Google's Gemini 3.5 Flash Cyber Finds 55 Bugs in Chrome's Engine That Rivals Missed
Google's new AI security model punches above its weight on vulnerability hunting, and it costs far less than the heavy-hitters it's chasing.
Key points
- Google launched Gemini 3.5 Flash Cyber on 22 July 2026 as a low-cost AI model built specifically to find and fix software security flaws.
- The model found 55 confirmed vulnerabilities in V8, the JavaScript engine inside Google's Chrome browser, compared to 47 found by the older Gemini 3.5 Flash.
- Ten of those 55 bugs were unique discoveries: no other AI model spotted them.
- Flash Cyber is available first to governments and trusted partners through CodeMender, Google's security-focused coding tool.
- Anthropic's rival security model, Mythos 5, costs twice as much to run as Anthropic's own Claude Opus 4.8.
Software vulnerabilities, the hidden flaws in code that hackers exploit to break into systems, cost companies and governments billions every year. Finding them fast, and cheaply, matters enormously. Google thinks it has a new answer.
On Tuesday, Google announced Gemini 3.5 Flash Cyber, an AI model fine-tuned specifically for cybersecurity work. It plugs into CodeMender, Google's AI coding agent, which is software that can carry out multi-step programming tasks on its own. Together, they scan code at speed, hunting for weaknesses before attackers can.
The numbers are striking. Against V8, the JavaScript engine that powers Chrome and countless other apps, Flash Cyber found 55 confirmed unique issues. The standard Gemini 3.5 Flash found 47. Anthropic's Claude Opus 4.6 found 36. Flash Cyber also scored competitively on the CyberGym benchmark, an industry test designed to measure how well AI systems handle cybersecurity challenges, when given up to five attempts per task.
Google's key design choice was repetition at scale. CodeMender can call Flash Cyber multiple times in quick succession, and each pass uncovers new code paths the previous run missed. Think of it like asking a thorough reader to check a manuscript again and again: each read catches something fresh.
The elephant in the room is Anthropic's Mythos 5, a heavyweight security model released under the company's Project Glasswing initiative. First reported by The Verge AI, Mythos 5 is powerful but expensive, costing twice as much per use as Claude Opus 4.8, Anthropic's premium general-purpose model. Microsoft adopted Mythos for security checks and recorded its biggest-ever Patch Tuesday, the monthly release of software fixes, after the AI surfaced a wave of new vulnerabilities.
Flash Cyber is Google's bid to offer comparable results at a fraction of the running cost. That matters most when you need to scan enormous codebases repeatedly, not just once.
For now, Flash Cyber is restricted to governments and trusted partners. Broader access is not yet confirmed.
Should ordinary users worry about any of this?
No. This is a tool for the people who defend software, not a threat to the people who use it. When AI finds a bug in Chrome's engine before a criminal does, your browser gets patched faster. The risk goes down, not up.
The broader picture is a sprint among AI labs to own the security market. Google has Flash Cyber. Anthropic has Mythos. China's Z.ai claims its own model can compete. That competition, whatever its costs, should mean faster, cheaper vulnerability patches for everyone.
