Introducing Gemini 3.6 Flash, 3.5 Flash-Lite, and 3.5 Flash Cyber  🔗 **Source:** [Introducing Gemini 3.6 Flash, 3.5 Flash-Lite, and 3.5 Flash Cyber](https://blog.google/innovation-and-ai/models-and-research/gemini-models/gemini-3-6-flash-3-5-flash-lite-3-5-flash-cyber/) > [!note]+ Document Notes > tags: [gemini-models, ai-agents, token-efficiency, ai-benchmarks, cybersecurity-ai] > author: Tulsee Doshi > source: Google Blog (blog.google) > reference: https://blog.google/innovation-and-ai/models-and-research/gemini-models/gemini-3-6-flash-3-5-flash-lite-3-5-flash-cyber/ > date created: {{date:YYYY-MM-DD}} {{time:HH:mm}} > > # 🏷️ Title: Introducing Gemini 3.6 Flash, 3.5 Flash-Lite, and 3.5 Flash Cyber > <!-- deep-read:sections start --> ## 🧭 Table of Contents - [📝 Summary](#-summary) - [📖 Main Content](#-main-content) - [🗒️ Notes](#️-notes) - [📚 References](#-references) - [🗣️ Paraphrase](#️-paraphrase) - [📰 Newsletter](#-newsletter) - [✅ Action Items](#-action-items) - [🧪 Hypotheses](#-hypotheses) - [📊 Methodology](#-methodology) - [❓ Questions](#-questions) - [🔮 Future Research](#-future-research) - [💡 Implications](#-implications) - [🧠 Learning Styles Assessment](#-learning-styles-assessment) - [📊 Accessibility Assessment](#-accessibility-assessment) - [🌍 DEIB Assessment](#-deib-assessment) - [✅ Logical Validity](#-logical-validity) - [🛡️ DARVO Analysis](#-darvo-analysis) - [🎯 Conclusion](#-conclusion) ### 🔗 References - [Introducing Gemini 3.6 Flash, 3.5 Flash-Lite, and 3.5 Flash Cyber](https://blog.google/innovation-and-ai/models-and-research/gemini-models/gemini-3-6-flash-3-5-flash-lite-3-5-flash-cyber/) — primary source ## 📝 Summary - Google shipped three new Gemini models in one announcement: **3.6 Flash** (the workhorse, better coding/knowledge-work/multimodal quality at lower token cost), **3.5 Flash-Lite** (fastest, cheapest 3.5-class model at 350 output tokens/sec), and **3.5 Flash Cyber** (a specialized model paired with the CodeMender agent, restricted to governments and trusted partners). - It matters because the pitch isn't "bigger model," it's cheaper-and-faster-per-agentic-task — Google is explicitly optimizing for the economics of running multi-step AI agents in production, not chatbot benchmarks. - Key stakeholders: the Gemini product team (Tulsee Doshi as author), developers building agents via the Gemini API/Android Studio/Antigravity, enterprise customers (Hebbia, Harvey named as early adopters), and — for Flash Cyber specifically — governments and "trusted partners" doing vulnerability defense. - Risks/tradeoffs: all comparative numbers come from Google's own benchmark selection plus one named third party (Artificial Analysis); Flash Cyber's dual-use framing (find bugs before attackers do) also means the same capability could accelerate offense if it leaks past the "limited-access pilot" gate; safety claims ("substantially more resistant to jailbreaks") aren't independently verified in the post. - Bottom line: an efficiency-focused mid-cycle refresh (3.6/3.5 tier) that quietly telegraphs two bigger things coming — Gemini 3.5 Pro in partner testing, and pretraining already underway for Gemini 4. ## 📖 Main Content The post is a product announcement, not a technical paper, so it's structured around three model releases plus a teaser. **3.6 Flash** is framed as a drop-in upgrade to 3.5 Flash: same tier, better coding/knowledge-work/multimodal results, but built specifically to *use fewer tokens* getting there — 17% fewer output tokens on the Artificial Analysis Index, up to 65% fewer on DeepSWE (a Datacurve coding benchmark), and fewer reasoning steps/tool calls per multi-step workflow. Pricing dropped too: $1.50/1M input, $7.50/1M output tokens. Named benchmark wins: DeepSWE (49% vs 37%), MLE Bench (63.9% vs 49.7%), OSWorld-Verified computer-use (83.0% vs 78.4%), GDPval-AA v2 knowledge-work (1421 vs 1349). Computer use is now a built-in client-side tool in the Gemini API and Gemini Enterprise. **3.5 Flash-Lite** targets high-throughput, latency-sensitive workloads (agentic search, document processing) rather than raw quality. At 350 output tokens/sec and $0.30/1M input, $2.50/1M output, it's the cheapest, fastest model in the lineup, with configurable "thinking levels" so developers trade latency for depth as needed. Notably, Google