Google expands Gemini with cheaper models and a bug-hunter it keeps on a leash

UPDATED 11:00 EDT / JULY 21 2026 AI Google expands Gemini with cheaper models and a bug-hunter it keeps on a leash by Duncan Riley Google LLC today launched three new Gemini Flash models and moved its CodeMender code-security agent into preview, part of a push to run artificial intelligence agents more cheaply and to automate the finding and fixing of software vulnerabilities. The new models are Gemini 3.6 Flash, an updated version of the workhorse model Google positions for coding and knowledge work; Gemini 3.5 Flash-Lite, built for high-throughput tasks; and Gemini 3.5 Flash Cyber, a security-tuned model the company is restricting to governments and trusted partners. Gemini 3.6 Flash is the centerpiece. Google said it uses up to 17% fewer output tokens than the previous 3.5 Flash on the Artificial Analysis Index and takes fewer reasoning steps and tool calls to complete multistep jobs. It’s priced at $1.50 per million input tokens and $7.50 per million output tokens, below the cost of 3.5 Flash. The company reported gains across coding and knowledge benchmarks. It put the model at 49% on DeepSWE against 37% for 3.5 Flash, at 63.9% on the MLE Bench measure of machine-learning research against 49.7%, and at 83% on the OSWorld-Verified test of computer use against 78.4%. Computer use is now a built-in tool in the Gemini API and Gemini Enterprise. On GDPval-AA v2, a benchmark for knowledge work, Google scored the model at 1421 against 1349. Early customers include legal AI company Harvey AI Corp. and financial research platform Hebbia Inc., which Google said used the model for document parsing, data analysis and report drafting. “Gemini 3.6 Flash excels at document drafting and review in practice areas like capital markets and corporate M&A,” Niko Grupen, head of applied research at Harvey, said in a testimonial provided by Google. “Compared to its predecessor, Gemini 3.6 Flash showed strong gains in performance on our benchmarks and was notably more efficient, completing tasks 12% faster on average.” Google said 3.6 Flash ships with expanded Frontier Safety safeguards covering chemical, biological, radiological and nuclear risks and cyber offense and has been trained to resist jailbreaks while cutting refusals of benign requests. Gemini 3.5 Flash-Lite is the cheapest and fastest of the three. Priced at 30 cents per million input tokens and $2.50 per million output tokens, it delivers the highest throughput of the 3.5 series, according to Artificial Analysis. Google said it significantly outperforms the earlier 3.1 Flash-Lite on tests, including Terminal-Bench 2.1. On some coding and agentic evals such as SWE-Bench Pro and OSWorld-Verified, it beats the larger 3 Flash. The company is positioning it as a migration path for workloads running on its 2.5 and 3 Flash models and is rolling it out in Google Search. The third model is aimed squarely at security. Gemini 3.5 Flash Cyber is fine-tuned to find, validate and patch software vulnerabilities and runs inside CodeMender. Google said that when CodeMender calls the model up to five times to produce a single report, it reaches competitive performance against much larger models on the CyberGym benchmark. In testing by Google DeepMind’s Big Sleep team on complex codebases such as Chrome and Safari, the company said Flash Cyber outperformed its own 3.5 Flash and 3.6 Flash models as well as Anthropic PBC’s Claude Opus 4.6. On the V8 JavaScript engine, Google said the model found 55 unique confirmed issues, compared with 47 for 3.5 Flash and 36 for Claude Opus 4.6, including 10 that no other model caught. Google said it benchmarked against Claude Opus 4.6 rather than newer competitor mode