Google Holds Back Gemini 3.5 Flash Cyber as CodeMender Enters Preview

## Executive summary Google announced Gemini 3.5 Flash Cyber (used through CodeMender) — a specialized model for automated vulnerability discovery, exploit checks, and patch generation — with access limited to governments and trusted partners; early tests found numerous confirmed issues in internal codebases but Google has not published false-positive rates, patch acceptance, regression data, or broad production evidence, raising concerns about dual-use risk and the need for strict controls (isolated testing, human review, regression testing, and limited repository access).