Gemini 3.6 Flash: fewer tokens, same gap
I ran Gemini 3.6 Flash through a few of my usual coding tasks this morning. Google launched it alongside 3.5 Flash-Lite and 3.5 Flash Cyber, all pushed as production-ready models for agents and high-throughput work. The benchmark tables in the blog post show nice jumps over the previous Flash, but in my tests the gap to the best models is still there.
Google says 3.6 Flash addresses efficiency feedback from 3.5 Flash. It uses fewer tokens to deliver higher quality at the exact same cost. There’s also 3.5 Flash-Lite, which they claim hits ~350 output tokens per second for agentic search and document processing, and Flash Cyber, a model specialized in finding and patching software vulnerabilities. The messaging is all about speed and cost — these are workhorse models, not top-of-the-line intelligence.
We’re rolling out three new models to make AI agents faster, smarter, and cheaper at scale: 🔵 Gemini 3.6 Flash: It uses fewer tokens than 3.5 Flash to deliver higher quality work at the exact same cost. 🔵 Gemini 3.5 Flash-Lite: A fast, cost-effective option for everyday tasks like processing documents and agentic search. 🔵 Gemini 3.5 Flash Cyber: A cybersecurity model built to find and patch critical software vulnerabilities.
I gave 3.6 Flash a few tasks from my current project: refactoring a Python trading bot, writing some Magento configuration scripts, and debugging an API integration. It finished them quickly, and the responses were shorter — sometimes noticeably more concise. But it still missed edge cases that Claude Opus and even the latest GPT-5 mini caught. The errors weren’t huge, but they were the kind that would cause a bug in production if I didn’t review the code carefully. For straightforward boilerplate, it’s fine. For anything requiring decision-making across a multi-file codebase, I’d still look elsewhere.
The efficiency angle might make sense if you’re paying per token and serving millions of requests. For my workflow, saving a few tokens doesn’t matter if I have to spend more time checking the output.
Flash Cyber is the most concrete, narrow promise: a model trained specifically to find and fix vulnerabilities. If it actually reduces false positives compared to generic models, that’s useful. I’ll test it on some known CVEs when I get a chance, but I haven’t seen independent benchmarks yet.
Overall, these are iterative improvements, not a leap. Google is optimizing for cost and throughput, and that’s probably the right bet for their cloud customers. For me, the models that produce the most reliable output still come from other labs.