# Google's Cyber AI Can Find Vulnerabilities Faster Than Any Human — And That's the Point
The benchmark numbers buried in DeepMind's announcement tell a story worth sitting with. Running against V8, the JavaScript engine inside Chrome, Gemini 3.5 Flash Cyber found 55 unique confirmed vulnerabilities in a fixed number of invocations. Gemini 3.5 Flash found 47. Claude Opus 4.6 found 36. And 10 of those 55 were caught by nothing else.
This isn't a marginal improvement. It's a widening gap, and it's accelerating.
Google DeepMind shipped Gemini 3.5 Flash Cyber on Tuesday — a security-specialized model built on the 3.5 Flash architecture and integrated exclusively into CodeMender, the company's AI-powered vulnerability discovery and patching agent. For now, the only way to access it is through a government or "trusted partner" arrangement. That's not an accident.
## Built to Find What Humans Miss at Scale
The design logic here is worth understanding before the marketing noise drowns it out.
Conventional AI-assisted code auditing hits a cost ceiling fast. Large models are expensive, and running them across millions of lines of code repeatedly — probing different paths, trying varied inputs, re-evaluating after patches — becomes economically prohibitive at enterprise scale. Gemini 3.5 Flash Cyber is explicitly optimized to be called "multiple times at high speed and low cost." CodeMender doesn't invoke it once; it invokes it dozens of times per scan, covering code paths that would exhaust a single expensive model pass.
The practical result is breadth. You're not getting one deep look at a codebase — you're getting a hundred rapid-fire passes from slightly different angles. For complex systems like browser engines and kernel components, where the interesting bugs live at the intersection of edge cases, that matters.
The model also did something that should catch every security engineer's attention: it produced a 100% reliable remote-code execution exploit that bypassed both ASLR and W^X protections. These aren't obscure mitigations. ASLR has been a standard memory protection technique for nearly two decades. W^X — the principle that memory can be either writable or executable but not both — is a foundational defense against code injection. A model that reliably circumvents both in testing is not a tool you hand out freely.
## The Government-First Strategy Is a Risk Calculation, Not a Business Decision
DeepMind's Gemini Security Lead Raluca Ada Popa and VP of Security Four Flynn published a blog post alongside the announcement that was unusually candid about the dual-use problem. "Given the dual-use nature of this technology, we have taken an intentional approach to how we deploy 3.5 Flash Cyber," they wrote.
That framing matters. This isn't a company saying its AI tool is too powerful for regular customers because enterprise pricing tiers haven't been built yet. This is an explicit acknowledgment that a model capable of autonomously finding RCE vulnerabilities in Chrome-level complexity, and then building reliable exploits around those findings, cannot be offered as a cloud API to anyone with a credit card.
The sandboxing approach they've chosen is architecturally clever. Because 3.5 Flash Cyber only runs inside CodeMender, Google can tune exactly what the model will and won't do — enabling forensic analysis workflows that a refusal-heavy general model might reject, while blocking the raw vulnerability-to-exploit pipeline that an adversary would want. The model's capabilities don't change; its operating envelope does. Whether that holds when the model's weights eventually leak — and they will — is a different conversation.
The government-first pilot gives defenders an asymmetric advantage while the ecosystem catches up. In theory. In practice, it depends heavily on which governments, what vetting looks like, and whether the "trusted partner" criteria are rigorous or commercially flexible.
## Anthropic and OpenAI Walked This Road First
Google is not the first lab to publish this kind of work. Anthropic demonstrated Claude's ability to find RCE vulnerabilities in real production environments. OpenAI has done similar evaluations. What's new here is the deployment architecture — CodeMender as the sandboxed delivery mechanism — and the explicit benchmark comparisons that put a number on the performance gap.
Those numbers create their own pressure. If defenders using Gemini 3.5 Flash Cyber can find 55 issues where Claude finds 36, the competitive calculus for government and enterprise security teams is obvious. It also creates an arms race dynamic where every major lab now needs a security-specialized model to compete for this market segment.
The timeline is compressing. CodeMender was announced in October 2025 — nine months ago. The specialized model built for it is already outperforming general-purpose frontier models on real codebases. Red-teaming capabilities and end-to-end enterprise defense are on the roadmap. The pace from "announced the agent" to "released the specialist model" to "enterprise availability" is not leisurely.
## HackWire Analysis
What the coverage is mostly missing is the infrastructure security angle. Browser engines and public APIs are the headliners in DeepMind's benchmark numbers, but CodeMender's real value proposition — and its real risk surface — is legacy enterprise code.
Government agencies and large enterprises run millions of lines of C and C++ written before memory-safe practices were standard. That code is rarely audited thoroughly because the human cost is prohibitive. A model that can sweep that surface cheaply, at scale, and with demonstrably better recall than humans or general-purpose AI changes the economic calculus for vulnerability discovery programs. It also changes the calculus for any adversary who gains access to equivalent capability.
The government-first rollout is the right call. But "governments and trusted partners" is a category that has historically included contractors, integrators, and partner agencies with varying security practices. The real stress test for DeepMind's dual-use guardrails isn't a nation-state threat actor building their own equivalent — it's a subcontractor with legitimate access and loose operational security.
The 55-versus-36 benchmark gap also deserves scrutiny beyond the headline. V8 is an extremely well-audited codebase with a large historical bug database that training data almost certainly includes in some form. Performance on less-studied targets — obscure industrial control system firmware, proprietary telecom stacks, embedded medical device software — is the number Google hasn't published yet. That's where the real unknowns live.
For defenders, the practical action is not to wait for broad access. If your organization qualifies as a government or trusted partner, the pilot program is worth pursuing now — the head start is the entire point of the access restriction. For everyone else, the Gemini Enterprise Agent Platform with generally available models offers CodeMender's foundational capabilities without the specialized model. It's a meaningful step down in raw vulnerability discovery performance, but it's available today.
— HackWire Editorial
## Related Coverage