Google DeepMind Unveils Gemini 3.5 Flash Cyber, an AI That Hunts and Patches Software Bugs
The new model, offered only to governments and vetted partners through CodeMender, aims to spot flaws in code and write fixes on its own.
Key points
- Google DeepMind announced Gemini 3.5 Flash Cyber on Tuesday, a specialised AI model built on the existing 3.5 Flash system.
- The model is designed to find, confirm, and patch software vulnerabilities, which are weaknesses in code that attackers can use to break in.
- Access is restricted to governments and trusted partners through a limited pilot delivered via a tool called CodeMender.
- Google is positioning the release as defensive tooling, not a general-purpose product for developers or the wider public.
Google's DeepMind lab has released a new artificial intelligence model aimed squarely at software security work.
It is called Gemini 3.5 Flash Cyber. The company announced it on Tuesday.
The model is built on top of Gemini 3.5 Flash, one of Google's faster and cheaper AI systems. This version has been tuned for one job: finding bugs in code, checking that the bugs are real, and writing patches to close them. A patch, in plain terms, is a small update that fixes the broken part of a program.
The rollout is deliberately narrow. Google says the model will only be available to governments and what it calls "trusted partners". It is being delivered through CodeMender, a Google system for automated code repair, and the whole thing is framed as a limited-access pilot.
That means most developers will not be able to touch it. Neither will the security community at large.
Why is Google keeping this locked down?
Because a tool that finds vulnerabilities is also, by definition, a tool that finds vulnerabilities. The same skill that helps a defender close a hole helps an attacker walk through it. Google has not spelled out its full reasoning, but limited pilots are the industry's usual answer when a capability cuts both ways.
AI models that read and reason about code are not new. What is changing is speed. A model that can scan a large codebase, flag a likely flaw, verify it actually works as an exploit, and then propose a fix compresses work that used to take a security researcher days or weeks.
Google's pitch, as reported by The Hacker News, is that Gemini 3.5 Flash Cyber does all three steps: discover, validate, patch.
The validation step matters. Most automated bug finders produce a lot of noise, flagging code that looks suspicious but is actually fine. Human researchers then spend hours chasing false alarms. If the model can confirm a bug is genuinely exploitable before a person sees it, that saves real time.
The patching step matters more. Writing a fix that closes the hole without breaking the surrounding code is genuinely hard. It is the part vendors typically get wrong when they rush.
What does this mean for ordinary users?
Nothing direct, at least for now. You cannot download it. Your bank cannot buy a subscription. The pilot is aimed at large institutions with the resources to run it responsibly.
The longer-term effect, if the tool works as advertised, is that some of the software you rely on daily could get patched faster. Fewer weeks between a bug being discovered and a fix landing on your phone or laptop.
There is a flip side worth naming. Governments with access to a fast bug-finding AI can use it defensively or offensively. Which way any particular government leans is a policy question, not a technical one, and Google has not published details on how partners will be vetted or what guardrails apply.
Regulators have not weighed in yet. Expect that to change. The European Union's AI Act and the United States' emerging federal AI guidance both cover dual-use systems, and a model explicitly built to find security flaws sits squarely in that category.
What affected users should do
Nothing to act on today. Keep your software updated, as always. That is the single most useful habit whether the patch was written by a person or a machine.
