Google launches Gemini 3.6 Flash, Flash-Lite & Flash Cyber — but holds back 3.5 Pro
On 21 July Google shipped Gemini 3.6 Flash and 3.5 Flash-Lite for everyone — cheaper, faster, better at code — plus a security-only model, Flash Cyber, locked to governments and "trusted partners." Still no sign of the 3.5 Pro flagship, and Gemini 4 is who-knows-when.
Right, Google's finally shown up. Three new Gemini models on 21 July — and there's a catch straight off the bat. Two of them, Gemini 3.6 Flash and 3.5 Flash-Lite, are out for everyone: the API, AI Studio, the app, the lot. The third, 3.5 Flash Cyber, you probably can't even touch — it's going to governments and "trusted partners" only. And the big one everyone's been waiting on, 3.5 Pro? Still not here. Here's what actually shipped.
What shipped
What's actually new
Most of this is just cheaper and faster — the models burn fewer tokens and get through agent jobs in fewer steps. The one genuinely new trick is computer use: in 3.6 Flash it's now baked straight into the API, so the model drives a browser or a screen itself, no separate automation stack bolted on the side. In 3.5 that was an afterthought; now it ships in the box. And for the devs — Google quietly killed the old sampling knobs, temperature, top_p and top_k, across the whole 3.x line.
Cyber's a different animal. It's not a new party trick, it's a specialist — same Flash model, fine-tuned for one job: hunt down security holes, prove they're real, patch them, and do it cheap and fast inside Google's CodeMender agent that calls it over and over across your code. Google's own numbers: on the V8 JavaScript engine it flagged 55 real vulnerabilities against 47 for normal 3.5 Flash and 36 for Claude Opus 4.6 — including 10 that both of those walked straight past.
What's not in it
Three things people were watching for that just aren't here. 3.5 Pro — the proper flagship, the one meant to be the big deal — is still locked in partner testing, out "when it's ready," whatever that means. Gemini 4 has started training but there's no date, so don't hold your breath. And real-time didn't move at all — live voice and video still run on the old Gemini 3.1 Flash Live model, so if you were hoping this fixed the real-time stuff, it didn't.
Good news, bad news — and the one I wanted is a no-show.
Look, I fucking love Google. But they've gone quiet since December while everyone else moved streets ahead, so any new models are good news — even if the real story here isn't the models, it's the price war. Cheaper Gemini drags everyone cheaper, and that's the bit that actually matters to a business owner. Good news: new models, cheaper, a genuinely handy new trick in computer-use. Bad news: 3.5 Pro — the one I was actually waiting for, the one that's meant to be amazing — is a no-show, and Gemini 4 is anyone's guess. This is the mid-tier getting a polish while the big one's still in the oven.
On real-time, don't get excited. Live's brilliant on paper and I use it — I'll be driving through Cambodia getting Gemini to work out where the hell I am, half for a laugh — but it's a pain in the arse. The brain's welded to Google's model, so unless you build a bridge you can't wire it into your own system. And the video's sketchy: slow and glitchy the second there's any noise around you. This drop didn't touch a bit of that.
The computer-use thing I'll test, but honestly I don't drive it much myself — my agents do that. Where it'd actually get me is coding alongside Gemini, the two of us working together on the same thing. So I'm hoping this rolled into the desktop app too — I'm going to go check that myself.
The one that genuinely excites me is Flash Cyber, and it's specific. I'm building a third-party watcher — a security agent that sits outside my whole system as an independent judge. Always-on, on its own VPS, one tier under god-level, watching the gateway and the entire business spine, talking straight to my CEO and the team: threats, dodgy processes, self-learning, anything off. A cheap, fast, fine-tuned vulnerability hunter is exactly the shape of that job. Only catch — "governments and trusted partners only." No idea if that shuts me out. We'll give it a crack.
And we test everything for real — not in some sandbox, in the actual system, on our own code, real usage. Cyber, computer-use, all of it. I also want to see if the images finally got better, because that's been bullshit for a while. And here's the other thing on cheaper models and maxing what you pay for: I run multiple subscriptions across multiple machines — two Mac Minis and an old MacBook — because the marketing and the dashboards are visual, I need to actually see them on real screens, and they're my devices doing the work. If I'm paying for it, I'll run it properly across my own gear. That's only fair.
I've lived the government-and-dual-use side of this too, if you want the long version — that's the Fable 5 story.
- Google · 21 Jul 2026 — Introducing Gemini 3.6 Flash, 3.5 Flash-Lite, and 3.5 Flash Cyber (the announcement, all benchmark and pricing figures).
- 9to5Google · 21 Jul 2026 — Google launches Gemini 3.6 Flash and 3.5 Flash-Lite, teases Gemini 4.
- GCN — Google launches Gemini 3.6 Flash and a cybersecurity model with 17% fewer output tokens.
- Stan Ventures — Google Launches Gemini 3.6 Flash, 3.5 Flash-Lite and 3.5 Flash Cyber.
STEPTEN.IO · The Wire · AI desk — filed 21 Jul 2026. Facts from the sources; the take is Stephen's — every word his, flagged as opinion.