Google shipped three Gemini models at once, and none of them is the 3.5 Pro everyone was waiting for
- On July 21, Google shipped three Gemini models at once, all on the Flash line: the workhorse 3.6 Flash, the fastest and cheapest member of the 3.5 family, 3.5 Flash-Lite, and a bug-hunting specialist, 3.5 Flash Cyber.
- The long-awaited 3.5 Pro never showed up. The flagship Pro line is still stuck at 3.1 Pro Preview, and the launch page offers a single line about "testing with partners" — while also announcing that pre-training for Gemini 4 has begun.
- The pitch for 3.6 Flash is that it talks less. On the same batch of software engineering tasks, output dropped from 276K tokens to 97K, the success rate climbed from 37% to 49%, and the output price fell from $9.00 to $7.50.
- 3.5 Flash-Lite pushes 350 output tokens per second, the fastest in the 3.5 family — but its output price is up 66.7% from the previous generation, and the launch page only calls it "compelling value."
- 3.5 Flash Cyber isn't for sale. It scores 83.2% on CyberGym, fourth among the five systems in Google's own chart.
Three models in one drop, and the one everybody wanted isn't among them
On July 21, 2026, Google released three Gemini models at once. All three belong to Flash, the cheap-and-fast product line. Not a single flagship.
The newest thing on the Pro line is still 3.1 Pro Preview
Check the official Gemini API pricing page and the latest Pro model listed is gemini-3.1-pro-preview — still a preview. Both of today's releases, 3.6 Flash and 3.5 Flash-Lite, are generally available.
The launch page closes with a note on what's next:
We have started our most ambitious pre-training run yet, for Gemini 4, and progress is exciting. Google Blog, 2026-07-21
Eight Demo Lab clips showing the two available models at work
Alongside the main text, the launch page carries a set of Demo Lab videos showing what the two shipping models do inside real tools.
Four clips for 3.6 Flash
Four clips for 3.5 Flash-Lite
3.6 Flash sells itself on brevity: two-thirds fewer words on the same work
On the same batch of long-horizon software engineering tasks, the previous 3.5 Flash averaged 276,000 tokens before it was done. 3.6 Flash spends 97,000. Nearly two-thirds less talk — and the share of tasks it actually gets right rises from 37% to 49%.
Both numbers come from Google's published charts, drawn from the same benchmark: DeepSWE v1.1. It measures the kind of software work a model has to grind through on its own — read a real codebase, locate the problem, change the code, run the tests, then keep going based on what comes back.
Google quotes the reduction two different ways: 17% by the Artificial Analysis index, and "up to 65%" on "certain evals, such as Datacurve's DeepSWE." Its explanation of the mechanism is two lines long — fewer reasoning steps and tool calls to finish a multi-step task, plus higher precision, which means fewer redundant code edits and fewer execution loops.
Output costs five times what input does, so writing less is saving money
What you send the model counts as input; what the model sends back counts as output, and the two are billed separately. Here's the spread for 3.6 Flash on the Gemini API pricing page:
what you send it
what it sends back (5× the input price)
The pricing page marks the output column "including thinking tokens" — the model's own reasoning is billed as output too. And an agentic workflow is precisely the case where the model works through the steps itself: read a file, call a tool, look at the result, decide the next move. Stack up enough steps and that accumulated output is your bill.
Price: output down 16.7%, plus two tiers the launch page skipped
The launch page says "lower cost per output token" and lists 3.6 Flash at $1.50 in, $7.50 out. Cross-checking the Gemini API pricing page: 3.5 Flash also charges $1.50 for input, but $9.00 for output — so the output side is down 16.7%.
Two other tiers go unmentioned. Work you aren't waiting on can go through batch processing at half price, and repeated long contexts that hit the cache are billed at $0.15 per million tokens, a tenth of the input rate.
