Gemini 3.6 Flash, 3.5 Flash-Lite, and Flash Cyber: Full Benchmarks

Google announced three related Gemini models on July 21, 2026: Gemini 3.6 Flash, Gemini 3.5 Flash-Lite, and Gemini 3.5 Flash Cyber. The joint release frames them as a production family rather than three interchangeable tiers. Flash is the capable workhorse, Flash-Lite targets high-volume latency-sensitive jobs, and Flash Cyber is a restricted specialist deployed inside CodeMender.

The major efficiency claims are concrete. Gemini 3.6 Flash uses 17% fewer output tokens than 3.5 Flash on the Artificial Analysis Index and up to 65% fewer on Google's DeepSWE comparison, while cutting output price from $9 to $7.50 per million tokens. Flash-Lite reaches a reported 350 output tokens per second at $0.30 input and $2.50 output per million tokens.

One release date, three deployment contracts

Grouping the models in one article preserves Google's launch structure, but the access boundaries must remain explicit. Gemini 3.6 Flash and 3.5 Flash-Lite launched through the Gemini API, AI Studio, enterprise products, and consumer surfaces. Flash Cyber was announced for a limited pilot available only to governments and trusted partners through CodeMender.

All are hosted services, not open-weight releases. The Gemini 3.6 Flash model card specifies native multimodal input—text, images, audio, and video—a context window up to one million tokens, and up to 64K text output. The Flash-Lite card reports the same input and output limits.

This is why “best model” is the wrong procurement question. A general agent, a receipt-classification pipeline, and a vulnerability-remediation program have different throughput, quality, access, and risk requirements.

Gemini 3.6 Flash benchmark table

Google's model card reports these same-source comparisons:

The launch post cites slightly different DeepSWE values—49% versus 37%—consistently with the card, and also reports 17% fewer output tokens overall. Comparisons to GPT, Claude, and Grok in Google's table use named configurations but remain vendor-assembled; the matched 3.6-versus-3.5 rows are the cleanest upgrade evidence.

Coding, computer use, and knowledge work

DeepSWE rises from 37% to 49%, while SWE-bench Pro moves from 55.1% to 58.7%. These tests differ in agent scaffold and problem distribution, so the larger DeepSWE gain should not be projected directly onto every repository. Terminal-Bench's smaller 1.8-point increase suggests that some established shell tasks were already strong.

OSWorld-Verified improves to 83.0%, and Google makes computer use a built-in client-side tool through the Gemini API and enterprise platform. A built-in tool reduces integration friction but does not grant authority: screen actions still need domain allowlists, confirmation for material changes, and recovery from stale UI state.

GDPval-AA v2 rises by 72 Elo to 1421, supporting Google's knowledge-work positioning. Teams working with reports, charts, and documents should add citation accuracy, spreadsheet formula integrity, and factual traceability rather than relying on a general preference score. Our frontier model evaluation guide explains how to build workload-specific gates.

Long context and token efficiency

The most striking matched gain is GDM-MRCR v2 at one million tokens: 54.0% for 3.6 versus 26.6% for 3.5. The 128K average rises from 77.3% to 91.8%. These results support better retrieval across large contexts, but 54% at the maximum also shows that a one-million-token limit is not a guarantee of reliable recall.

Google reports 17% fewer output tokens on the Artificial Analysis Index and up to 65% fewer on DeepSWE. It attributes the reduction to fewer reasoning steps and tool calls. The “up to” value is workload-specific; capacity planning should use the distribution on internal tasks.

At $1.50 per million input tokens and $7.50 per million output tokens, 3.6 keeps the 3.5 input price and lowers output from $9. Cost per accepted workflow should include prompt caching, tool execution, retries, and reviewer correction. A cheaper token does not compensate for an unnecessary million-token prompt.

Flash-Lite is a separate operating point

Gemini 3.5 Flash-Lite is not simply 3.6 with lower quality. Google describes it as the fastest 3.5-class model and cites 350 output tokens per second from Artificial Analysis. The launch price is $0.30 per million input tokens and $2.50 per million output tokens.

