Google DeepMind Unveils Gemini 3.5 Flash Cyber, an AI That Hunts and Patches Software Bugs

Key points

• Google DeepMind announced Gemini 3.5 Flash Cyber on Tuesday, a specialised AI model built on the existing 3.5 Flash system.
• The model is designed to find, confirm and patch software vulnerabilities, which are weaknesses in code that attackers can use to break in.
• Access is restricted to governments and trusted partners through a limited pilot delivered via a tool called CodeMender.
• Google is positioning the release as defensive tooling, not a general-purpose product for developers or the wider public.

Google's DeepMind lab has released a new artificial intelligence model aimed squarely at software security work.

Called Gemini 3.5 Flash Cyber and announced on Tuesday, it's built on Gemini 3.5 Flash, one of Google's faster, cheaper AI systems. This version has been tuned for one job: finding bugs in code, checking they're real, and writing patches to close them. A patch, in plain terms, is a small update that fixes the broken part of a program.

The rollout is deliberately narrow. Google says the model will only be available to governments and what it calls "trusted partners", delivered through CodeMender, a Google system for automated code repair, as a limited-access pilot. Most developers won't be able to touch it. Neither will the security community at large.

Why is Google keeping this locked down?

Because a tool that finds vulnerabilities is also, by definition, a tool that finds vulnerabilities. The same skill that helps a defender close a hole helps an attacker walk through it. Google hasn't spelled out its full reasoning, but limited pilots are the industry's usual answer when a capability cuts both ways.

AI models that read and reason about code aren't new. What's changing is speed. A model that can scan a large codebase, flag a likely flaw, verify it actually works as an exploit, and then propose a fix compresses work that used to take a security researcher days or weeks.

Google's pitch, as reported by The Hacker News, is that Gemini 3.5 Flash Cyber handles all three steps: discover, validate, patch.

The validation step matters. Most automated bug finders produce noise, flagging code that looks suspicious but is actually fine, and human researchers spend hours chasing false alarms. If the model can confirm a bug is genuinely exploitable before a person sees it, that saves real time. The patching step matters more. Writing a fix that closes the hole without breaking the surrounding code is genuinely hard. It's the part vendors typically get wrong when they rush.

This isn't Google's first move in the AI-versus-hacker space. Our 17 July story on Google's automated defence platform noted the company's argument that criminals can hand off access to a breached network in 22 seconds, a speed no human security team matches.

What does this mean for ordinary users?

Nothing direct, at least for now. You can't download it, and your bank can't buy a subscription. The pilot targets large institutions with the resources to run it responsibly.

Longer term, if the tool works as advertised, some of the software you rely on daily could get patched faster. Fewer weeks between a bug being found and a fix landing on your phone or laptop.

There's a flip side worth naming. Governments with access to a fast bug-finding AI can use it defensively or offensively. Which way any particular government leans is a policy question, not a technical one, and Google hasn't published details on vetting criteria or what guardrails apply.

Regulators haven't weighed in yet. Expect that to change. The EU's AI Act and emerging US federal AI guidance both cover dual-use systems, and a model explicitly built to find security flaws sits squarely in that category.

What affected users should do

Nothing to act on today. Keep your software updated. That's the single most useful habit whether the patch was written by a person or a machine.