Google just made a play to win security teams on price. On Tuesday, the company launched Gemini 3.5 Flash Cyber, a dedicated model built to find and patch software vulnerabilities fast, and it’s pitching the tool as a cheaper answer to Anthropic’s pricey Mythos. Google called it a “cost-efficient and highly capable alternative” to the larger, compute-heavy systems that have dominated AI security so far.
The model rolls out first to governments and trusted partners through CodeMender, Google’s security-focused coding agent. That distribution choice tells you who Google wants in the door first: the buyers with the most code to defend and the most to lose.
What stands out here is the economics. Anthropic’s Mythos 5, part of its Project Glasswing initiative, is powerful but expensive. It costs roughly twice as much as Claude Opus 4.8 to run. Google’s bet is that speed plus low cost beats raw size, because a cheap model you can call again and again ends up scanning more code than an expensive one you invoke sparingly.
📊 Why cheaper changes the math
Security scanning isn’t a one-shot job. The more times an agent can sweep a codebase, the more paths it checks and the more bugs it surfaces. Google says CodeMender can call 3.5 Flash Cyber “multiple times at high speed and low cost,” which lets its agents cover more ground per dollar.
The benchmarks Google shared back the pitch:
- On the CyberGym AI cybersecurity benchmark, 3.5 Flash Cyber hit “competitive performance” against “significantly larger models” when called up to five times.
- Testing on Chrome’s V8 JavaScript engine, it flagged 55 unique confirmed issues, compared to 47 from standard Gemini 3.5 Flash and 36 from Opus 4.6.
- It found 10 issues no other model caught, and kept surfacing new vulnerabilities the more it was invoked.
That last point is the real argument. A model that stays productive across repeated runs rewards the call-it-often approach Google is selling.
🏁 The race behind the headline
This isn’t happening in a vacuum. Microsoft adopted Mythos for its own security checks and just had its biggest Patch Tuesday of the month after using AI to hunt for vulnerabilities. China’s Z.ai claims its model can go toe to toe with Mythos too. AI-assisted vulnerability discovery is turning into a genuine category, and the major labs are all staking claims.
Google didn’t stop at the security model. Alongside 3.5 Flash Cyber, it shipped upgraded Gemini 3.6 Flash with better coding and multimodal performance, plus a new 3.5 Flash-Lite that Google calls the “most cost-effective” option in the 3.5 lineup. The through-line across all three is cost. Google is competing on price and throughput while rivals lean on heavyweight, premium models.
🔧 What it means for practitioners
If you run security or DevOps, the takeaway is straightforward: the trade-off between capability and cost is shifting. A few things to watch:
- Cheaper per-call security models make continuous, repeated scanning affordable rather than a budget line you ration.
- Access is gated for now. Governments and trusted partners get 3.5 Flash Cyber first through CodeMender, so broad availability is still ahead.
- Expect more AI-in-the-loop patch cycles. Microsoft’s oversized Patch Tuesday is a preview of what happens when these tools point at large codebases.
The bigger shift is philosophical. For a while, the assumption was that better AI security meant bigger, costlier models. Google is arguing the opposite: a smaller model you can run cheaply and often can match the giants where it counts, in bugs actually found. If that holds up outside Google’s own benchmarks, it reshapes how teams budget for AI-driven security.
For now, the numbers come from Google, so independent testing will be the real test. You can find the full details and benchmark breakdown at the original report from The Verge AI.