As we evaluated models for Figma Make, we wanted balance across quality, speed, and cost. Gemini 3.6 Flash hits that sweet spot, letting us explore and iterate on prototypes far faster while holding onto design quality. Matt Colyer, Director of Product at Figma (quoted on Google Blog)
Google also name-checks two customers, Hebbia and Harvey, saying the model is especially strong on multimodal knowledge work such as document parsing, chart and data analysis, and report drafting.
3.6 Flash beats last generation's flagship, 3.1 Pro, on all four benchmarks
In Google's four-panel bar chart, the pale bar on the far left is Gemini 3.1 Pro — the same preview model that remains the newest thing on the Pro line. The body of the launch page never discusses that column.
| Benchmark | What it tests | 3.1 Pro | 3.5 Flash | 3.6 Flash |
|---|---|---|---|---|
| DeepSWE v1.1 | Long-horizon software engineering: read a real codebase, edit code, run tests | 12% | 37% | 49% |
| MLE-Bench | Machine learning research (Google labels it ML Research) | 42.6% | 49.7% | 63.9% |
| GDPVal-AA v2 | Everyday tasks from real occupations, scored as Elo rather than percentage | 965 | 1349 | 1421 |
| OSWorld-Verified | Computer use: clicking through a real system, opening apps, finishing tasks | 76.2% | 78.4% | 83.0% |
That GDPVal-AA v2 row is Elo, not a percentage. Artificial Analysis describes the metric as "agentic real-world work tasks, (Elo−500)/2000."
Artificial Analysis rates 3.6 Flash (high thinking) at 50 on its Intelligence Index, a composite of nine evaluations.
3.5 Flash-Lite is the fastest model in the 3.5 family — and pricier than the one it replaces
The second release, Gemini 3.5 Flash-Lite, is positioned for low latency and high throughput, with agentic search and document processing called out as target workloads. Citing Artificial Analysis, Google says it produces 350 output tokens per second, the fastest in the 3.5 family.
Google adds one result that isn't in the chart: long-context retrieval on GDM-MRCR v2 improves from 60.1% to 72.2%, testing whether a model can pull the right passages out of extremely long material.
What the launch page leaves out: it costs more than its predecessor
On price, the launch page says it is "priced at $0.30 / $2.50, with quality significantly better than 3.1 Flash-Lite and compelling value." Missing from that sentence: what 3.1 Flash-Lite cost. From the official pricing page:
| 3.1 Flash-Lite | 3.5 Flash-Lite | Change | |
|---|---|---|---|
| Input (text / image / video) | $0.25 | $0.30 | +20% |
| Output | $1.50 | $2.50 | +66.7% |
| Input (audio) | $0.50 | $0.30 | −40% |
| Terminal-bench 2.1 | 31.0% | 54.0% | +23 pts |
| GDPVal-AA v2 (Elo) | 642 | 1140 | +498 |
Text output is up by two-thirds; audio input, going the other way, is down by 40%. The launch page sticks to "compelling value" throughout and never mentions the change in absolute price.
Its other selling point is adjustable thinking levels within a single model. Set it to minimal or low for high-frequency work when latency and cost matter; dial it up for sub-agent loads that need multi-step decomposition. At every thinking level, Google says, it beats 3.1 Flash-Lite by a wide margin. Computer use is now a built-in tool as well.
…the speed and cost efficiency Ashler needs for agentic retrieval and tool-calling. It excels at analyzing fragmented infrastructure records while holding context across hundreds of deliverables, supporting our users as they build the next generation of power grids, transit networks, and data centers. Connor Goggins, Co-founder and CTO of Ashler (quoted on Google Blog)
3.5 Flash-Lite is also rolling out into Google Search.
3.5 Flash Cyber hunts vulnerabilities — and isn't for sale
The third release, Gemini 3.5 Flash Cyber, is fine-tuned from 3.5 Flash for one job: find security flaws in software, confirm they're actually exploitable, then write the patch. It costs less per token than larger security models, and it isn't sold publicly.
