The short version: On July 21 Google announced three models. two you can buy — Gemini 3.6 Flash and the floor-priced 3.5 Flash-Lite. The third, Gemini 3.5 Flash Cyber, you can't: it's gated to governments and "trusted partners," with no public price and no API. It's a cybersecurity model that verifies a vulnerability by autonomously writing exploit code in a sandbox and then patches it, running inside Google's CodeMender agent. On the V8 JavaScript engine it found 55 unique confirmed issues to mainline Flash's 47 and Claude Opus 4.6's 36 — 10 of them caught by nobody else. The capability is real, it's proven on a hardened codebase, and Google decided it was dangerous enough to lock behind a pilot. For a founder, the lesson isn't "buy it." It's: assume this exists on the other side too, and shrink your attack surface now.

What it actually does#

Most models "find vulnerabilities" the way a reviewer does — they read code and reason about what might go wrong, which produces a lot of plausible-but-unconfirmed findings. Flash Cyber does something categorically different: when it suspects a bug, it writes exploit code and runs it in a sandbox to prove the vulnerability is actually reachable and exploitable, and only then generates a fix. Inside CodeMender, multiple Flash Cyber agents work in parallel and collapse their findings into one combined report. That's the leap — from "here's a suspicious pattern" to "here's a working proof, and here's the patch."

The numbers are the part that should get your attention, because they're on V8, one of the most-audited, most-attacked codebases on Earth. Over a fixed number of invocations, Flash Cyber surfaced 55 unique confirmed issues, versus 47 for the mainline model it's built from and 36 for Opus 4.6 — and 10 of its findings were caught by neither of the others. On CyberGym, the benchmark for autonomous vulnerability research, it lands at frontier-competitive scores. This is not a CTF demo. It's confirmed defects in production-grade software, found autonomously, at a rate that beats a frontier general model.

The distribution model is the news#

Here's what makes this a founder story and not a security-team story: Google isn't selling it. No public pricing, no API, access limited to governments and "trusted partners" through a controlled pilot. A hyperscaler shipped a genuinely capable model and then deliberately withheld it from the market — the clearest signal yet that the industry now treats autonomous, offensive-capable vulnerability discovery as dual-use and dangerous in the open.

When the vendor won't sell you the capability because it's too dangerous, the honest read is that the capability works — and works well enough that someone will rebuild it where the guardrails don't apply.

That's the uncomfortable inference. Restricted access slows proliferation; it doesn't prevent it. The recipe — a competent coding model plus a sandbox where it can write and run exploit code — is now publicly validated, and it generalizes to open and general-purpose models that no one is gating. The realistic timeline is not "if" attackers get autonomous vuln-scanning at scale, but "how long the delay is." Assume your public endpoints and your dependency tree are already being scanned this way by someone who didn't need Google's permission.

What a two-person team does about it#

You can't buy the defense model, so buy yourself margin instead. None of this is exotic; the asymmetry just made it urgent:

The frontier just bifurcated: the sharpest offensive-security capability is now access-gated, which tells you it's real and tells you it's coming. The founders who come out ahead aren't the ones who get into the pilot. They're the ones who automate their defense before the same technique shows up unguarded — the same instinct behind the $36M bet on AI counter-phishing. Shrink the surface now, while the delay is still on your side.