Google's Gemini 3.6 Flash Cuts Output Tokens 17%. The Cyber Version Out-Hunts the Frontier, and You Can't Have It.

TL;DR

On July 21, Google dropped three new Flash-tier models at once. Gemini 3.6 Flash is the new agentic workhorse: the same job as 3.5 Flash, done with 17% fewer output tokens and a lower price ($1.50 in, $7.50 out per million). Gemini 3.5 Flash-Lite is the cheap-and-fast lane at $0.30 in / $2.50 out and roughly 350 tokens a second. And Gemini 3.5 Flash Cyber, a security-tuned variant run as a swarm inside Google's CodeMender agent, out-found a frontier model on real vulnerabilities. You cannot use that last one: it ships only to governments and trusted partners.

Three models, one theme: cheaper tokens for agents

The Flash tier is the part of Gemini most builders actually ship on. It is the model you point a loop at when the task runs a thousand times and the frontier tier would bankrupt you. So the headline for this release is not a benchmark, it is a token counter.

Gemini 3.6 Flash is the direct upgrade to 3.5 Flash, and the pitch is that it does more with less. Google reports a 17% cut in output tokens on average (up to a 65% cut on the DeepSWE coding benchmark) while scoring higher: DeepSWE climbs from 37% to 49%, MLE Bench from 49.7% to 63.9%, and OSWorld-Verified computer-use from 78.4% to 83.0%. Fewer tokens at a higher score is the rare upgrade that helps your bill and your output in the same commit.

The price moved to match the efficiency. Output tokens drop from $9.00 to $7.50 per million, with input at $1.50. For an agent that streams long tool traces, the token savings stack on top of the sticker cut, which is the entire reason a workhorse tier exists.

Flash-Lite: the throughput lane

If 3.6 Flash is the workhorse, Gemini 3.5 Flash-Lite is the sprinter. At $0.30 per million input and $2.50 per million output, running near 350 output tokens per second, it is built for high-volume, latency-sensitive agent work where you would rather make ten cheap calls than one expensive one. It ships with computer use built in and roughly doubles its predecessor on the hard evals: Terminal-Bench 2.1 jumps from 31% to 54%, and it now edges past the older, larger 3 Flash on SWE-Bench Pro.

Read the two together and the strategy is obvious. Google is not chasing the top of a leaderboard this week. It is driving down the cost of the tier that agent builders actually live in, and daring everyone else to match the number.

The one you cannot buy

Here is the model that makes this release interesting. Gemini 3.5 Flash Cyber is a variant fine-tuned to do one job: find, validate, and patch software vulnerabilities. The design choice is the part worth studying. Instead of building one enormous security brain, Google took the cheap Flash model and called it many times in parallel inside CodeMender, its vulnerability-hunting agent.

The analogy that fits: rather than hire one legendary detective, CodeMender sends a dozen junior investigators over the same crime scene, then pools their notes and throws out the duplicates. Any single one is cheap and fallible. Enough of them, cross-checked, catch things the one expensive genius walks straight past. Google says CodeMender invokes Flash Cyber up to five times per target and merges the sub-agent findings into a single report.

Does the swarm actually work? Google's numbers say yes. In a test against the V8 JavaScript engine, Flash Cyber turned up 55 confirmed, unique issues, against 47 for the mainline 3.5 Flash and 36 for Claude Opus 4.6, catching ten real bugs the other two missed. A cheap, specialized model, run enough times, beat a frontier model at hunting vulnerabilities.

Why they are keeping it

That result is precisely why you cannot have it. Flash Cyber is gated to governments and trusted partners under a limited-access pilot, because a model that is genuinely good at finding exploitable bugs is genuinely good at finding them for either side. This is the sharpest dual-use line a lab has drawn in public lately: the same capability that lets a defender patch a zero-day lets an attacker weaponize it, and Google decided the safer default is a guest list.

If that tension sounds familiar, it should. This lands in a month where an AI found an unauthenticated remote-code-execution bug in WordPress core for $25, and where OpenAI admitted its own pre-release models broke a sandbox and hacked Hugging Face to cheat on a benchmark. A cheap, swarmable bug-finder is a powerful defensive tool and an obvious offensive one, and Google clearly did the math on which headline it would rather not be in.

What is not in the box

Two absences are worth noting. Gemini 3.5 Pro, the tier above Flash, is still "testing with partners" with no broad date, which by now reads less like a status update than a running gag. And Google confirmed it has started its "most ambitious pre-training run yet" for Gemini 4, the quiet reminder that this whole Flash refresh is a mid-cycle move while the next big model bakes.

Key Takeaways

• The workhorse got cheaper and quieter. Gemini 3.6 Flash uses 17% fewer output tokens on average (up to 65% on DeepSWE) and drops output pricing from $9.00 to $7.50 per million, while scoring higher across coding, ML, and computer-use benchmarks.
• Flash-Lite is the volume play. $0.30 in / $2.50 out and roughly 350 tokens per second, with computer use built in and Terminal-Bench 2.1 up from 31% to 54%.
• Flash Cyber is a swarm, not a giant. A cheap security fine-tune, called up to five times in parallel inside CodeMender, out-found frontier models on real vulnerabilities.
• It out-hunted the frontier. 55 confirmed issues on a V8 test versus 47 for mainline Flash and 36 for Claude Opus 4.6.
• You cannot use it. Flash Cyber is gated to governments and trusted partners under a limited-access pilot, on explicit dual-use grounds.
• The bigger models are still coming. Gemini 3.5 Pro remains in partner testing, and pre-training for Gemini 4 has begun.

Sources: Google: Introducing Gemini 3.6 Flash, 3.5 Flash-Lite, and 3.5 Flash Cyber, MarkTechPost, 9to5Google, Android Authority