Google has introduced Gemini 3.8 Flash and Gemini 3.8 Flash Cyber, two versions of the same new model family aimed at long-running software work and defensive security. In its September 2 announcement, Google says the general Flash model is its strongest reasoning and coding model yet, while Flash Cyber is built for vulnerability discovery and automated patching.
The split is practical rather than cosmetic. Gemini 3.8 Flash is available to developers and consumers at the same introductory API price as 3.7 Flash, $0.75 per million input tokens and $3.75 per million output tokens. Flash Cyber is restricted to trusted defenders through the Fairwind Program, which gives selected government authorities, critical-infrastructure operators, and software maintainers access to higher-risk cyber capabilities.
Flash spends more effort on long tasks
Google is positioning the regular 3.8 Flash as a workhorse for software engineering, agentic tasks, and multi-step reasoning. The company says it often approaches larger frontier models while keeping the speed and introductory cost of 3.7 Flash. Its reported 54.9% score on HLE-Verified covers questions across STEM, humanities, and professional subjects, but it remains a vendor benchmark rather than an independent comparison.
The model’s operating behavior is part of the update. Google says 3.8 Flash takes additional reasoning steps and can call tools repeatedly on difficult tasks. That can improve reliability on long-horizon work, but it can also use more tokens. Developers can lower the effort setting when compute efficiency matters, or keep using 3.7 Flash for workloads that favor predictable token use.
Google highlights DeepSWE v1.1, a benchmark for long-horizon software engineering, where it says 3.8 Flash outperforms most larger frontier models on end-to-end engineering problems. The announcement also points to stronger results in finance and legal-agent evaluations. That focus follows Google’s recent agentic video analysis update, which also moved more model work into targeted, tool-driven steps. Those figures describe Google’s tests, so they show the company’s target for the model rather than a guarantee for every codebase or tool chain.
Cyber capability arrives behind an access gate
Gemini 3.8 Flash Cyber is the more consequential release. Google says it reaches frontier-level performance on CyberGym for autonomous vulnerability discovery and exceeds 70% on an internal test spanning complex codebases in 20 programming languages. For automated patching, Google reports a 47.2% pass@1 score on CWE-Bench, close to a leading frontier model’s 47.8% result, while claiming a lower cost.
The company also reports operational examples. Google’s Chrome Security team says Flash Cyber produced 2.6 times more correct vulnerability patches than the best much larger commercial models in its comparison. Google says Wiz measured higher recall at between 2.3 and 5.2 times lower cost, and that its Cloud Vulnerability Research team used the model to find a critical foundational vulnerability in under two hours. These are company-provided results, not independent security audits.
The release extends the safety questions raised by OpenAI’s Astra threshold, but Google’s access decision draws a sharper line between ordinary model use and advanced cyber work. Flash Cyber receives more permissive cybersecurity mitigations than regular 3.8 Flash, which is why Google is limiting it to the Fairwind group. Google says both models include safeguards for cyber offense and other high-risk domains.
For developers, the immediate change is a faster Flash model with a choice between deeper effort and lower token overhead. For defenders, the important detail is not just the benchmark scores but the distribution model: access is tied to an institution’s defensive role. Google has made Gemini 3.8 Flash available through its developer tools and products, while Flash Cyber remains a controlled capability whose broader availability depends on the Fairwind program.
