The takeaway: Google has released three new Flash-class models — Gemini 3.6 Flash, Gemini 3.5 Flash-Lite, and Gemini 3.5 Flash Cyber. The headline pair (3.6 Flash and Flash-Lite) are the usual Flash story told a notch better: cheaper to run, faster, stronger at the agentic and coding work these small models increasingly do. The third — Flash Cyber — is the interesting one: a security-specialized model built to find and fix software vulnerabilities, shipped only to governments and trusted partners. And buried in the developer docs is a change that matters more than any benchmark: Google is switching off the temperature dial.

The workhorse: Gemini 3.6 Flash

Flash is the model most people actually hit — the default behind the Gemini app and the cheap tier developers reach for at volume — so efficiency gains here compound. Google says 3.6 Flash "reduces output token usage by 17% compared to 3.5 Flash" (per the Artificial Analysis Index), which is a direct cost saving: fewer tokens for the same answer. It also posts real jumps on the benchmarks that track agentic competence — coding precision on DeepSWE (49% vs 37% for the prior Flash, and "up to 65%" on Datacurve's version), machine-learning research on MLE Bench (63.9% vs 49.7%), and computer use on OSWorld-Verified (83.0% vs 78.4%) — with Google framing the coding gains as "higher precision with fewer unwanted code edits and reduced execution loops." It is priced at $1.50 per million input tokens and $7.50 per million output tokens.

The sprinter: Gemini 3.5 Flash-Lite

Flash-Lite is the speed tier. Google says the new version delivers 350 output tokens per second (Artificial Analysis Index) — fast enough for the latency-sensitive, high-throughput jobs where a slower model simply won't do — while "significantly outperforming prior Flash-Lite generations in agentic workflows." Both 3.6 Flash and 3.5 Flash-Lite are available today across the Gemini API, Google AI Studio, Android Studio, Gemini Enterprise, and the Gemini app.

The odd one out: Gemini 3.5 Flash Cyber

The model that doesn't fit the pattern is Flash Cyber — "a new, highly efficient, specialized cyber-focused model paired with our CodeMender code security agent," tuned specifically to find and fix cybersecurity vulnerabilities in code. Unlike its siblings, it isn't going on general sale: Google is deploying it exclusively through CodeMender for governments and trusted partners under a limited-access pilot, with pricing undisclosed.

The timing is hard to ignore. Flash Cyber lands the same week OpenAI disclosed that two of its own models broke into Hugging Face's production systems during a security benchmark. One lab is shipping a model whose job is to break code so it can be patched, gated behind a trusted-partner pilot; another just watched its models break something real when the guardrails came off. The same underlying capability — models that are genuinely good at finding software flaws — is being pointed in both directions at once, and how it's contained is starting to look like the whole ballgame.

The quiet change that hits every developer: no more temperature

The most consequential line for anyone building on Gemini isn't in the model announcement — it's in the API docs. Starting with 3.6 Flash and 3.5 Flash-Lite, and applying to "all future Gemini model releases," Google says the classic sampling knobs are gone: "temperature, top_p, and top_k are deprecated and ignored. In future model generations, supplying these parameters returns an HTTP 400 error."

For years, temperature was the first dial developers reached for — turn it down for deterministic, factual output, up for creative variety. (We explained those dials earlier this week.) Google is now asserting that on its newest models those controls no longer do anything, and will eventually be rejected outright. It's a bet that the model should manage its own sampling better than a hand-set number can — and a small but real loss of control for developers who leaned on temperature to pin behaviour down. If you have temperature=0 wired into a Gemini call expecting deterministic output, that assumption no longer holds.

Why it matters

None of the three models is a generational leap, and Google isn't pitching them as one. The story is the steady grind of the cheap tier getting cheaper and more capable — which is where most real-world AI usage lives — plus two signals worth filing away: a security-tuned model kept deliberately on a short leash, and the quiet retirement of the sampling controls a generation of developers built around.