flash Cyber multiple times in quick succession, and each pass uncovers new code paths the previous run missed. Think of it like asking a thorough reader to check a manuscript again and again: each read catches something fresh.
That said, confirmed bug counts aren't the whole story. Our piece from 19 July, "AI Spots Bugs in Minutes. Proving They Are Real Still Takes a Human.", found that security teams are already drowning in AI-generated reports that crumble the moment someone tries to reproduce them. Volume is only useful if the bugs hold up.
Anthropicβ€˜s Mythos 5 is a heavyweight security model released under the company's Project Glasswing initiative, first reported by The Verge AI. It's powerful but expensive, costing twice as much per use as Claude Opus 4.8. Microsoft adopted Mythos for security checks and recorded its biggest-ever Patch Tuesday, the monthly release of software fixes, after the AI surfaced a wave of new vulnerabilities.
Flash Cyber is Google's bid to offer comparable results at a fraction of the running cost. That matters most when you need to scan enormous codebases repeatedly, not just once. Access for now is restricted to governments and trusted partners, with no confirmed date for broader availability.
Should ordinary users worry about any of this?
No. This is a tool for the people who defend software, not a threat to the people who use it. When AI finds a bug in Chrome's engine before a criminal does, your browser gets patched faster. Risks shrink, they don't grow.
The broader picture is a sprint among AI labs to own the security market. Google has Flash Cyber, Anthropic has Mythos, and China's Z.ai claims its own model can compete. That competition should mean faster, cheaper vulnerability patches for everyone.
