Three Flash-tier Geminis land: what a developer actually picks

What it is

Three new Flash-tier Gemini models from Google DeepMind, released July 21, 2026. Gemini 3.6 Flash uses fewer tokens than 3.5 Flash to deliver higher quality work at the exact same input cost, Gemini 3.5 Flash-Lite is a fast, cost-effective option for everyday tasks like processing documents and agentic search, and Gemini 3.5 Flash Cyber is a cybersecurity model built to find and patch critical software vulnerabilities. The Cyber variant is not a general-purpose model — it is part of a limited-access pilot program that will soon be available to governments and trusted partners via CodeMender.

The next-work-session test

You're wiring a coding agent that reads a repo, plans a migration, and opens PRs. Today it runs on 3.5 Flash and you're bleeding output tokens on long tool-call chains. Swap the model ID to gemini-3.6-flash, rerun your eval set, and check two numbers: tokens per completed trajectory and pass rate on your held-out tasks. Google's pitch is that Gemini 3.6 Flash cuts output tokens by 17% (up to 65% on DeepSWE) and drops the output price from $9.00 to $7.50 per 1M — treat both as vendor claims until your own eval confirms them on your workload. For lower-stakes agent steps (retrieval, classification, doc parsing), route to 3.5 Flash-Lite in the same run and log the delta.

Pricing

Verified via Google's own pages and multiple third-party trackers:

• Gemini 3.6 Flash: $1.50 per one million input tokens and $7.50 per one million output tokens through its application programming interface (API).
• Gemini 3.5 Flash-Lite: $0.30/$2.50 per million, in/out.
• Gemini 3.5 Flash Cyber: Gemini 3.5 Flash Cyber is a limited-access pilot. Google has made it available to governments and trusted partners only. If you do get access via CodeMender, the Gemini 3.5 Flash Cyber in CodeMender costs the same as the Gemini 3.6 Flash AI model, $1.50 per million input token and $7.50 per million output. For most developers reading this: effectively unavailable.

Cached input reportedly drops significantly — worth checking against your own request pattern before assuming the sticker price.

What we'd actually use it for

Two honest use cases, both narrower than the "agents at scale" pitch:

Flash Cyber isn't a tool you can use. It's a signal that Google is productizing vulnerability-finding models — during testing on the V8 JavaScript engine, it found 55 unique issues, per Google — which matters for your threat model even if you never call the API.

Limits

• No Gemini 3.5 Pro yet. Google reiterates that "Gemini 3.5 Pro is currently testing with partners," with broad availability "as soon as it's ready." If your agent needs a stronger reasoner at the top of the loop, this release doesn't help.
• Token savings are workload-dependent. The 17% average and 65% peak come from Google's own evals. On your task mix the delta could be smaller — or negative if 3.6 Flash's different verbosity profile breaks parsers tuned to 3.5 Flash output.
• Flash Cyber is gated. No public API. You can't add a Cyber model ID to your app. Don't plan around it.
• Migration cost is real. Even a "drop-in" swap means re-running evals, re-tuning prompts that leaned on 3.5 Flash quirks, and re-checking tool-call formats.

See the model card at deepmind.google/models/gemini/flash and the launch post at the DeepMind blog.

Try it if

• You're running a coding or browser agent on 3.5 Flash today and output tokens dominate your bill.
• You need a genuinely cheap model for LLM-as-judge evals or batch classification (3.5 Flash-Lite).
• You have an eval harness already — swap the model ID, rerun, compare. Low risk.
• Your stack is on Vertex AI or AI Studio and you want to stay in one vendor's SDK.

Skip it if

• You're waiting for a Pro-tier reasoner. This release is not that.
• You've already tuned prompts and parsers hard against Claude, GPT, or another provider — the switching cost likely exceeds the token savings.
• You were hoping to use Flash Cyber for your own security scanning. It's not available to you.
• Your agent's bottleneck is latency on the first token, not total output volume — the wins here are efficiency, not raw speed at the top of the loop.