Google Releases Gemini 3.6 Flash, 3.5 Flash-Lite, and 3.5 Flash Cyber: A Cheaper, More Token-Efficient Flash Tier Built for Agentic Workloads
MarkTechPost Asif Razzaq ● Covered by 19 sources
Google dropped three cheaper, faster Gemini Flash models today, built for agent workloads. One version even hunts security bugs automatically, and it's already outscoring Claude Opus.
Based on reporting by MarkTechPost, Asif Razzaq — read the original for the full story.
Summary, retelling and take written by AI under human oversight; images are AI-generated illustrations. How we work · Report an error
Google isn't chasing headlines with a shiny new flagship today. Instead it shipped three Flash-tier models aimed squarely at the boring, expensive part of AI: running agents at scale without burning through token budgets. Gemini 3.6 Flash, 3.5 Flash-Lite, and 3.5 Flash Cyber all landed at once, and the theme across all three is the same — do more with less, especially fewer tokens per task.
Gemini 3.6 Flash is the new default, and its pitch is almost entirely about efficiency rather than raw smarts. It uses 17% fewer output tokens than its predecessor on the Artificial Analysis Index, and up to 65% fewer on the DeepSWE coding benchmark from Datacurve. Google also cut the output price from $9.00 to $7.50 per million tokens, so a chattier model got both quieter and cheaper. Despite the trim, quality actually went up: DeepSWE scores jumped from 37% to 49%, and OSWorld-Verified climbed from 78.4% to 83.0%. Early adopters like Hebbia and Harvey are already using it for document parsing and report drafting, with computer-use now built directly into the API.
Gemini 3.5 Flash-Lite is the speed play — 350 output tokens per second at just $0.30 per million input tokens. That's not just fast for its own generation; it beats the older, larger 3 Flash on SWE-Bench Pro (54.2% vs 49.6%) and OSWorld-Verified (74.0% vs 65.1%). Developers get dial-able thinking levels, so a high-volume search pipeline can run lean while a gnarlier subagent task can spend more compute thinking things through.
The strangest and most interesting release is Flash Cyber, a version of 3.5 Flash fine-tuned specifically to find and patch software vulnerabilities. Google's logic is that hunting deep bugs is a search problem, not a reasoning problem — so instead of one giant model grinding slowly, it runs many cheap Flash Cyber instances in parallel inside CodeMender, its code-security agent, calling the model up to five times and merging results. On Google's internal Big Sleep evaluation against the V8 JavaScript engine, Flash Cyber found 55 unique confirmed bugs, compared to 47 for standard 3.5 Flash and 36 for Claude Opus 4.6. In one live test, Google's own vulnerability research team reportedly found remote-code-execution flaws in public APIs within two hours using it.
And that's exactly why Flash Cyber isn't available to just anyone. Google is gating it to governments and vetted partners, because a model this good at finding exploits is equally good at handing them to someone with bad intentions. Reaction online split predictably: builders are happy about the price drops, while some Hacker News threads groused that Google keeps shipping efficiency wins while its flagship reasoning models remain delayed and, in some cases, hard to reliably access.
My take — AI-written commentary, not fact-checked reporting
The efficiency numbers are real, and I like that Google is optimizing for token cost instead of just chasing benchmark bragging rights — that's the metric that actually matters once you're running thousands of agent calls a day. But gating Flash Cyber to governments and 'trusted partners' is the part everyone should be watching: an automated bug-hunting agent that beats Claude Opus at finding zero-days is also, by definition, a tool someone will eventually misuse, and access-control lists have a bad track record of staying closed forever.
Read more about this at: MarkTechPost
