Google Ships Gemini 3.6 Flash, 3.5 Flash-Lite, and a Vulnerability-Hunting Cyber Model — Still No 3.5 Pro
Google released three new Gemini models on July 21 targeting cost and coding, plus a restricted security variant built to find and patch vulnerabilities. The flagship 3.5 Pro missed its release window again.
Google released three new Gemini models on July 21: Gemini 3.6 Flash, 3.5 Flash-Lite, and 3.5 Flash Cyber. The flagship Gemini 3.5 Pro was not among them — again.
Gemini 3.6 Flash cuts output token usage by 17% compared to 3.5 Flash, according to the Artificial Analysis Index, while gaining roughly 12 points on coding and multimodal benchmarks. Pricing dropped too: $1.50 per million input tokens and $7.50 per million output tokens, down from $9 per million output on the previous Flash. It’s aimed squarely at coding, knowledge work, and multimodal tasks — the workhorse tier most production apps actually run on.
Gemini 3.5 Flash-Lite goes further on cost, at $0.30 per million input tokens, built for high-volume tasks where latency and price matter more than raw capability — think classification, extraction, and other jobs that don’t need frontier reasoning.
The interesting one is Gemini 3.5 Flash Cyber. Built on top of 3.5 Flash and fine-tuned specifically to find, validate, and patch software vulnerabilities, it’s not going into the public API. Google is limiting initial access to governments and trusted partners through a CodeMender pilot program — the same defensive-security initiative Google has been building out as AI-assisted vulnerability discovery becomes a live arms race on both the attacker and defender side.
All three are available now through the Gemini API, Google AI Studio, and Android Studio, with enterprise access via the Gemini Enterprise Agent Platform.
What’s conspicuous is what didn’t ship. Gemini 3.5 Pro has now missed its target window multiple times, and Google used this same announcement to confirm it’s still not ready — without giving a new date. For a company racing Claude Sonnet 5, GPT-5.6, and Grok 4.5 on flagship capability, shipping three mid-tier models while staying silent on the actual flagship reads less like a coordinated release and more like a stopgap. Flash-tier upgrades keep the API competitive on price and latency; they don’t answer the question of whether Google’s best model can still hang with the frontier.
For teams building on Gemini today, 3.6 Flash is the upgrade worth taking immediately — better benchmarks at a lower price is a rare combination. Flash Cyber is worth watching if you’re in the CodeMender pilot or adjacent to gov/enterprise security tooling. Everyone else is still waiting on Pro.