Gemini 3.6 Flash Launch: Price, Benchmarks, API & Flash-Lite

Last updated: July 21, 2026

Google has launched Gemini 3.6 Flash and Gemini 3.5 Flash-Lite as generally available production models, alongside a specialized Gemini 3.5 Flash Cyber system for finding and fixing software vulnerabilities.

The headline is efficiency rather than a new flagship. Gemini 3.6 Flash uses 17% fewer output tokens than 3.5 Flash on the Artificial Analysis Index, lowers output pricing from $9 to $7.50 per million tokens, and improves Google’s reported coding, computer-use, knowledge-work, and ML-research scores. Gemini 3.5 Flash-Lite targets high-volume work at 350 output tokens per second and costs $0.30 per million input tokens and $2.50 per million output tokens.

Both public models have a 1-million-token context window, 64k maximum output, native multimodal input, thinking controls, and built-in tools including Computer Use. Google says they are ready for production through the Gemini API.

Gemini 3.6 Flash at a glance

Gemini 3.6 Flash is a direct successor to Gemini 3.5 Flash, not the delayed Gemini 3.5 Pro. Google calls it the new Flash workhorse: a model intended to balance intelligence, latency, and cost for agents that may reason, call tools, inspect visual inputs, edit code, and continue across multiple steps.

The pricing change is easy to miss. Input remains at $1.50 per million tokens, while output falls from the prior model’s $9 to $7.50. If the model also produces 17% fewer output tokens on a representative workload, the effective cost reduction can be larger than the price cut alone. The exact savings will vary because reasoning depth, tool calls, cached content, retries, and output length depend on the application.

Gemini 3.6 Flash benchmarks

Google’s launch table shows gains over Gemini 3.5 Flash across several agentic and knowledge-work evaluations.

Google says coding output has fewer unwanted edits and reduced execution loops, while multi-step workflows take fewer reasoning steps and tool calls. The official API migration guide adds useful nuance: 3.6 Flash more often runs diagnostic scripts before changing code, which can improve difficult tasks but add unnecessary exploration on a simple frontend request. Google also says evaluators preferred earlier models for some visual styling, even though 3.6 Flash was stronger at producing functional code.

That combination suggests a practical testing plan. Measure more than pass rate:

• number of changed files and out-of-scope edits;
• tool calls and model turns per completed task;
• total input, cached, and output tokens;
• retries after malformed function calls;
• latency to first useful action and to final result;
• human corrections required after tests pass;
• visual quality separately from functional correctness.

Vendor benchmark gains matter most when they reduce total task cost or human review, not when they only improve a leaderboard number.

Gemini 3.5 Flash-Lite at a glance

Gemini 3.5 Flash-Lite is the throughput model. It is designed for workloads where a large number of fast, inexpensive calls matters more than using Google’s strongest available reasoning on every item.

Google recommends the minimal thinking level for extraction, routing, classification, and other latency-sensitive work. For autonomous subagents, code execution, tool use, or multi-step reasoning, it recommends testing medium or high so the model does not stop too early.

The reported benchmark gains over Gemini 3.1 Flash-Lite are substantial:

Google also reports that 3.5 Flash-Lite beats the larger Gemini 3 Flash on SWE-Bench Pro (54.2% vs 49.6%) and OSWorld-Verified (74.0% vs 65.1%). That does not make Flash-Lite universally better: benchmark settings, thinking levels, latency, and error modes still matter. It does make the model unusually interesting for subagent fleets, bulk document processing, catalog enrichment, translation, search, and structured extraction.

Gemini 3.6 Flash vs 3.5 Flash-Lite: which should you use?

Use Gemini 3.6 Flash when the task needs:

• multi-step planning and tool use;
• production code generation or migration;
• spatial or multimodal reasoning;
• chart, document, and visual-data analysis;
• computer use with more reliable planning;
• fewer repair loops than Gemini 3.5 Flash.

Use Gemini 3.5 Flash-Lite when the task needs:

• high-volume document parsing;
• translation, classification, or routing;
• structured JSON extraction;
• agentic search at low latency;
• many parallel subagents with controlled budgets;
• a low-cost replacement for older Flash-Lite or selected 2.5 Flash workloads.