claims it beats the older, larger **3 Flash** on several agentic/coding evals (SWE-Bench Pro: 54.2% vs 49.6%; OSWorld-Verified: 74.0% vs 65.1%) — the standard "smaller-but-newer beats older-and-bigger" pattern in fast-moving model families. **3.5 Flash Cyber** is the most unusual release: a Flash-tier model fine-tuned specifically for finding and fixing security vulnerabilities, deployed only inside Google's CodeMender agent (multiple Flash Cyber instances collaborate to produce one combined vulnerability report), reaching "competitive performance at the frontier" on the CyberGym benchmark. Access is deliberately gated — governments and trusted partners only, via a "limited-access pilot program" — an explicit acknowledgment of dual-use risk (the same vulnerability-finding capability that helps defenders patch bugs first could help attackers find them first). The post closes by teasing **Gemini 3.5 Pro** (in partner testing, broad availability "soon") and confirms Google has started pretraining **Gemini 4**, its "most ambitious pre-training run yet." ### 🗒️ Notes - Positioning shift: this release is argued on *cost per agentic task*, not raw capability — a break from the usual "bigger benchmark number" framing. - 3.6 Flash's efficiency claim (17% fewer output tokens, up to 65% on DeepSWE) is presented as coming from fewer reasoning steps/tool calls, not just terser output — implies architecture/training changes to agent loop efficiency, not just verbosity tuning. - Computer-use-as-built-in-tool (both 3.6 Flash and 3.5 Flash-Lite) signals Google standardizing agentic screen-control as a first-class API capability rather than a separate product. - 3.5 Flash-Lite beating 3 Flash on agentic/coding evals is the clearest "small model, new generation > big model, old generation" data point in the post — relevant for anyone doing cost-based model routing. - Flash Cyber's restricted distribution (governments/trusted partners only, via CodeMender) is a concrete instance of a lab choosing deployment surface as the safety control, rather than relying solely on model-level refusals. - Customer proof points named: Hebbia and Harvey (document parsing/analysis), both enterprise/legal-adjacent knowledge-work tools — consistent with the GDPval-AA "knowledge work" benchmark being highlighted. - The safety paragraph for 3.6 Flash pairs two claims that are in tension by design: stronger CBRN/cyber-offense safeguards *and* fewer refusals for beneficial use — Google is explicitly trying to narrow refusals without loosening on the misuse axes it names. - No independent/third-party verification is cited for any of the safety or jailbreak-resistance claims — they come from Google's own model card, referenced but not quoted. ## 📚 References - Artificial Analysis Index — third-party benchmark cited for token efficiency and throughput comparisons (no URL provided in source) - DeepSWE (Datacurve) — coding benchmark - MLE Bench — ML research benchmark - OSWorld-Verified — computer-use benchmark - GDPval-AA v2 — knowledge-work benchmark - Terminal-Bench 2.1 — coding/agentic benchmark - GDM-MRCR v2 — long-context benchmark - SWE-Bench Pro — coding benchmark - CyberGym — cybersecurity benchmark used for 3.5 Flash Cyber - CodeMender — Google's code security agent that hosts 3.5 Flash Cyber - Hebbia, Harvey — customers cited as early users of 3.6 Flash ## 🗣️ Paraphrase Google is refreshing its Flash model line around one idea: agents cost money every time they call a tool or take a reasoning step, so the win isn't a smarter model, it's a model that gets the same job done in fewer steps and fewer tokens. 3.6 Flash does that for general coding and knowledge work at a lower price than its predecessor; 3.5 Flash-Lite does it for high-volume, latency-sensitive jobs at an even lower price, reportedly beating the previous full-size Flash tier on several agentic tasks. The odd one out is 3.5 Flash Cyber, a vulnerability-hunting model bundled into Google's CodeMender agent and handed only to governments and vetted partners — Google's own acknowledgment that a tool built to find security holes faster than defenders can patch them is exactly as useful to attackers as to defenders, so who gets it matters as much as what it can do. The post ends by name-dropping what's next: Gemini 3.5 Pro in partner