Google Launches Two Gemini Flash Models and Announces Flash Cyber Pilot

Google positions 3.6 Flash as its workhorse model for coding, knowledge work and multimodal tasks. The company says it consumes 17% fewer output tokens than 3.5 Flash on the Artificial Analysis Index and takes fewer reasoning steps and tool calls for multi-step work. Its API price is $1.50 per million input tokens and $7.50 per million output tokens.

Gemini 3.5 Flash-Lite targets high-throughput and low-latency workloads such as agentic search and document processing. Google lists pricing of $0.30 per million input tokens and $2.50 per million output tokens and cites a measured speed of 350 output tokens per second. Both models are available through the Gemini API and Google AI Studio, with availability varying across other Google products.

The performance numbers in Google's announcement are vendor-reported benchmark results, not independent guarantees for a production workload. Teams should measure task success, latency, token use, retries and tool-call behavior on their own prompts before migrating traffic.

Gemini 3.5 Flash Cyber is fine-tuned to find, validate and patch software vulnerabilities and is paired with Google's CodeMender agent. Google says multiple Flash Cyber agents can work together on a single report. Because vulnerability research is dual use, the company plans to offer the model only to governments and trusted partners through a limited-access pilot.

That means the release should not be described as a generally available autonomous patching system. Google's workflow keeps developers in the approval path for proposed fixes, and teams adopting similar tooling still need isolated execution, reproducible validation, change review and audit trails.

The lower token price is only one component of workload cost. A useful comparison should include total output tokens, failed attempts, tool calls, wall-clock latency and any human review required. For agent systems, a cheaper model can still cost more if it produces longer traces or needs more retries.

The practical result is a wider Flash portfolio: 3.6 Flash for higher-quality agentic work, Flash-Lite for throughput-sensitive tasks, and a restricted cyber model for controlled vulnerability workflows. Production teams should treat Google's benchmark claims as a starting hypothesis and validate each route separately.