For a tiered agent, the models can work together: 3.6 Flash can plan and synthesize, while Flash-Lite handles many narrow parallel tasks. Google shows this master-agent/subagent pattern in its launch examples, but the economics should still be measured end to end.

What is Gemini 3.5 Flash Cyber?

Gemini 3.5 Flash Cyber is a specialized version of 3.5 Flash fine-tuned to find, validate, and patch software vulnerabilities. Google pairs it with CodeMender, an agent infrastructure that can invoke multiple Flash Cyber agents and combine their work into one report.

This is not another public model to select in AI Studio. Because vulnerability research is dual-use, Google says the initial limited-access pilot will be exclusive to governments and trusted partners through CodeMender, with expansion over time.

The strongest evidence in Google’s technical post comes from real security workflows:

• on a fixed number of V8 JavaScript engine runs, Flash Cyber found 55 unique confirmed issues, versus 47 for mainline 3.5 Flash and 36 for Claude Opus 4.6;
• 10 of those V8 issues were not caught by either comparison model;
• Google says the system is already finding and fixing vulnerabilities in Chrome, Android, Cloud, Ads, and YouTube;
• in one internal example, the model found remote-code-execution and memory-corruption vulnerabilities in two hours and generated a reliable exploit for validation.

These are Google-reported security results, and the comparison is not a general intelligence ranking. The model is optimized for repeated code-path exploration inside an agent system, while some competing models refuse offensive-looking benchmark tasks because of their safety policies.

The product lesson is architectural: for vulnerability discovery, many inexpensive specialized passes can explore more paths than one call to a large general model. The governance lesson is that Google is not making the capability broadly self-serve at launch.

Availability: where the new models are live

As of July 21, 2026:

• Gemini API and Google AI Studio: 3.6 Flash and 3.5 Flash-Lite are GA.
• Gemini app: both public models are available.
• Google Antigravity: 3.6 Flash is available and is the new default behind the Antigravity managed agent.
• Android Studio: developer access is available.
• Gemini Enterprise Agent Platform: both models are available.
• Gemini Enterprise app: 3.6 Flash is available.
• Google Search: 3.5 Flash-Lite is rolling out.
• CodeMender: Flash Cyber is coming through a restricted pilot, not public self-serve access.

Gemini 3.5 Pro is not part of this GA release. Google says it remains in testing with partners and will be released broadly when ready.

API migration changes developers should not miss

Google is changing request behavior starting with 3.6 Flash and 3.5 Flash-Lite, and says these rules will apply to future Gemini releases.

Model IDs

gemini-3.6-flash
gemini-3.5-flash-lite

Remove deprecated sampling controls

The API now ignores temperature, top_p, and top_k, and Google says future model generations will return an HTTP 400 error when they are supplied. Use explicit system instructions, structured output schemas, and thinking_level instead of relying on those controls.

Do not prefill a model turn

Requests can no longer end with a non-empty model role turn. Applications that used a prefilled model response to force a prefix or suppress a preamble should migrate to system instructions or structured outputs.

Update thinking configuration

• Gemini 3.6 Flash defaults to medium.
• Gemini 3.5 Flash-Lite defaults to minimal.
• Replace old numeric thinking_budget logic with the supported string thinking_level values where required.

Re-run function-calling tests

Audit thought-signature preservation, multimodal payload placement, function-response IDs, and malformed-function-call handling. A model-ID change alone is not a complete migration.

Final verdict

Google’s July 21 release is a production-economics update with meaningful capability gains. Gemini 3.6 Flash is cheaper per output token, reportedly less verbose, and stronger on coding, computer use, ML research, and knowledge work. Gemini 3.5 Flash-Lite makes a bigger leap in the inexpensive tier and may be the more consequential model for teams processing millions of routine items or running fleets of narrow agents.

Flash Cyber is the most technically dramatic announcement, but the least accessible. It shows how specialized low-cost models can be orchestrated for deep vulnerability discovery while also illustrating why advanced cyber capability is being released cautiously.

The right next step is not to replace every Gemini endpoint at once. Choose representative tasks, record total tokens and tool calls, measure retries and human corrections, remove deprecated parameters, and migrate only when the new model improves the cost of a completed, reviewed task.

FAQ