Google Built a Model That Writes Working Exploits. Then It Decided You Can't Have It.

On July 21, Google DeepMind announced Gemini 3.5 Flash Cyber, a model fine-tuned to find, validate and patch software vulnerabilities. Most of the coverage led with the benchmark numbers. The more consequential sentence is about who is allowed to use it: the model will be "exclusively available to governments and trusted partners via CodeMender" as a limited-access pilot, expanding over time.

Google's stated reason, verbatim: "Given the dual-use nature of this technology, we have taken an intentional approach to how we deploy 3.5 Flash Cyber."

A frontier lab building a capability and then declining to sell it is worth more attention than another set of benchmark wins. It is the second time in two months that a lab has treated access control as the safety mitigation rather than refusal training or an acceptable-use policy.

What It Can Actually Do

The defensive framing is real, and the numbers behind it are specific. On the V8 JavaScript engine, the model found 55 unique confirmed issues, against 47 for mainline Gemini 3.5 Flash and 36 for Claude Opus 4.6, including 10 that no other model identified. It performed competitively against larger models on the CyberGym benchmark. It was stress-tested against Chrome and Safari.

Then there is the detail that explains the deployment decision, and which most write-ups mention in passing. In testing, the model produced a working remote-code-execution exploit that defeated standard memory protections, reported as reliable and as bypassing ASLR and W^X.

That is a categorically different artifact from a scanner. Finding a vulnerability tells a defender where to patch. Producing a reliable exploit that defeats the mitigations designed to make that vulnerability unexploitable is the offensive half of the work, and it is the half that makes "who has access" the operative question.

The Containment Is Architectural

The gating is not only a licensing decision. The model operates solely inside CodeMender, Google's vulnerability-discovery-and-patching agent, first unveiled in October 2025. Running only within that harness means the guardrails restricting it to defensive tasks are structural rather than advisory: there is no standalone API to point at an arbitrary target.

Because the model is small and cheap, CodeMender can call it repeatedly on a single vulnerability report, exploring far more code paths than a single expensive query would allow. The economics are part of the capability.

This is the same shape as Anthropic's Project Glasswing, where an unreleased model that found zero-days across every major operating system was distributed to vetted organisations under a controlled-access programme rather than published. Two labs, two months apart, reaching the same conclusion: for capabilities in this class, decide who gets to hold it.

The Same Week, Anthropic Shipped the Opposite

One day after the Gemini announcement, on July 22, Anthropic put its Claude Security plugin for Claude Code into public beta. It runs a multi-agent vulnerability scan from the terminal, reads Git history, traces data flows across files, and targets injection flaws, authentication bypasses, memory corruption and logic errors, turning findings into patch files the developer reviews and applies.

No gating, no vetted partner list, no government-only pilot.

It would be tidy to call this two labs making opposite calls on the same capability, and that reading is wrong. They are not the same artifact. Google gated a purpose-built vulnerability-discovery model that demonstrably writes working exploits. Anthropic shipped a tooling layer, running on general-purpose models, scoped to code the user already controls. Scanning your own repository is a different act from being handed an exploit generator.

The useful conclusion is narrower and more durable: the gating decision tracks what the artifact can do when pointed at something that is not yours. That is a more sensible dividing line than capability level alone, and it is roughly where both labs landed, from opposite directions, in the same week.

"Trusted Partners" Is Doing a Lot of Work

Google has not published who qualifies as a trusted partner, what the selection criteria are, what pricing looks like, or when general access might arrive. There is no standalone API and no announced general-release date.

Every one of those omissions is load-bearing. "Limited-access pilot, expanding over time" describes a gate with a scheduled opening, and from the outside there is no way to distinguish a safety control from a go-to-market sequence. Both produce the same press release.

The word "governments" deserves the same scrutiny. A model that reliably writes exploits, distributed to state customers under undisclosed criteria, is not obviously a purely defensive arrangement. Nothing in the announcement suggests otherwise, and nothing in it rules the question out either.

This lands directly on the gap in the two competing proposals for a frontier-AI standards body. If access control is becoming the primary mitigation for dangerous capability, then who is deemed trustworthy becomes a governance decision of the first order, currently made unilaterally by the lab that built the thing. Neither the Hassabis proposal nor the administration's variant addresses vetting.

What Was Not Disclosed

Two absences are worth recording rather than glossing.

Google published no detail on pre-release adversarial testing or misuse evaluation specific to 3.5 Flash Cyber. Its announcement describes capability evaluations, CyberGym and the Chrome commit-scanning pipeline, which measure how well the model finds bugs. Those are not misuse evaluations. Separately, Google has described enhanced Frontier Safety safeguards covering CBRN and cyber-offense misuse for Gemini 3.6 Flash, a different model, and it would be a mistake to read that as describing the Cyber variant.

Some coverage also carried precise Big Sleep percentages for the model's performance. Those figures do not appear in Google's own announcement, which characterises the result only as significantly surpassing mainline 3.5 Flash and 3.6 Flash, and two secondary accounts of them disagreed with each other. They are omitted here for that reason.

Access Control Is the Weakest Strong Lever

Gating is a real mitigation and better than shipping this to anyone with a credit card. It also has a property worth naming: it is the mitigation that degrades on its own.

Refusal training, whatever its considerable limits, travels with the model. Access control does not. It holds only while the access list stays small, the vetting stays meaningful, and no equivalent capability appears elsewhere. Announcing a pilot that expands over time is announcing the intention to relax it. Export controls on chips work as a durable lever because non-compliance carries legal cost; a lab's voluntary access list carries none, and can be widened by a product decision.

The pattern now has two instances in two months, from the two labs most vocal about safety. That is genuinely better than the alternative. It is also, structurally, the same bet as asking Congress to screen synthetic DNA orders: build the capability, then control the periphery. The capability keeps scaling either way.