testing, and pretraining already running for Gemini 4. ## 📰 Newsletter New Gemini models just landed, and the headline isn't "bigger" — it's "cheaper and faster to run as an agent." If you're building AI features into WordPress workflows (content generation, automated triage, agentic search over a site's content), **3.6 Flash** and **3.5 Flash-Lite** are worth a look purely on cost: Google reports 3.6 Flash using ~17% fewer output tokens than its predecessor at a lower per-token price, and 3.5 Flash-Lite running at 350 tokens/sec for $0.30/$2.50 per million tokens — numbers that matter a lot if you're calling a model per-request across a high-traffic site. Both are live today via the Gemini API, and 3.5 Flash-Lite is starting to roll into Google Search itself. If any part of your dev stack talks to the Gemini API, this is a good week to re-check your model choice against the new price/latency numbers. ## ✅ Action Items #### DevRel - Developer experience: update any internal docs/snippets that reference Gemini 3.5 Flash pricing or benchmarks to reflect 3.6 Flash / 3.5 Flash-Lite's new numbers before recommending a model tier to teams. - Developer advocacy: if evaluating Gemini for an agentic feature, run a small side-by-side (cost + latency) between 3.5 Flash and 3.6 Flash on a real workload rather than trusting the vendor benchmark alone. #### OSPO - No direct action items identified for this category from this source. #### Community - No direct action items identified for this category from this source. #### WordPress - **Core AI:** if exploring Gemini as a backend for any WP-adjacent AI feature, note the new computer-use built-in tool and lower Flash-Lite pricing as inputs to a cost/latency evaluation. #### The WPCC - No direct action items identified for this category from this source. ### FAIR - No direct action items identified for this category from this source. ## 🧪 Hypotheses - H1: 3.6 Flash's token-efficiency gains (17% fewer output tokens on Artificial Analysis, up to 65% on DeepSWE) hold up on workloads outside Google's selected benchmark set. - H2: 3.5 Flash-Lite's claimed wins over the older, larger 3 Flash on agentic benchmarks (SWE-Bench Pro, OSWorld-Verified) generalize to non-benchmark, real-world agent tasks. - H3: Restricting 3.5 Flash Cyber to governments/trusted partners via CodeMender measurably reduces misuse risk compared to open API access, without materially slowing defensive patching. - H4: The "fewer refusals for beneficial uses" training goal for 3.6 Flash does not come at the cost of increased false negatives on CBRN/cyber-offense prompts. - H5: Cost-per-agentic-task (not raw benchmark score) is becoming the dominant purchasing criterion for enterprise customers choosing between frontier-adjacent model tiers. ### 📊 Methodology - H1/H2: Independent benchmarking using held-out or newly authored agentic tasks (not Artificial Analysis' published set), comparing token count, latency, and cost across 3.5 Flash, 3.6 Flash, 3.5 Flash-Lite, and 3 Flash under identical prompts/tools. - H3: Red-team study comparing vulnerability discovery-to-patch time with and without Flash Cyber-class tooling, under both a "defender-only access" and simulated "leaked access" condition, measuring relative advantage. - H4: Adversarial prompt suite spanning both "should refuse" (CBRN/cyber-offense) and "should not refuse" (legitimate security research, chemistry education) prompts, scoring refusal-accuracy trade-off before/after the safety training change. - H5: Survey or interview study with enterprise AI buyers (e.g., Hebbia/Harvey-style customers) on how heavily unit economics (tokens/cost per completed task) weighs against raw model quality in tier selection. ### ❓ Questions - What specific architectural or training changes produced the drop in tool calls/reasoning steps for 3.6 Flash — is it distillation, RL on agent trajectories, or something else? - How is "trusted partner" defined and vetted for 3.5 Flash Cyber access, and is there an appeals/expansion path for smaller security teams? - Does Gemini 3.5 Pro (teased, "testing with partners") sit above or alongside 3.6 Flash on the cost/quality curve, and will it inherit the same efficiency training? - What does "our most ambitious pre-training run yet" for Gemini 4 imply about compute budget