Gemini 3.6 Flash Reduces Agent Output Tokens, While a Lightweight Cyber Variant Expands Vulnerability Discovery

Google has divided the Gemini Flash lineup into three engineering roles: 3.6 Flash handles general agentic, coding, and multimodal workloads; 3.5 Flash-Lite targets high-volume, low-latency requests; and 3.5 Flash Cyber is based on 3.5 Flash and fine-tuned to find, validate, and patch vulnerabilities. Citing Artificial Analysis, Google says 3.6 Flash uses 17% fewer output tokens on average than 3.5 Flash, while Flash-Lite has a measured throughput of 350 output tokens per second. These figures directly affect the total cost of long-running agent workflows, although results will still vary with prompts, tool loops, and serving regions.

The Cyber variant is designed not to complete an audit through a single expensive reasoning pass, but to let CodeMender invoke a smaller model in parallel or repeatedly, explore more execution paths, and then consolidate the findings into a vulnerability report. Google says that, under a fixed call budget, it found 55 confirmed issues in V8, including 10 that the comparison model did not detect. It has also been used to scan Chrome commits. However, these are primarily Google’s internal evaluations, some of which are not public, so external parties cannot fully reproduce them.

Deployment constraints are equally important: 3.5 Flash Cyber will initially be available only through CodeMender to governments and trusted partners, rather than as a generally available API model. Engineering teams should separately validate each workload’s success rate, end-to-end token usage, retry count, and time to first token instead of comparing only per-call pricing. Security teams should assess whether a specialized small model can increase code-path coverage within the same budget, and monitor when capabilities from the restricted variant become available through the general Gemini API.