DeepMind's companion blog gives the backdrop: AI now finds vulnerabilities faster than existing systems can patch them, so defenders need something capable, cheap, and deployable at scale. Google says Flash Cyber's per-token price undercuts larger security models.
The idea: swap one expensive call for many cheap ones
Finding deep vulnerabilities means searching an enormous space of execution paths — the same function branches thousands of ways depending on inputs and call order. Expecting one giant model call to reason through all of them, DeepMind writes, is the bottleneck.
Google's answer is to call a small model many times. Inside CodeMender, its code security agent, multiple Flash Cyber agents each sweep a batch of code paths, and the results are synthesized into one report.
thousands of execution paths
each analyzing a batch of paths
high-quality report
DeepMind adds that as the number of calls goes up, Flash Cyber keeps turning up new code paths and new vulnerabilities. Because it's cheap, the whole setup can live inside high-frequency scanning, pre-release checks, and per-commit pipelines.
The full CyberGym ranking
CyberGym tests AI agents against hundreds of real software vulnerabilities. The launch page describes the result as reaching "frontier-level" performance; DeepMind's phrasing is "competitive performance against significantly larger models." Ranked by the numbers on the chart:
| Rank | System | CyberGym |
|---|---|---|
| 1st | GPT-5.5-Cyber in OpenAI Agent | 85.6% |
| 2nd | Mythos 5 in Anthropic Agent | 83.8% |
| 3rd | GPT-5.6 Sol in OpenAI Agent | 83.6% |
| 4th | Gemini 3.5 Flash Cyber in CodeMender (max 5 model calls) | 83.2% |
| 5th | Mythos Preview in Anthropic Agent | 83.1% |
Fourth place sits 0.1 points above fifth and 2.4 points below first. Google's own bar carries a qualifier: a maximum of five model calls. DeepMind explains that the score comes from configuring CodeMender to make at most five calls per final report, and a footnote states that competitor scores are taken from each vendor's self-reported numbers.
The V8 run: 55 vs 47 vs 36
V8 is Chrome's JavaScript engine, which DeepMind calls extremely complex. Given a fixed number of calls, here's how many unique, confirmed issues each model surfaced:
Google explains why "unique" matters: weaker security models tend to get stuck in a loop, reporting the same issue over and over while missing the ones that count. Stronger models cast a wider net, which is what produces more distinct findings.
The other two runs are scored pass@1. On an independent evaluation built by Google's Big Sleep team — which deliberately targets the hardest critical vulnerabilities in complex codebases like Chrome and Safari — Flash Cyber clearly outperforms both mainline 3.5 Flash and 3.6 Flash. On Chrome's production commit-scanning pipeline it improves substantially over 3.5 Flash; none of the vulnerabilities in that set have ever been publicly disclosed, which Google says keeps the benchmark free of data contamination for Gemini and competitors alike. Early feedback from security engineering testers at Wiz and Cloud CISO also confirmed the gain over mainline 3.5 Flash.
In the field: a working exploit chain in two hours
Google Cloud's vulnerability research team pointed Flash Cyber at their own systems. Within two hours, it found remote code execution flaws across several public APIs, plus a memory corruption bug in a sensitive production service.
It then produced a 100% reliable remote code execution exploit that bypassed standard defenses like ASLR and W^X — the first randomizes where a program sits in memory on each run, the second forbids any memory region from being both writable and executable.
Running inside CodeMender, Flash Cyber is already finding and fixing bugs across Google's internal Chrome, Android, Cloud, Ads, and YouTube codebases. Google claims an advantage in training data that others don't have: OSV.dev, an open source vulnerability database with more than 700,000 records, plus over a decade of accumulated OSS-Fuzz fuzzing results. That, Google says, means the model isn't stuck on synthetic exercises — it learns to drive industry-standard tools, read through million-line projects like Chromium, and work through security tasks that demand hours of sustained analysis.