relative to prior Gemini generations? ### 🔮 Future Research - Independent, cross-lab comparison of "tokens per completed agentic task" as a standardized efficiency metric (most published benchmarks still measure accuracy, not cost-to-solve). - Longitudinal tracking of whether restricted-access security models (Flash Cyber and any competitor equivalents) actually shift the offense/defense balance in the wild. - Comparative study of refusal-rate safety training approaches across labs (Google's "fewer refusals, more targeted safeguards" vs. more blanket refusal strategies elsewhere). ### 💡 Implications - Practice: teams building AI agents should start budgeting and choosing models by cost-per-completed-task rather than per-token price alone, since fewer steps/tool calls changes the real-world cost more than sticker price. - Security: dual-use vulnerability-finding models are now explicit product lines (not just research demos), meaning access-control policy is becoming as important a "safety feature" as model-level refusals. - Education: benchmark literacy matters more as vendors cite an increasing number of named-but-opaque evals (DeepSWE, GDPval-AA, CyberGym) — consumers need a way to sanity-check these beyond trusting the announcement. - Funding/market: the Flash tier's rapid iteration cadence (3, 3.1, 3.5, 3.6 within roughly a year per the post's references) suggests competitive pressure is concentrated at the "cheap, fast, good-enough" tier, not just the frontier. ### 🧠 Learning Styles Assessment - Reading level estimate: roughly 12th–14th grade (Flesch-Kincaid-style estimate) — sentences are short to medium, but density of technical jargon (agentic workflows, token efficiency, named benchmark acronyms) pushes the effective reading level above the plain sentence structure alone would suggest. #### 👀 Visual learners - Present: several referenced screenshots/diagrams (OSWorld task comparison, financial-data parsing, code migration, texture extractor demo) though alt text/captions weren't preserved in the scraped content. - Improve: add labeled before/after diagrams comparing token/step counts between 3.5 Flash and 3.6 Flash on one concrete task, and a simple pricing comparison table across all three new models. #### 🔊 Aural learners - Present: the page includes a "Listen to article" AI-generated audio player. - Improve: a short human-narrated summary would aid retention beyond the AI-generated read-aloud, especially for the pricing/benchmark numbers that are easy to mishear. #### 🗣️ Verbal learners - Present: plain-language framing of what each model is "for" (workhorse, fastest/cheapest, cyber-specialized). - Improve: a short glossary for benchmark names (DeepSWE, GDPval-AA, CyberGym, etc.) since none are defined inline. #### 🧩 Kinesthetic learners - Present: links to the Developer Guide and model cards for hands-on API access. - Improve: a minimal reproducible code snippet showing the computer-use built-in tool call would let developers try the headline feature immediately. #### 🧠 Logical learners - Present: a benchmark table style comparison (X% vs Y%) repeated across sections. - Improve: a single consolidated table of all named benchmarks across all three models, rather than scattered inline pairs, would make cross-model comparison easier. #### 🧑‍🤝‍🧑 Social learners - Present: named customer quotes/logos (Hebbia, Harvey) as social proof. - Improve: a linked discussion forum or developer community thread for early feedback would extend the social-learning surface beyond the blog post itself. #### 🧘‍♀️ Solitary learners - Present: self-serve links to Developer Guide and model cards for independent exploration. - Improve: a self-check "which model tier fits my workload" decision flow would help solo readers self-select without external guidance. #### 🌿 Naturalistic learners - Present: none — the post doesn't touch environmental/compute-efficiency framing despite efficiency being the core pitch. - Improve: pairing "fewer tokens per task" with an energy/compute-efficiency angle would tie the announcement to sustainability, which the post currently leaves out entirely. ### 📊 Accessibility Assessment #### Screen reader semantics - Present: clear heading structure for each model section; breadcrumb navigation present. - Improve: several images (benchmark