Google Built a Model That Writes Working Exploits. Then It Decided You Can't Have It.

On 21 July, Google DeepMind announced Gemini 3.5 Flash Cyber, a model fine-tuned to find, validate and patch software vulnerabilities. Most of the coverage led with the benchmark numbers. The more consequential sentence is about who is allowed to use it: the model will be "exclusively available to governments and trusted partners via CodeMender" as a limited-access pilot, expanding over time.

Google's stated reason is the "dual-use nature of this technology", which it says led it to take "an intentional approach" to deploying 3.5 Flash Cyber.

A frontier lab building a capability and then declining to sell it openly is worth more attention than another set of benchmark wins. It is not the first time this year that a lab has treated access control as the safety mitigation rather than refusal training or an acceptable-use policy: Anthropic did so with Project Glasswing in April, and OpenAI did so with GPT-5.5-Cyber in May.

What It Can Actually Do

The defensive framing is real, and Google's numbers behind it are specific. By Google's count, on the V8 JavaScript engine and across a fixed number of invocations, the model found 55 unique confirmed issues, against 47 for mainline Gemini 3.5 Flash and 36 for Claude Opus 4.6, including 10 that neither of the other two models caught. On the CyberGym benchmark, Google says CodeMender, calling the model up to five times per report, scored 83.2 per cent, against self-reported scores of 83.1 to 85.6 per cent for the significantly larger models it compared. Google's own Big Sleep team also built an evaluation on hard-to-find vulnerabilities in codebases such as Chrome and Safari, which Google ran without the model's safety guardrails.

Then there is the detail that explains the deployment decision, and which most write-ups mention in passing. Google says its Cloud Vulnerability Research team used the model on Google's own systems, where it found a memory-corruption vulnerability in a sensitive production service and then generated what Google calls a "100% reliable" remote-code-execution exploit that bypassed ASLR and W^X, two standard memory protections. Google has published no further detail, and the claim has not been independently checked.

That is a categorically different artefact from a scanner. Finding a vulnerability tells a defender where to patch. Producing a reliable exploit that defeats the mitigations designed to make that vulnerability unexploitable is the offensive half of the work, and it is the half that makes "who has access" the operative question.

The Containment Is Architectural

The gating is not only a licensing decision. Google says outside users will reach the model only through CodeMender, its vulnerability-discovery-and-patching agent, first unveiled in October 2025. It has announced no standalone API. That makes the containment partly architectural, since partners use the model only inside Google's own harness, but Google has not said what guardrails that harness applies or whether it limits what a partner can point the model at.

Because the model is lightweight and cheap, Google says, CodeMender can call it several times for each final report, letting the agent analyse far more code paths than a single expensive query would allow. The economics are part of the capability.

This is the same shape as Anthropic's Project Glasswing, launched in April, where an unreleased model that Anthropic says found zero-days in every major operating system was distributed to vetted organisations under a controlled-access programme rather than published. OpenAI took the same route in May, releasing GPT-5.5-Cyber in limited preview only to vetted defenders. Three labs in under four months, reaching the same conclusion: for capabilities in this class, decide who gets to hold it.

The Same Week, Anthropic Shipped the Opposite

One day after the Gemini announcement, on 22 July, Anthropic released its Claude Security plugin for Claude Code in beta, open to all Claude Code users. It runs a multi-agent vulnerability scan inside a Claude Code session and, in Anthropic's description of Claude Security, reads Git history, traces data flows across files, and targets injection flaws, authentication bypasses, memory corruption and logic errors, turning findings into patch files the developer reviews and applies.

No gating, no vetted partner list, no government-only pilot.

It would be tidy to call this two labs making opposite calls on the same capability, and that reading is wrong. They are not the same artefact. Google gated a purpose-built vulnerability-discovery model that, by Google's account, has written a working exploit. Anthropic shipped a tooling layer, running on general-purpose models, designed for code the user already controls. Scanning your own repository is a different act from being handed an exploit generator.

The useful conclusion is narrower and more durable: the gating decision tracks what the artefact can do when pointed at something that is not yours. That is a more sensible dividing line than capability level alone, and it is roughly where both labs landed, from opposite directions, in the same week.

"Trusted Partners" Is Doing a Lot of Work

Google has not published who qualifies as a trusted partner, what the selection criteria are, what pricing looks like, or when general access might arrive. There is no standalone API and no announced general-release date.

Every one of those omissions is load-bearing. A "limited-access pilot program", "expanding over time", describes a gate that is meant to open, and from the outside there is no way to distinguish a safety control from a go-to-market sequence. Both produce the same press release.

The word "governments" deserves the same scrutiny. A model that Google says has written a fully reliable exploit, distributed to state customers under undisclosed criteria, is not obviously a purely defensive arrangement. Nothing in the announcement suggests otherwise, and nothing in it rules the question out either.

This lands directly on the gap in the two competing proposals for a frontier-AI standards body. If access control is becoming the primary mitigation for dangerous capability, then who is deemed trustworthy becomes a governance decision of the first order, currently made unilaterally by the lab that built the thing. Hassabis's essay mentions vetting only for the labs' own key personnel, and nothing reported about the administration's variant addresses who should be vetted for access.

What Was Not Disclosed

Two absences are worth recording rather than glossing.

Google published no detail on pre-release adversarial testing or misuse evaluation specific to 3.5 Flash Cyber, and as of October 2026 it has published no model card for it. Its announcement describes capability evaluations, CyberGym, the Big Sleep evaluation, the V8 comparison and the Chrome commit-scanning pipeline, which measure how well the model finds bugs. Those are not misuse evaluations. Separately, Google has described enhanced Frontier Safety safeguards covering CBRN and cyber-offence misuse for Gemini 3.6 Flash, a different model, and it would be a mistake to read that as describing the Cyber variant.

The other absence is any way to check the headline results from outside. Google's announcement gives the Big Sleep figures only in a chart, a 72 per cent success rate for 3.5 Flash Cyber against 42 per cent for 3.6 Flash and 36 per cent for mainline 3.5 Flash, on an evaluation Google's own team built. The exploit is described in two sentences, with no detail on the vulnerability. Every figure in this piece is Google's own, and we found no independent reproduction of any of them as of October 2026.

Access Control Is the Weakest Strong Lever

Gating is a real mitigation and better than shipping this to anyone with a credit card. It also has a property worth naming: it is the mitigation that degrades on its own.

Refusal training, whatever its considerable limits, travels with the model. Access control does not. It holds only while the access list stays small, the vetting stays meaningful, and no equivalent capability appears elsewhere. Announcing a pilot that expands over time is announcing the intention to relax it. Export controls on chips work as a durable lever because non-compliance carries legal cost; a lab's voluntary access list carries none, and can be widened by a product decision.

The pattern now spans three frontier labs in under four months, and it has kept spreading: on 6 October 2026 Anthropic widened its vetted Cyber Verification Program into three access tiers. That is genuinely better than the alternative. It is also, structurally, the same bet as asking Congress to screen synthetic DNA orders: build the capability, then control the periphery. The capability keeps scaling either way.

Correction, 16 October 2026: An earlier version of this article said Google's announcement did not include Big Sleep percentages; its chart gives them, including 72 per cent for 3.5 Flash Cyber. It also said Google's move was only the second time in two months that a lab had used access control as the mitigation, and that the pattern came from two labs, omitting OpenAI's GPT-5.5-Cyber, released only to vetted defenders in May; described the working exploit as produced in testing, when Google says it came from its own team's work securing Google's systems; and said that running inside CodeMender makes the model's defensive guardrails structural and stops it being pointed at arbitrary targets, which Google has not said. Those passages have been corrected.