What is Gemini 3.5 Flash Cyber and why is access restricted?

Gemini 3.5 Flash Cyber is a purpose-built AI model from Google DeepMind, fine-tuned to find, validate, and exploit software vulnerabilities autonomously. Google released it on July 21 in a limited-access pilot through CodeMender, available only to governments and trusted partners. Access is restricted because of the model's dual-use nature: in testing it found RCE vulnerabilities in public APIs within two hours and generated a working exploit that bypassed ASLR and W^X protections. Google's position is that a model this capable should not be in unrestricted hands.

What does the Claude Security plugin for Claude Code actually do?

Anthropic launched the Claude Security plugin in public beta on July 23. It adds a /claude-security command to Claude Code with three modes: scan the full codebase, scan a branch or pull request diff, or generate patch files from a security report. The scan uses a six-phase multi-agent workflow — inventory, threat modelling, per-component research, gap sweeping, adversarial panel review, and red-team pass — to trace data flows across files and business logic in ways static analysers cannot. Findings come with style-matched patch suggestions.

Does releasing Claude Security to everyone create the same risks Google is worried about?

The tools solve the same problem from different ends of the spectrum. Claude Security is built to find vulnerabilities in code you own, producing reports and patches for your own developers — a defensive workflow. Gemini 3.5 Flash Cyber, by contrast, is explicitly trained to generate working exploits and validate vulnerabilities by attacking them. Google's restricted release reflects a view that exploit generation capability is categorically more dangerous than vulnerability detection. Anthropic's public beta reflects a view that the detection side should be a commodity available to every developer, not just well-funded organisations.

Google Gates Its Security AI. Anthropic Opens It. One Week, Two Bets.

Two AI labs shipped security-focused tools within 48 hours of each other this week. They made opposite decisions about who should get to use them.

On July 21, Google DeepMind announced Gemini 3.5 Flash Cyber, a model purpose-built to discover, validate, and patch software vulnerabilities — restricted by default to governments and trusted partners in a limited-access pilot. On July 23, Anthropic launched the Claude Security plugin for Claude Code in public beta, available to any Claude Code user, with the source published to the claude-plugins-official repository.

One lab gated its security AI behind an approval process. The other shipped it as a free plugin.

What Gemini 3.5 Flash Cyber Actually Does

Gemini 3.5 Flash Cyber is a fine-tuned variant of the existing Flash 3.5 architecture, optimised specifically for security tasks. Google’s own benchmarks show it can autonomously move from identifying an attack surface to generating a working exploit, including bypassing ASLR and W^X memory protections — standard mitigations that most vulnerability scanners take as given.

In testing before launch, the model found remote-code-execution vulnerabilities in public APIs and a memory-corruption bug in a production service within two hours. That timeline — two hours to a working RCE — is faster than most penetration testing engagements and well within the window where an attacker could act before a defender patches.

The model is being deployed through CodeMender, Google DeepMind’s AI coding agent, which will serve as the interface for government and enterprise customers. Pricing, selection criteria for the trusted partner programme, and a general access timeline have not been published.

Google framed the access restriction as a consequence of the model’s offensive capabilities. In its announcement, the company acknowledged the dual-use tension directly: a model capable of finding and validating zero-days at speed is useful to defenders who can patch, and dangerous in the hands of someone who won’t.

What the Claude Security Plugin Actually Does

Anthropic’s Claude Security plugin takes a narrower cut. It is built as a developer tool for finding vulnerabilities in your own codebase, not for generating working exploits against external targets.

The plugin adds a single command — /claude-security — to the Claude Code terminal interface. Three modes: scan the entire repository, scan a diff or pull request, or produce patch files from an existing security report.

The scan runs as a six-phase multi-agent workflow. An inventory phase maps the codebase into components. A threat-modelling phase builds an attack surface picture per component — entry points, sinks, trust boundaries. Research agents work in parallel across components. A sweep pass fills gaps in coverage. A three-lens panel independently verifies findings to cut false positives. A final adversarial pass stress-tests the results.

The output is a report with findings categorised by severity, each paired with a suggested patch matched to the project’s coding style. Anthropic says the system can trace data flows across files and understand business logic — the class of vulnerabilities that escapes pattern-matching static analysis tools because the bug isn’t visible in a single file.

The plugin is free. The source is public at version 0.10.0.

The Bet Each Lab Is Making

The divergence is philosophically significant. Both labs are deploying AI to the same problem — software has too many vulnerabilities, and finding them manually at scale doesn’t work. The question is what kind of tool you build, who gets it, and what you’re responsible for if it gets misused.

Google’s position: exploit generation capability is categorically dangerous. You can build a version of this for defenders, but the version that generates working exploits for arbitrary targets should be subject to vetting. The platform company model — trusted customers with accountability — is the gatekeeping mechanism.

Anthropic’s position: vulnerability detection in your own code is a commodity that should be cheap and widely available. Making security scanning accessible to the developer who maintains a small open source library matters more than restricting it. They’re not shipping an exploit framework; they’re shipping a scanner.

Both positions have internal logic. The Gemini 3.5 Flash Cyber restriction makes sense given that the model demonstrated autonomous RCE exploit generation in testing — that’s a capability profile significantly above “tells you what’s wrong with your code.” The Claude Security plugin’s open release makes sense for a tool that produces reports and patches for code you own.

The uncomfortable question neither announcement resolves: as capability increases, the line between “finds the vulnerability” and “exploits the vulnerability” gets thinner. The model that tells you a function is vulnerable to SQL injection is a small step from the model that tells you what payload to send. Google’s gated release reflects an explicit view that Gemini 3.5 Flash Cyber has crossed that line. Whether Claude Security stays on the right side of it is something Anthropic will discover as the public beta accumulates real-world usage.

Google Gates Its Security AI. Anthropic Opens It. One Week, Two Bets.

What Gemini 3.5 Flash Cyber Actually Does

What the Claude Security Plugin Actually Does

The Bet Each Lab Is Making

References

Frequently Asked Questions