charts, demo screenshots) appear without descriptive alt text in the scraped content — should be verified and added on the live page. #### Keyboard navigation - Present: standard blog navigation (menus, links) typical of blog.google's platform. - Improve: cannot verify focus order or skip-links from scraped text alone; would need direct testing on the live page. #### Contrast and readability - Present: standard Google blog styling, generally high-contrast by default. - Improve: no way to verify actual rendered contrast from text content; recommend a live contrast check given the audio player and interactive language-preference widget on the page. #### Text resizing and reflow - Present: not assessable from scraped text. - Improve: verify the many benchmark comparison callouts reflow cleanly at 200% zoom rather than clipping numeric comparisons. #### Media and captions - Present: an audio "Listen to article" player with speed/voice controls. - Improve: no visible transcript link for the audio version itself (redundant with the article text, but a downloadable transcript would still help low-bandwidth or offline readers); demo videos/GIFs (code migration, theme studio) have no visible caption text in the scrape. #### Forms and interactions - Present: newsletter signup form with confirmation messaging ("Done. Just one step more."). - Improve: cannot verify inline validation/error messaging from scraped content. #### Standards reference - Gaps most likely to map to WCAG 2.2 AA: 1.1.1 Non-text Content (alt text on benchmark/demo images), 1.2.2/1.2.5 (captions/audio description for embedded demo media). ### 🌍 DEIB Assessment #### Cultural breadth - Present: the page offers region/language switching across ~25 locales, suggesting global distribution intent. - Improve: the actual announcement content (benchmarks, customer examples) is US-enterprise-centric (Hebbia, Harvey); no non-US customer examples are cited. #### Inclusive language - Present: technical language is used consistently and defined implicitly through context (e.g., "agentic workflows"). - Improve: acronym-heavy benchmark names (DeepSWE, GDPval-AA, MLE Bench) are never spelled out or defined, which disadvantages non-specialist and non-native-English readers. #### Neurodiversity support - Present: consistent section structure (one model per section, consistent sub-pattern of description → pricing → benchmarks). - Improve: benchmark data is presented as inline prose comparisons ("49% vs. 37%") rather than a consistent table format, which is harder to parse for some readers than a structured layout. #### Representation - Present: two named enterprise customers (Hebbia, Harvey); author is a named individual (Tulsee Doshi) with title disclosed. - Improve: no individual developer or smaller-team use cases are represented — all named examples are enterprise-scale. #### Psychological safety - Present: no contentious or sensitive framing; safety/misuse risks (Flash Cyber, CBRN) are acknowledged directly rather than minimized. - Improve: n/a — the post's tone doesn't raise psychological-safety concerns. ### ✅ Logical Validity #### Strong reasoning - The efficiency argument (fewer tool calls/reasoning steps → lower token count → lower cost) is a coherent causal chain, and it's tied to a specific mechanism (multi-step workflow efficiency) rather than asserted as a bare number. - The Flash Cyber access-restriction decision is a clear, explicitly-reasoned risk tradeoff: "AI models have become capable of finding vulnerabilities faster than current systems can fix them" → therefore restrict distribution to defenders. This is a transparent premise-to-conclusion argument, clearly stated in the "3.5 Flash Cyber" section. #### Fallacies - **Appeal to authority / unverified statistic:** nearly every benchmark claim ("83.0% vs. 78.4%," "up to 65%") is sourced to either Google's internal evaluation or a single named third party (Artificial Analysis) with no methodology link or independent replication offered — readers must take the comparison on faith. Fix: link directly to the underlying benchmark methodology or a reproducible eval harness. - **Cherry-picking risk (not fully a fallacy, but a bias worth flagging):** the post highlights only benchmarks where the new models win; it doesn't disclose whether any benchmarks showed