Three new Gemini Flashes: which one goes in your agent loop

What it is

Three Gemini variants shipped together on July 21, 2026. Google DeepMind released three new Gemini models on July 21, 2026: Gemini 3.6 Flash, 3.5 Flash-Lite, and a security-focused 3.5 Flash Cyber for finding software vulnerabilities. The pitch is a three-tier ladder — general workhorse, cheap-and-fast, and a restricted security specialist — while Google's flagship 3.5 Pro remains delayed.

The next-work-session test

You're sizing a coding agent that runs a plan → tool-call → verify loop maybe 40 times per task. Today you're on 3.5 Flash. The question is: do you swap the whole loop to 3.6 Flash, or split — 3.5 Flash-Lite for the cheap classification steps (routing, "did the test pass?", short summaries) and 3.6 Flash only for the reasoning turns?

That's the actual decision this drop forces. If Google's efficiency claim holds on your traffic, 3.6 Flash is a drop-in that costs less per completed task. If your loop is dominated by short tool-routing calls, Flash-Lite is where the real budget wins.

Pricing

Verified across multiple outlets, though prices are vendor-set — treat them as list-price API rates, not what you'll actually pay after caching and batch discounts.

• Gemini 3.6 Flash: $1.50 per one million input tokens and $7.50 per one million output tokens through its API.
• Gemini 3.5 Flash-Lite: $0.30/$2.50 per million.
• Gemini 3.5 Flash Cyber: not sold on the API. The model will be exclusively available to governments and trusted partners via CodeMender soon as part of a limited-access pilot program. Pricing: unverified — Google hasn't published one because most orgs can't buy it.

On the token-efficiency claim: Google launches Gemini 3.6 Flash and a cybersecurity model with 17% fewer output tokens, and vendor claims go further — Google's Gemini 3.6 Flash model cuts AI agent token costs by up to 65% on long horizon engineering tasks. That 65% is a Google number on a Google-picked workload. Assume it will be smaller on yours.

What we'd actually use it for

Two narrow, honest use cases:

Flash Cyber isn't a tool most readers will touch. Note it exists, move on.

Limits

• The efficiency claim is Google's, on Google's evals. Vendor benchmarks describe a possible ceiling, not your median. Rerun your own evals before you commit a production budget.
• 3.5 Pro is not here. If your loop needs the strongest reasoning tier, this drop doesn't help you. Google DeepMind released three new Gemini models on July 21 — Gemini 3.6 Flash, 3.5 Flash-Lite, and 3.5 Flash Cyber — while its flagship 3.5 Pro remains delayed.
• Flash Cyber is effectively unavailable. Google DeepMind announced Gemini 3.5 Flash Cyber on July 21, 2026, with initial access reserved for governments and trusted partners through CodeMender. If you're a normal security team, this is a press release, not a product you can buy this quarter.
• Knowledge cutoff. Gemini 3.6 Flash is priced at $1.50 per million input tokens and $7.50 per million output tokens, and carries a knowledge cutoff of March 2026 across all context lengths. Retrieval still matters.
• Migration cost is not zero. New model, new prompt quirks. Budget an afternoon for eval regressions — small formatting changes will show up.

Try it if

• You already run a Gemini-based agent loop and have an eval harness ready to A/B a model swap.
• Your bill is dominated by output tokens and you'd feel a 15–30% reduction.
• You have obvious "cheap step" candidates in the loop (routing, classification, short extraction) that could move to Flash-Lite.
• You're a defensive security team that could plausibly qualify for the CodeMender pilot — worth a conversation, not a plan.

Skip it if

• You don't have evals. Swapping models without measurement is how quality regressions ship silently.
• Your workload needs the top reasoning tier — wait for 3.5 Pro.
• You're already on a non-Google stack and the migration cost dwarfs the token savings.
• You were hoping Flash Cyber would slot into your SOC this month. It won't.

For the full announcement and the model card links, see DeepMind's launch post and, for the restricted-access context on Flash Cyber, TechRepublic's rundown of the CodeMender pilot.