Given the dual-use nature of the technology, DeepMind writes, Google made a deliberate choice about how to ship it: no public sale. It will go to governments and trusted partners through CodeMender as a limited pilot, expanding gradually from there. The launch page uses the future tense; nothing is open yet. Separately, Google is opening CodeMender's underlying capabilities to ordinary customers through the Gemini Enterprise Agent Platform, using generally available Gemini models.
Where you can use these two today
3.6 Flash and 3.5 Flash-Lite are both available from day one:
- Developers: the Gemini API, reachable through Google AI Studio and Android Studio; 3.6 Flash is also in Google Antigravity.
- Enterprises: the Gemini Enterprise Agent Platform, with 3.6 Flash selectable in the Gemini Enterprise app as well.
- Everyone else: pick it in the Gemini app; 3.5 Flash-Lite is rolling out into Google Search.
Computer use — letting the model drive a machine's interface directly — is now a built-in client-side tool through the Gemini API and Gemini Enterprise, supported by both new models.
On safety, 3.6 Flash tightens defenses in two areas: chemical, biological, radiological, and nuclear risks (CBRN), and cyberattack misuse. Google says this makes the model considerably harder to jailbreak while also training it to refuse legitimate requests less often. Both models have public model cards with the details.
Google shipped three Gemini models at once, all on the Flash line: the workhorse writes two-thirds fewer words and does better work
Three Flash models landed on July 21, and the long-awaited flagship 3.5 Pro wasn't among them. This page does the math, with charts.
↓ One page · one animated chart
Gemini is Google's family of AI models, split into three tiers by price: Pro is the strongest and priciest, Flash handles everyday work, and Flash-Lite is the fastest and cheapest. The July 21 drop brought three models at once, all in the two cheap tiers.
- Gemini 3.6 Flash — the workhorse tier's new generation, available the same day.
- Gemini 3.5 Flash-Lite — the fastest model in the 3.5 family, available the same day.
- Gemini 3.5 Flash Cyber — a vulnerability hunter, not for sale, restricted to governments and trusted partners.
- (Missing) Gemini 3.5 Pro — the flagship tier. The launch page offers one line about "testing with partners" and nothing else: no date, no benchmarks, no price. The newest Pro model available remains 3.1 Pro Preview. The same page announces that pre-training has begun on the next generation, Gemini 4.
Start with what the previous workhorse got wrong.
✘ Each run averaged 276,000 tokens (the words the model produces, billed per token), and only 37% of runs actually got it right.
What you send counts as input, what the model sends back counts as output, and they're billed separately — output at 5× the input rate, with the model's own thinking billed as output too. The more circles it runs and the longer it talks, the bigger the bill, whether or not the job gets done.
3.6 Flash sells itself on brevity. On the same batch of long-horizon software engineering tasks (the benchmark is called DeepSWE v1.1), it cuts average output to a little over a third of the previous generation — and the price per output token drops too. Both together, here's what one task costs on the output side:
Price $9.00 / million tokens
───────────────
One task ≈ $2.48
Price $7.50 / million tokens
───────────────
One task ≈ $0.73
Nearly two-thirds less talk, and the success rate climbs from 37% to 49%. Which raises the obvious question: cut that many words, and how does the work get better?
It comes down to how many rounds a job takes. On this kind of task the model has to work through the steps itself: read the files, think it over, make the edit, run the tests, look at the results, decide what's next. Every round it writes out its reasoning again — that's how the word count piles up.
The dot on the left crawls a long way; the one on the right runs short and fast. That's what "two-thirds fewer words" looks like inside a single task — fewer circles, and shorter talk in each one.
"Output down 65%" doesn't land until you put it on a bill. Take 1,000 tasks like this one, counting only what the model writes:
for one job
actually worked
3.5 Flash-Lite fastest
3.5 Flash Cyber governments only
- × No 3.5 Pro
- × No date
- × No benchmarks
- × No price
it writes now
the other way
Artificial Analysis, on its own task set, measured a 17% drop.
And the cheapest tier, Flash-Lite, raised its output price from $1.50 to $2.50.