# Introducing Gemini 3.6 Flash, 3.5 Flash-Lite, and 3.5 Flash Cyber **Source**: [[3. Resources/Readwise/Articles/Introducing Gemini 3.6 Flash, 3.5 Flash-Lite, and 3.5 Flash Cyber]] > [!question] Lingering Questions > - What specific architectural or training change produced the drop in tool calls/reasoning steps for 3.6 Flash — distillation, RL on agent trajectories, or something else? The post doesn't say. > - How is "trusted partner" defined and vetted for 3.5 Flash Cyber access, and is there an appeals/expansion path for smaller security teams? > - Nearly every benchmark claim in the post is sourced to Google's own evaluation or one named third party (Artificial Analysis), with no methodology link or independent replication offered. > [!tip] Article Ideas > - "Access control as a safety lever separate from refusal tuning" — Flash Cyber's gated distribution (governments/trusted partners only) is a clean, citable case study for any piece on dual-use AI capability governance. > [!link] Cross Reference > - [[3. Resources/MOCs/AI Cost & Tokenomics MOC]] — the entire announcement is argued on cost-per-agentic-task, not raw benchmark score > - [[3. Resources/MOCs/AI Agent Safety MOC]] — Flash Cyber's access-gating as a safety-control case study > - [[3. Resources/Permanent Notes/Practical Obscurity Is an Economic Property Not a Technical One]] — both claims are about what happens to a risk when the cost of exploiting a capability changes > [!quote] Vocabulary > - **CodeMender** — Google's code-security agent; hosts 3.5 Flash Cyber, with multiple instances collaborating to produce one combined vulnerability report > - **Dual-use capability** — a capability equally useful to defenders and attackers (here: automated vulnerability discovery), where distribution/access control becomes a distinct safety lever from refusal tuning ## Bib capsule Google announced three Gemini model releases in one post: 3.6 Flash (a token-efficient upgrade to 3.5 Flash), 3.5 Flash-Lite (the fastest/cheapest 3.5-tier model), and 3.5 Flash Cyber (a vulnerability-hunting model restricted to governments and trusted partners via the CodeMender agent) — plus a teaser for Gemini 3.5 Pro and confirmation that Gemini 4 pretraining has begun. ## Author's thesis The pitch isn't "bigger model," it's cheaper-and-faster-per-agentic-task: Google is explicitly optimizing for the economics of running multi-step AI agents in production, and treating a dual-use security capability's distribution as a safety control distinct from model-level refusal. ## Key arguments (≤3) 1. **3.6 Flash's efficiency gain comes from fewer steps, not just terser output** — 17% fewer output tokens on Artificial Analysis, up to 65% fewer on DeepSWE, attributed to fewer reasoning steps and tool calls per multi-step workflow. 2. **A new-generation cheap tier can beat the prior generation's expensive tier** — 3.5 Flash-Lite reportedly outperforms the older, larger 3 Flash on agentic/coding evals (SWE-Bench Pro, OSWorld-Verified). 3. **Flash Cyber treats deployment surface as the safety control** — restricted to governments/trusted partners via a "limited-access pilot," an explicit acknowledgment that the same vulnerability-finding capability helps attackers exactly as much as defenders. ## Claim atoms ### 3.6 Flash cuts tokens, not just cost > [!quote] > "we see 3.6 Flash consuming 17% fewer output tokens than 3.5 Flash. It also takes fewer reasoning steps and tool calls to accomplish multi-step workflows." Reusable framing: efficiency gains from fewer agent steps compound with per-token price cuts — relevant whenever evaluating a model swap for an agentic pipeline. ### Flash-Lite beats the prior full-size Flash tier > [!quote] > "on many agentic and coding evals, 3.5 Flash-Lite even outperforms 3 Flash, including on SWE-Bench Pro (54.2% vs. 49.6%) and OSWorld-Verified (74.0% vs. 65.1%)" Evidence for the recurring pattern that a new generation's cheap tier can outrun the prior generation's expensive tier — useful heuristic for model-tier routing decisions. ### Flash Cyber is gated by access, not just refusal > [!quote] > "The model will be exclusively available to governments and trusted partners via CodeMender soon as part of a limited-access pilot program." A concrete case of a lab using distribution/access control as the primary safety mechanism for a dual-use capability, rather than relying on model-level refusal alone. ## Permanent candidates - **Access control is a safety lever independent of model refusal behavior** — the strongest, most reusable candidate; promoted below. ## Processing checklist - [ ] Compare Flash Cyber's access-gating approach to how other labs (OpenAI, Anthropic) handle dual-use security-research models - [ ] Check whether Gemini 3.5 Pro ships with the same token-efficiency training as 3.6 Flash once released - [x] Connect into the relevant MOCs — [[3. Resources/MOCs/AI Cost & Tokenomics MOC]], [[3. Resources/MOCs/AI Agent Safety MOC]] ## Links - [[3. Resources/MOCs/AI Cost & Tokenomics MOC]] — cost-per-agentic-task as the announcement's actual selling point - [[3. Resources/MOCs/AI Agent Safety MOC]] — Flash Cyber's access-gating as a dual-use-capability safety mechanism