Google has released three new models in its Flash tier: Gemini 3.6 Flash, Gemini 3.5 Flash-Lite, and Gemini 3.5 Flash Cyber. These updates target speed, cost, and token efficiency rather than maximum reasoning depth. They are designed for production agents and high-volume workloads.
Gemini 3.6 Flash: fewer tokens and lower output costs
This new model serves as the default workhorse for coding, knowledge tasks, and multimodal applications. It builds on the 3.5 Flash foundation with a primary focus on efficiency. On the Artificial Analysis Index, 3.6 Flash uses 17% fewer output tokens than 3.5 Flash. On the DeepSWE benchmark, Google reports a reduction of up to 65%. The model also requires fewer reasoning steps and tool calls during multi-step workflows.
Prices have moved down to match these efficiency gains. The cost is now $1.50 per 1M input tokens and $7.50 per 1M output tokens. The output rate drops from the previous $9.00 per 1M on 3.5 Flash. Lower verbosity combined with the reduced output price cuts the total cost per agentic task.
Quality improvements accompany the efficiency gains. On DeepSWE, 3.6 Flash scores 49% versus 37% for 3.5 Flash. On MLE Bench, it reaches 63.9% versus 49.7%. On OSWorld-Verified, it hits 83.0% versus 78.4%. On GDPval-AA v2, a knowledge-work benchmark, it scores 1421 versus 1349. Computer use is now a built-in client-side tool via the Gemini API and Gemini Enterprise. Early customers including Hebbia and Harvey report gains in document parsing, chart analysis, and report drafting.
Google is shipping 3.6 Flash with enhanced Frontier Safety safeguards. These cover Chemical, Biological, Radiological, and Nuclear (CBRN) and cyber-offense misuse. Full details are in the 3.6 Flash model card.
Gemini 3.5 Flash-Lite: the fastest model in the 3.5 line
Gemini 3.5 Flash-Lite targets low-latency and high-throughput jobs. Use cases include agentic search and document processing. As measured by Artificial Analysis, it runs at 350 output tokens per second. Pricing is $0.30 per 1M input tokens and $2.50 per 1M output tokens.
The model clears the prior 3.1 Flash-Lite by wide margins. On Terminal-Bench 2.1, it scores 54% versus 31%. On GDM-MRCR v2, a long-context benchmark, it reaches 72.2% versus 60.1%. On GDPval-AA v2, it scores 1140 versus 642. Notably, Flash-Lite also beats the older 3 Flash on some evals. It leads on SWE-Bench Pro at 54.2% versus 49.6% and on OSWorld-Verified at 74.0% versus 65.1%.
Flash-Lite exposes configurable thinking levels: minimal, low, and higher. Developers can prioritise low-cost, low-latency execution for high-volume tasks. They can also engage higher thinking levels for multi-step subagent workloads. Computer use is a built-in tool here too.
Gemini 3.5 Flash Cyber in CodeMender: cheap agents that find and patch bugs
Gemini 3.5 Flash Cyber is the most specialised release. It is built on 3.5 Flash and fine-tuned to find, validate, and patch software vulnerabilities. The design premise is the search-space problem. Finding deep flaws means exploring an immense execution search space. A single call to one massive model becomes a bottleneck.
The answer is a cheap model called many times. Inside CodeMender, Google’s code-security agent, multiple 3.5 Flash Cyber agents run in parallel. CodeMender invokes the model up to five times, then merges the sub-agent findings into one report. On the CyberGym benchmark, this setup reaches competitive performance against much larger models.
The internal evaluations are striking. On Google’s Big Sleep evaluation, Flash Cyber significantly surpassed mainline 3.5 Flash and 3.6 Flash. On the V8 JavaScript engine, it found 55 unique confirmed issues at a fixed number of invocations. That compares to 47 for mainline 3.5 Flash and 36 for Claude Opus 4.6. It caught 10 issues the other two models missed. In one real-world test, Google’s Cloud Vulnerability Research team used it to find remote-code-execution flaws in public APIs within two hours.
Community reaction
Reaction split along predictable lines. Builders welcomed the price and efficiency. The delayed flagship drew the loudest criticism. On Hacker News, some argued Google is over-selling capacity it cannot reliably provision, citing frustrating hands-on coding sessions. The gated Flash Cyber release opened a dual-use debate about who should hold automated exploit-finding tools.
Availability
Gemini 3.6 Flash and 3.5 Flash-Lite are available starting today. Developers can access them through the Gemini API via Google AI Studio and Android Studio. Gemini 3.6 Flash is also in Google Antigravity and rolling out in GitHub Copilot. Enterprises get both models in the Gemini Enterprise Agent Platform, with 3.6 Flash in the Gemini Enterprise app. Everyone can use them via the Gemini app, and 3.5 Flash-Lite is rolling out in Google Search. Start with the Developer Guide.
What it means
For people building software, the shift is practical. The new pricing structure means running agents is cheaper per task, not just faster. CodeMender shows that you can run multiple cheap models in parallel to find security flaws more effectively than relying on a single expensive model. The result is lower bills and better performance for automated workflows.
