Gemini 3.6 Flash: Agentic AI at $1.50 per Million Tokens

Something shifted this week in how the industry talks about its own models. Google no longer sells a chatbot that also does tasks; it sells an engine built, in its own words, for agentic workloads: software that acts on its own for minutes at a stretch, clicking through screens and calling tools with no human in the loop. The price of that autonomy just dropped. The same week, researchers showed that the walls meant to box these agents in can be walked straight through.

The Lead: Google Gemini 3.6 Flash Launches at $1.50 per Million Tokens, Built for Agentic Workloads

Google launched Gemini 3.6 Flash on July 21, priced at $1.50 per million input tokens and $7.50 per million output tokens, an entire model tier the company describes as built for agentic workloads.

The pitch is efficiency, not raw scale. Gemini 3.6 Flash consumes about 17% fewer output tokens than the model it replaces and takes fewer reasoning steps and fewer tool calls to finish a multi-step job. Since you pay per token, fewer steps is not a footnote: it is the bill. An agent that reaches the same answer in fewer moves costs less every single time it runs.

The tier is stacked. Both public models carry a one-million-token context window, native multimodal input, and built-in Computer Use, whose OSWorld-Verified score jumps from 78.4% to 83%. Below them sit a cheaper 3.5 Flash-Lite at $0.30 and $2.50 per million and a security-tuned “3.5 Flash Cyber,” a bug-hunting model the coverage said Google keeps on a leash, while a Gemini 4 was teased in the background.

For an operator, the number that matters is not the sticker price but that leash. Google shipping a security model it openly keeps restrained, in the same breath as a tier built to run on its own, is the tension of this whole moment stated plainly. The company is racing to make autonomy cheap while admitting some of it needs a chain, as 9to5Google first reported.

What It Means for You

The agent is arriving on your desk faster than the box that is supposed to hold it.

Perplexity pushed its Computer agent to every Pro subscriber this week and aimed it straight at the enterprise, adding Slack workflows, Snowflake support, and document review as it goes after Microsoft and Salesforce. If you pay for Perplexity Pro, you now have an agent that clicks through real software on your behalf, not just a smarter search box.

The trouble starts when that kind of agent slips its cage. Pillar Security disclosed seven sandbox-escape vulnerabilities across four coding tools, including Cursor, OpenAI’s Codex CLI, and Google’s Gemini CLI, where an agent writes a file that a trusted program outside its sandbox later runs or scans. Most are already patched, and Cursor fixed its flaw in version 3.0.0. Google declined to patch some of its own, arguing a sandbox was never the right place to draw the line, as The Next Web reported.

“An agent you can afford to run everywhere is only a gift if it stays where you put it.”

What’s Moving Underneath

Underneath the tools on your desk, two forces are deciding the terms on which agents reach you at all. South Korea this week formalized a free, unlimited national AI chatbot for every citizen, its AI for Everyone program, paired with a new AI law that forces winning vendors to route at least half of all queries through domestic Korean models. Reporting says roughly 23 million Koreans have already stopped paying for ChatGPT as the free option nears. It is sovereign AI offered as a public utility.

The other force is the fight over the rules. Federal disclosures filed July 21 show Anthropic spent a record $1.97 million lobbying Washington last quarter, up 26%, nearly matching Oracle and outspending Nvidia, while OpenAI spent $1.2 million. Combined AI-lab lobbying hit $3.17 million for the quarter, aimed at cybersecurity, copyright, and defense procurement, according to CNBC.

“The cheapest agent in the world still runs inside a boundary someone else drew.”

Neither a Korean statute nor a lobbying line item lands on your screen this week. Both are writing the rules that will decide which agents you are allowed to run next year, and who gets to build them.

One Tool Worth Knowing

Gemini 3.6 Flash

Gemini 3.6 Flash is the first model priced explicitly as an agent engine rather than a chat window, and the honest way to judge it is total job cost, not the per-token headline. A model that costs slightly more per token but finishes in fewer steps can end up cheaper than a bargain model that thrashes. Before you switch anything over, run one real multi-step task on both and compare the final bill, not the rate card.

If you write code, point the Gemini CLI at a small repository task and watch the token and tool-call counts, not just whether it works, because that count is now your real price. If you do not touch code, take one repetitive workflow you would trust a junior to run, a weekly report or an inbox triage, and price it out as an agent job before you hand it over. Either way, decide in advance what the agent may not touch, because the week’s other lesson is how easily these tools reach past the walls meant to hold them.

Wisdom Speaks

“Or who shut up the sea with doors … and marked out for it my bound, and set bars and doors, and said, ‘You may come here, but no further. Your proud waves shall be stopped here?’” Job 38:8-11, WEB

Out of the whirlwind, God answers Job not with an explanation but with the sea, the one force the ancient world knew it could never tame. And what does He say about it? Not that He crushed it, but that He bounded it: doors, bars, and a fixed line, this far and no further. That fixed decree carries a name in Hebrew, choq, the appointed limit that actually holds, the same word behind His command to the waves.

This is the week that word earns its keep. The industry is building agents that act faster and cost less, while the researchers who probe them keep proving that the phragmos we draw around them, the sandbox, the safety leash, is a fence a determined thing simply walks around. A boundary a human sets is a gevul that can be moved; the sea obeys a limit no wave has ever crossed.

We can keep the agent on a leash, but we did not make the leash, and every disclosure this week is a reminder of how short our reach really is. The only bound that has never failed was not drawn by us. What, this week, are you trusting to hold that you did not build?

Monday’s digest: Huawei’s Atlas 950 and the WAICO Charter, on China planting its own AI flag. Last week: Google Gemini 3.5 Pro Arrives With a 2-Million-Token Context Window, on Google’s prior model move. Today’s cheaper, more autonomous Flash tier extends both threads at once: the sovereign scramble to own AI, and Google’s relentless cadence, now aimed squarely at agents that run on their own.