Google launched Gemini 3.6 Flash and Gemini 3.5 Flash-Lite on July 21, 2026, pitching both as faster, more efficient engines for AI agents. The practical headline for developers is a smaller bill and shorter task time, not an across-the-board leap in intelligence.
A third model, Gemini 3.5 Flash Cyber, aims at finding and repairing software vulnerabilities. It will not be generally available: Google says governments and trusted partners will receive it through a limited CodeMender pilot because the same capabilities that help defenders can also be misused.
The releases arrive only two months after Gemini 3.5 Flash and while Google is still testing Gemini 3.5 Pro with partners. Google also said it has begun what it calls its most ambitious pre-training run yet for Gemini 4.
What changed in Gemini 3.6 Flash
Gemini 3.6 Flash is built on Gemini 3.5 Flash rather than a new foundation model. It accepts text, images, audio and video, returns text, and retains a context window of up to 1 million tokens with a 64,000-token output limit. Google made the model generally available in the Gemini API, Google AI Studio, Android Studio, Gemini Enterprise products, the Gemini app and Antigravity.
The price is $1.50 per million input tokens and $7.50 per million output tokens. The input rate is unchanged from 3.5 Flash, but the output rate is down from $9. Google says 3.6 also uses fewer reasoning steps, conversational turns and tool calls, reducing the execution loops that can make autonomous coding tasks slow and expensive.
Google reported better results on coding, computer-use and knowledge-work benchmarks. DeepSWE rose to 49% from 37%, OSWorld-Verified to 83.0% from 78.4%, and MLE-Bench to 63.9% from 49.7%. Those are useful signals, but they are benchmark results selected by the model maker, not guarantees for every production workload.
Faster work does not necessarily mean a smarter model
Independent testing adds an important caveat. Artificial Analysis scored Gemini 3.6 Flash at 50 on its Intelligence Index, the same result as Gemini 3.5 Flash. It did, however, record an average task time of 1.3 minutes, down from 2.7 minutes, and an average cost per task of about 50 cents, down from 59 cents.
That distinction matters for companies choosing an AI model. If a workflow already gets acceptable answers from 3.5 Flash, the new version may finish it with fewer tokens and less waiting. If the problem is raw reasoning quality, the independent aggregate result does not show a broad upgrade. Teams should rerun their own coding, document and tool-use evaluations before switching.
Flash-Lite is built for volume
Gemini 3.5 Flash-Lite is the smallest and fastest model in Google’s 3.5 family. Google lists it at $0.30 per million input tokens and $2.50 per million output tokens, with a default minimal thinking level. The model supports the same 1-million-token context window and built-in tools, including computer use.
Google and Artificial Analysis both reported roughly 350 output tokens per second in pre-release testing. Artificial Analysis also found that Flash-Lite finished its test tasks in about 0.6 minutes, nearly half the time of 3.1 Flash-Lite, while its Intelligence Index rose to 36 from 25.
But the cost comparison is not one-way. The independent test put average cost per task at 9 cents, up from 4 cents for 3.1 Flash-Lite, because the new model’s token prices are higher even though it produces fewer output tokens. For search, translation, classification and document processing at scale, the relevant question is therefore total cost per completed job, not the sticker price of a single token.
Why Google is restricting Flash Cyber
Gemini 3.5 Flash Cyber is fine-tuned to find, validate and patch vulnerabilities. Within CodeMender, multiple agents can explore different code paths and combine their findings into one report, a design meant to trade one expensive model call for many faster, specialized passes.
Google says the model found 55 unique confirmed issues in tests against the V8 JavaScript engine, compared with 47 for mainline Gemini 3.5 Flash and 36 for Claude Opus 4.6. Ten of those issues were not found by the other two models. Google also says the cyber model is already being used on internal codebases including Chrome, Android, Cloud, Ads and YouTube.
Those capabilities explain the staged release. A model that can reliably search large codebases for flaws can help defenders close security gaps, but it can also lower the cost of offensive discovery. The initial access limit is therefore part of the product, not a temporary footnote.
What users and developers should watch next
Gemini 3.6 Flash and 3.5 Flash-Lite are available now through Google’s consumer, developer and enterprise channels. Flash-Lite is also rolling out in Google Search. People using the Gemini app may notice the model options without needing to change any code; API customers will need to select the new model IDs and test the behavior of their existing prompts and tools.
The bigger unresolved question is Gemini 3.5 Pro. Google says it will release the model broadly when it is ready but gave no firm date. Meanwhile, the start of Gemini 4 training suggests that these Flash releases are optimization steps inside the current generation: meaningful for speed and cost, but not the final word on Google’s next foundation model.
Bottom line: Gemini 3.6 Flash is a more efficient workhorse, Flash-Lite is a high-throughput specialist with a cost tradeoff, and Flash Cyber is a potent defensive tool whose access limits are central to its safety case.
Sources: Google’s launch announcement, Gemini API documentation, Google DeepMind’s Flash Cyber report, and Artificial Analysis benchmark testing.
