Google Gemini 3.6 Flash, 3.5 Flash-Lite and Flash Cyber launch

Rather than shipping a single across-the-board update, Google split its mid-tier release into three purpose-built models on July 21, 2026 ^[1]- Gemini 3.6 Flash for general agentic and coding work, Gemini 3.5 Flash-Lite for high-throughput low-latency tasks, and Gemini 3.5 Flash Cyber for vulnerability research. The framing is explicitly economic: Google says 3.6 Flash uses about 17% fewer output tokens than 3.5 Flash while cutting output pricing from $9 to $7.50 per million tokens ^[1], a design aimed squarely at enterprises running continuous agent loops rather than one-off chat queries. Coverage of the launch frames this as a deliberate trade-off for customers paying per-token at scale - cutting the cost of long agentic workflows matters more to Google's enterprise base than topping a single leaderboard ^[2]. Flash-Lite, priced even lower at $0.30/$2.50 per million tokens and running at roughly 350 output tokens per second, targets the opposite end of the same problem - document processing and agentic search where throughput, not depth, is the bottleneck.

The most consequential data point in the launch isn't a new capability - it's the absence of one. Artificial Analysis's Intelligence Index score for Gemini 3.6 Flash landed at 50, identical to Gemini 3.5 Flash ^[3], even as Google marketed the release as a meaningful step forward ^[4]. Flash-Lite did post a real intelligence jump, from 25 to 36 on the same index. Where 3.6 Flash clearly did improve is coding and agentic execution: DeepSWE rose from 37% to 49%, MLE-Bench from 49.7% to 63.9%, and OSWorld-Verified from 78.4% to 83.0% ^[5]. Average time-per-task also roughly halved, from 2.7 minutes to 1.3 minutes for 3.6 Flash and from 1.0 to 0.6 minutes for Flash-Lite ^[3]. In other words, this is a speed-and-cost release with targeted coding gains layered on top of a flat general-intelligence score - a distinction that fueled the community pushback and Meta's public jab at the launch.

The Flash trio arrived without the flagship model developers have been waiting on since Google I/O. Gemini 3.5 Pro's delay traces to Bloomberg's July 16 report that the model was struggling to meet internal performance goals ^[6], prompting DeepMind to scrap an earlier base-model iteration entirely due to performance ceilings in multi-step mathematical reasoning and SVG scene generation, and retrain from a new base ^[7]. Logan Kilpatrick said the team is 'currently testing Gemini 3.5 Pro with partners' and hopes to 'land soon,' while separately confirming DeepMind has commenced 'its most ambitious pre-training run yet for Gemini 4' ^[8]. Running a scrapped-and-restarted flagship in parallel with an already-underway next-generation pretraining effort is an unusual sequencing choice, and it is the detail rival commentary on X has seized on as evidence Google is over-extended on its frontier roadmap even as its mid-tier ships on schedule.

Gemini 3.5 Flash Cyber is the launch's most technically striking - and most tightly gated - model. Fine-tuned specifically to find, validate, and patch software vulnerabilities through Google's CodeMender pipeline, it scored 83.2% on the CyberGym benchmark, close to OpenAI's reported GPT-5.5-Cyber score of 85.6% ^[9]. In internal testing it surfaced 55 unique confirmed V8 JavaScript engine issues, including 10 missed by both Gemini 3.5 Flash and Claude Opus 4.6, and helped Google's Cloud Vulnerability Research team find a remote-code-execution flaw and a memory-corruption bug in a production service within two hours ^[9]. That same capability cuts both ways: the model reportedly produced a 100%-reliable RCE exploit bypassing ASLR and W^X protections during testing ^[9], which is precisely why Google restricted it to a limited pilot for governments and trusted partners rather than a general release ^[10].