Against 3.1 Flash-Lite, Google reports Terminal-Bench 2.1 at 54% versus 31%, GDM-MRCR v2 at 72.2% versus 60.1%, and GDPval-AA v2 at 1140 versus 642. It also shows the new Lite ahead of Gemini 3 Flash on SWE-bench Pro, 54.2% versus 49.6%, and OSWorld-Verified, 74.0% versus 65.1%.

The Gemini 3.5 Flash-Lite model card confirms one-million-token multimodal input and 64K text output. Use it for classification, translation, extraction, search, and subagent fan-out only after evaluating tail latency and error cost at production concurrency.

Flash Cyber is intentionally restricted

Gemini 3.5 Flash Cyber is based on 3.5 Flash and fine-tuned to discover, validate, and fix software vulnerabilities. Google deploys multiple Cyber agents inside CodeMender to produce a combined report and says the system is competitive at the frontier on CyberGym.

The dedicated Flash Cyber release emphasizes a limited-access pilot for governments and trusted partners. That restricted contract is part of the model story, not an availability footnote. Cyber capability is dual use, and a benchmark result does not justify general API exposure.

Security teams should distinguish discovery, exploitability validation, patching, and deployment permissions. Run candidates in isolated replicas, prohibit access to production secrets, require reproducible evidence, and route patches through ordinary code review. A multi-agent report can increase coverage while also multiplying false positives and tool permissions.

Safety card and known limits

Google says 3.6 adds stronger safeguards for CBRN and cyber-offense misuse while minimizing unjustified refusals. Its model card reports automated safety comparisons to 3.5, notes a slight tone regression, and says manual red teaming found no egregious concerns. Google also states that 3.6 remained below the cyber Critical Capability Level.

The card names hallucination, occasional slowness, and timeouts as known limitations. It gives a March 2026 knowledge cutoff, while warning that some domains may behave closer to January 2025. Retrieval and citations therefore remain necessary even for a model released in July.

Safety results are not portable across products. Flash Cyber has a different capability and access policy; Flash-Lite may be embedded at much higher volume; 3.6 may control a computer. Test each model in its actual tool and authority envelope.

A routing and acceptance plan

Build a shared, versioned evaluation set, then route by task class. Compare 3.6 and Lite on high-volume extraction, search, translation, document processing, short code changes, long agent traces, and computer use. Measure accepted quality, p50 and p95 latency, total tokens, tool calls, retries, human minutes, and safety interventions.

Use Lite when its lower price and throughput survive the quality threshold. Escalate to 3.6 for difficult multimodal or long-context work. Keep Cyber inside the authorized CodeMender program. This explicit router prevents a powerful default from absorbing every workload and makes model upgrades auditable.

The durable-agent workflow guide covers checkpoints, idempotency, and approval gates. Pin API model IDs and evaluation dates; repeat canaries when Google changes a preview or stable alias.

Verdict

Google's July 21 release is best understood as a portfolio. Gemini 3.6 Flash materially improves coding, computer use, knowledge work, long-context retrieval, and output-token efficiency over 3.5 Flash. Flash-Lite offers a 350-TPS operating point at much lower unit price. Flash Cyber packages a specialized capability behind a deliberately narrow access boundary.

The benchmark evidence supports pilots for all three roles, but not interchangeability. Reproduce the matched gains on local tasks, price accepted workflows, and preserve the cyber restrictions. The strongest deployment will route between models rather than choosing one family member for everything.

Source notes — reviewed 2026

• Google's joint Gemini family announcement provides the July 21 date, product boundaries, efficiency claims, and headline evaluations.
• The Gemini 3.6 Flash model card supplies model limits, benchmark tables, safety results, and known limitations.
• The Gemini 3.5 Flash-Lite model card documents multimodal limits, distribution, and intended high-volume use.
• Google DeepMind's Flash Cyber release documents the specialized model and restricted CodeMender pilot.