Google Built an Exploit-Writing Gemini, Then Locked It Up

Google DeepMind announced Gemini 3.5 Flash Cyber this morning, a lightweight model fine-tuned to discover, validate and patch software vulnerabilities, and it is the first Gemini release Google has refused to sell. Access runs through a limited pilot open only to governments and vetted partners via CodeMender, Google's automated code-fixing agent. The reason is in the results: on an internal test the model produced a remote-code-execution exploit that worked 100% of the time and walked straight through ASLR and W^X, the two mitigations most production binaries still lean on.

• It out-finds bigger models. Scanning the V8 JavaScript engine, Flash Cyber surfaced 55 unique confirmed issues, against 47 for mainline Gemini 3.5 Flash and 36 for Claude Opus 4.6. Ten of those bugs were found by no other model tested.
• It is small on purpose. Flash Cyber is a fine-tune of 3.5 Flash, not a frontier model, so CodeMender can call it five times per report and still stay cheap enough to run across a whole commit stream.
• It is deliberately not for sale. Governments and trusted partners only, through CodeMender. Everyone else gets the same agent workflow backed by generally available Gemini models.
• Rivals are refusing the work. Google says newer competitor models declined parts of the Chrome commit-scanning task outright because of their own safety guardrails.

What did Google actually ship?

Flash Cyber is a security specialist built on Gemini 3.5 Flash, written up by Raluca Ada Popa, DeepMind's Gemini security lead, and Four Flynn, VP of security and privacy. It was trained on real security workflows across millions of lines of code, plus two assets Google happens to own outright: OSV.dev, the open-source vulnerability database with more than 700,000 entries, and a decade of OSS-Fuzz crash data. That is a corpus almost nobody else can assemble, and it explains why a Flash-class model beats far larger ones at this one job.

RelatedKemp LoadMaster Pre-Auth RCE Is Now Under Active Attack

The delivery vehicle is CodeMender, the autonomous patching agent Google unveiled in October 2025. CodeMender invokes Flash Cyber several times over different code paths and merges the output into a single report, so the model's small size is the point rather than a compromise. Five cheap calls beat one expensive one when the task is sweeping a repository.

How much better is it at finding bugs?

Google published four evaluations. On the V8 JavaScript engine, the headline test, Flash Cyber confirmed 55 unique issues where mainline 3.5 Flash found 47 and Claude Opus 4.6 found 36, with ten bugs that only Flash Cyber caught. On CyberGym, configured for up to five calls per report, Google says it is competitive with significantly larger models. On the Big Sleep evaluation against real Chrome and Safari code it beat both 3.5 Flash and the brand new 3.6 Flash. And on live Chrome production commit scanning it showed what Google calls significant uplift.

The number that matters most is not on that chart. Google's Cloud Vulnerability Research team pointed the model at a sensitive production service and, inside two hours, it surfaced remote-code-execution flaws in public APIs and a memory-corruption bug, then wrote an exploit that worked every single time and defeated address space layout randomization and write-xor-execute. Finding a crash is routine. Turning a crash into a deterministic exploit is the part that used to take a senior researcher weeks.

Why will Google not let you use it?

Because the same capability points in both directions. A model that reliably converts a memory-corruption bug into a working exploit is a defensive tool in a maintainer's hands and an offensive one everywhere else. Google's answer is distribution control rather than refusal: keep the weights and the endpoint inside a pilot, ship the CodeMender workflow to everyone else on generally available Gemini models, and let the capability gap sit where it can be audited.

That is a quieter position than it sounds. Google is implicitly saying its competitors solved this by teaching models to say no, and that this was the wrong trade. The claim that rival models refused parts of the Chrome scanning task is a shot at exactly that approach: a security model that declines security work is not safe, it is useless, and the maintainer still ships the bug.

What does it mean for the security market?

The exposed businesses are the ones that sell human vulnerability research by the hour. Bug bounty economics assume a scarce supply of people who can chain a crash into a proof of concept. A cheap Flash-class model that does the chaining changes the price of that labor, and the platforms sitting in the middle, HackerOne and Bugcrowd among them, will feel it before any vendor does. Wiz, now inside Google Cloud after the $32B acquisition, is named as an early tester, which tells you where this ends up commercially: bundled into cloud security posture management rather than sold as a model.

For investors the signal is not a Gemini revenue line, because there is not one here. It is that Google is willing to hold back a shippable capability, and that its moat in this niche is data nobody can buy: OSV.dev and ten years of OSS-Fuzz. Watch whether Microsoft and Amazon respond with equivalent gated security models, and watch whether any government pilot partner is ever named. Neither is investment advice, but both are the tells worth tracking.

1. Oct 2025Google unveils CodeMender autonomous agent that finds and patches critical flaws
2. Jul 21, 2026Gemini 3.6 Flash and 3.5 Flash-Lite ship generally available, priced from $0.30 per 1M input tokens
3. Jul 21, 2026Gemini 3.5 Flash Cyber announced gated pilot, governments and trusted partners only
4. NextGemini 4 pre-training Google says its most ambitious run yet has begun, no date given

Who is actually affected?

Open-source maintainers benefit first and most, whether they opt in or not. CodeMender already upstreams patches, and a model that clears V8-class code at this hit rate will raise the volume of automated reports landing in trackers for Chromium, curl, ffmpeg and the rest. That is good for security and rough for maintainers, who now triage machine-generated findings at machine speed with the same volunteer headcount.

RelatedWindows LegacyHive Zero-Day Gets a Fix, Just Not From Microsoft

Enterprise security teams get the shape of the tool without its edge. CodeMender on generally available Gemini models is a real product through the Gemini Enterprise Agent Platform, and it will catch ordinary bugs. It will not write your exploit, which for most compliance-driven programs is fine and for red teams is the whole reason they would have bought it.

The group nobody is discussing is everyone downstream of an unpatched binary. If the capability exists at Google, an equivalent exists or soon will outside it, and it will not come with an access gate. The half-life of an unpatched memory-corruption bug just got shorter for defenders and attackers at the same time.

Our take

This is the most honest release Google has shipped in a while, and the most uncomfortable. The company built something genuinely dangerous, measured it against a named competitor, published the loss column for its rivals, and then declined to sell it. That is a real position, not a press release. It also concedes something about the current safety consensus: models trained to refuse security work do not become safe, they become unable to defend anything, and Google clearly decided a capable gated model beats a crippled public one.

The part to be skeptical about is the numbers. Every figure here is Google's, run by Google, on targets Google chose, against a competitor Google picked. There is no independent harness for offensive security the way vals.ai exists for coding benchmarks. Until a third party runs Flash Cyber against Claude and GPT on the same corpus, 55 versus 36 is a marketing number with a methodology attached, and it should be read that way.

Original analysis by GenZTech. Reporting confirmed against The Hacker News and Google's own announcements.