Google just released three new Gemini models in one breath, like a barista rattling off today's specials. Two are for everyone. One is a government-only cybersecurity model that sounds like it moonlights as a very polite pen tester.

Flash, Flash-Lite, and a Very Exclusive Flash

Gemini 3.6 Flash lands as the new general-purpose workhorse: $1.50 per million input tokens, $7.50 per million output tokens, a million-token context window, and 17% fewer output tokens burned than its predecessor while scoring notably higher on coding benchmarks like DeepSWE (49% vs. 37%). Gemini 3.5 Flash-Lite undercuts it further at $0.30/$2.50 per million tokens, built for high-volume agentic grunt work at 350 tokens a second.

Then there's Gemini 3.5 Flash Cyber, a security-tuned variant built to find, verify, and patch vulnerabilities at scale — and it's not available to you, or basically anyone, unless you're a government or a "trusted partner" in Google's limited pilot.

The Interesting Part Isn't the Price Tag

Cheaper, faster, more efficient models are Tuesday in the AI industry at this point. What's actually notable is Google explicitly building — and just as explicitly locking down — a model whose entire job is offensive-grade vulnerability hunting.

That's a tacit admission that these models are now good enough at security research to be dangerous in the wrong hands, which is either reassuring (Google is being careful) or unsettling (the thing that needs careful handling exists at all). Figma, for what it's worth, called 3.6 Flash a genuine step forward on cost and quality — so the boring half of this launch is landing fine.

Somewhere, a red team is Slack-messaging their manager: "can we get on the trusted partner list."

Source: Google Blog