regressions. Fix: publish a full benchmark table including any metrics where the new model underperforms its predecessor, for credibility. #### Tone of voice - Confident, enthusiast-adjacent product marketing tone ("workhorse model," "significant improvement," "step forward in both cost and quality") — typical of a company blog announcing its own product, not a neutral third-party review. The safety paragraph shifts briefly to a more measured, risk-acknowledging register when discussing CBRN/cyber-offense safeguards and Flash Cyber's restricted access. ### 🛡️ DARVO Analysis - This is a product-announcement blog post, not a response to an accusation, so classic DARVO dynamics (Deny, Attack, Reverse Victim/Offender) don't apply in the way they would to a crisis-communications piece. - The closest adjacent pattern is a mild **risk-acknowledgment-as-reassurance** move: Google names the dual-use risk of Flash Cyber directly ("AI models have become capable of finding security vulnerabilities faster than current systems can fix them") and then frames its own restricted-access policy as the solution, without independent validation that the restriction is sufficient. This is transparent risk disclosure rather than denial or blame-shifting, so it does not rise to a DARVO pattern — flagged here only because dual-use framing is exactly the kind of claim worth watching for self-serving reassurance in future company statements on this same product line. ## 🎯 Conclusion Google's real news here is economic, not architectural: 3.6 Flash and 3.5 Flash-Lite are pitched on doing agentic work in fewer tokens and fewer steps at a lower price, which matters more for production AI-agent budgets than another point of benchmark accuracy. The genuinely novel piece is 3.5 Flash Cyber — a vulnerability-hunting model Google is deliberately keeping out of open API access because the same capability cuts both ways for defense and offense. Practical next step for readers: before adopting 3.6 Flash or 3.5 Flash-Lite for an agentic workload, run your own cost/latency comparison against your current model rather than relying solely on the vendor-selected benchmark numbers in this post. ## 🔄 Refactor Appendix — Introducing Gemini 3.6 Flash, 3.5 Flash-Lite, and 3.5 Flash Cyber ### 📚 Literature Atoms (H3) #### 3.6 Flash cuts tokens, not just cost > [!quote] > "we see 3.6 Flash consuming 17% fewer output tokens than 3.5 Flash. It also takes fewer reasoning steps and tool calls to accomplish multi-step workflows." **Context & use**: - "3.6 Flash: More efficient and better quality than 3.5 Flash" section - Reusable framing: efficiency gains from fewer agent steps compound with per-token price cuts — relevant whenever evaluating a model swap for an agentic pipeline **Tags**: #xref <!-- atomicity: 1 idea ✓ --> #### Flash-Lite beats the prior full-size Flash tier > [!quote] > "on many agentic and coding evals, 3.5 Flash-Lite even outperforms 3 Flash, including on SWE-Bench Pro (54.2% vs. 49.6%) and OSWorld-Verified (74.0% vs. 65.1%)" **Context & use**: - "3.5 Flash-Lite: Built to scale agentic workflows" section - Evidence for the recurring pattern that a new generation's cheap tier can outrun the prior generation's expensive tier — useful heuristic for model-tier selection decisions **Tags**: #xref <!-- atomicity: 1 idea ✓ --> #### Flash Cyber is gated by access, not just refusal > [!quote] > "The model will be exclusively available to governments and trusted partners via CodeMender soon as part of a limited-access pilot program." **Context & use**: - "3.5 Flash Cyber in CodeMender" section - Concrete case of a lab using distribution/access control as the primary safety mechanism for a dual-use capability, rather than relying on model-level refusal alone **Tags**: #xref #articleseed <!-- atomicity: 1 idea ✓ --> ### 🧠 Permanent Candidates (H4) #### Access control is a safety lever independent of model refusal behavior **Claim** (one sentence, Courtney's voice): When a model's capability is dual-use at the deployment level (not just the prompt level), restricting *who gets the model* is a distinct safety control from tuning *what the model will say*, and labs are starting to treat the two as separable levers. **Evidence pointer**: [[Introducing Gemini 3.6 Flash, 3.5 Flash-Lite, and 3.5 Flash Cyber#Flash Cyber is gated by access, not just refusal]] **Scope & conditions**: - Holds when: the capability's risk comes from *what it can do* (e.g., find exploitable vulnerabilities) rather than *what it will say* — refusal tuning can't fully mitigate a capability that's dangerous simply by existing in the wrong hands. - Breaks when: the "trusted partner" gate is porous, informally defined, or expands without re-evaluating risk — access control is only as strong as the vetting behind it. **Links** (≥1 with annotation): - [[credit-routing-model]] — because applies-in: the same "who/what gets access to a capability" logic underlies model-routing policy decisions (e.g., which tasks are safe to delegate to a cheaper/less-supervised executor). - [[dual-use AI capability]] — because extends: this is one concrete instance of a broader dual-use-deployment pattern worth tracking across labs. <!-- atomicity: 1 idea ✓ --> ### ✏️ Fleeting Queue - [F1] Compare Flash Cyber's access-gating approach to how other labs (OpenAI, Anthropic) handle dual-use security-research models — is restricted distribution becoming an industry norm? #articleseed - [F2] Check whether Gemini 3.5 Pro (teased as "testing with partners") ships with the same token-efficiency training as 3.6 Flash, once it's released. #xref ### → Things 3 - [ ] Benchmark 3.6 Flash vs. current model choice on one real agentic task for cost/latency before recommending a switch — content-pipeline work #things <!-- deep-read:sections end --> ## Highlights - we see 3.6 Flash consuming 17% fewer output tokens than 3.5 Flash. It also takes fewer reasoning steps and tool calls to accomplish multi-step workflows. - Note: 📚 3.6 Flash cuts tokens, not just cost · - "3.6 Flash: More efficient and better quality than 3.5 Flash" section - Reusable framing: efficiency gains from fewer agent steps compound with per-token price cuts — relevant whenever evaluating a model swap for an agentic pipeline · #atom/literature/h1 - on many agentic and coding evals, 3.5 Flash-Lite even outperforms 3 Flash, including on SWE-Bench Pro (54.2% vs. 49.6%) and OSWorld-Verified (74.0% vs. 65.1%) - Note: 📚 Flash-Lite beats the prior full-size Flash tier · - "3.5 Flash-Lite: Built to scale agentic workflows" section - Evidence for the recurring pattern that a new generation's cheap tier can outrun the prior generation's expensive tier — useful heuristic for model-tier selection decisions · #atom/literature/h2 - The model will be exclusively available to governments and trusted partners via CodeMender soon as part of a limited-access pilot program. - Note: 📚 Flash Cyber is gated by access, not just refusal · - "3.5 Flash Cyber in CodeMender" section - Concrete case of a lab using distribution/access control as the primary safety mechanism for a dual-use capability, rather than relying on model-level refusal alone · #atom/literature/h3 - Access control is a safety lever independent of model refusal behavior - Note: Holds when: the capability's risk comes from *what it can do* (e.g., find exploitable vulnerabilities) rather than *what it will say* — refusal tuning can't fully mitigate a capability that's dangerous simply by existing in the wrong hands. · - [[credit-routing-model]] — because applies-in: the same "who/what gets access to a capability" logic underlies model-routing policy decisions (e.g., which tasks are safe to delegate to a cheaper/less-supervised executor). · #atom/zettel/z1 - Compare Flash Cyber's access-gating approach to how other labs (OpenAI, Anthropic) handle dual-use security-research models — is restricted distribution becoming an industry norm? #articleseed - Note: ✏️ Fleeting capture #atom/fleeting/f1 - Check whether Gemini 3.5 Pro (teased as "testing with partners") ships with the same token-efficiency training as 3.6 Flash, once it's released. #xref - Note: ✏️ Fleeting capture #atom/fleeting/f2 - ** nearly every benchmark claim ("83.0% vs. 78.4%," "up to 65%") is sourced to either Google's internal evaluation or a single named third party (Artificial Analysis) with no methodology link or independent replication offered — readers must take the comparison on faith. Fix: link directly to the underlying benchmark methodology or a reproducible eval harness. - Note: 🔍 Fallacy: Appeal to Authority #fallacy/appeal-to-authority