Google has accelerated its AI release cycle again with the launch of Gemini 3.8 Flash and a security-focused variant, Gemini 3.8 Flash Cyber, as the company pushes its models deeper into autonomous software development and cybersecurity.
Announced on September 2, 2026, Gemini 3.8 arrives only three weeks after Gemini 3.7 Flash and marks Google's third Flash release in six weeks.
Google describes Gemini 3.8 Flash as its “most intelligent workhorse model” yet, designed for software engineering, autonomous agents and complex multi-step reasoning.
Its specialized sibling, Gemini 3.8 Flash Cyber, takes the same underlying intelligence into cybersecurity, focusing particularly on finding software vulnerabilities and producing fixes.
Unlike the general-purpose model, however, the Cyber version is not being made universally available. Google is restricting access through its newly announced Fairwind Program to selected trusted defenders.
Gemini 3.8 Flash Targets Coding and Autonomous AI Agents
Gemini 3.8 Flash is designed for workloads where an AI system must do more than generate a single response.
Google is positioning the model for long-horizon software engineering, agentic tasks and specialized knowledge work, where an AI agent may need to reason through a problem, use tools, evaluate results and repeatedly refine its approach.
According to Google, the model makes substantial gains over Gemini 3.7 Flash in software engineering and multi-step reasoning.
One important reason is that Gemini 3.8 Flash can effectively “work harder” on difficult problems.
For complex requests, the model can perform additional reasoning steps and make repeated tool calls in an effort to improve the final result.
There is a trade-off: Google acknowledges that this behavior can result in higher token consumption on demanding tasks.
Developers prioritizing efficiency can select lower effort levels or continue using Gemini 3.7 Flash.
Google Keeps Introductory API Price at $0.75 and $3.75 Per Million Tokens
Despite the performance improvements, Google has initially retained the same headline API pricing as Gemini 3.7 Flash.
Gemini 3.8 Flash costs:
Input: $0.75 per 1 million tokens
Output: $3.75 per 1 million tokens
Those are introductory rates.
Google says the introductory pricing expires on December 31, 2026.
Beginning January 1, 2027, the published rates are scheduled to increase to:
Input: $1.50 per 1 million tokens
Output: $7.50 per 1 million tokens
The distinction between per-token price and total task cost is important.
Although the current per-token rates remain unchanged from 3.7 Flash, Gemini 3.8 Flash may consume additional tokens when higher reasoning effort is used. A complex task could therefore cost more overall even when the listed price for each token remains the same.
Up to 1 Million Tokens of Context
Google DeepMind's model documentation lists Gemini 3.8 Flash with a context window of up to 1 million input tokens and a maximum 64,000-token text output.
The model accepts multiple input formats, including:
Text
Images
Audio
Video
Its output is text.
Google also lists support for capabilities including function calling, search as a tool and computer use.
This combination is particularly important for agentic applications, because an AI system working autonomously often needs to interact with external tools and information rather than relying entirely on the model's internal knowledge.
Google Reports Strong Benchmark Results
Google says Gemini 3.8 Flash delivers substantial improvements over its predecessor and, on some evaluations, competes with or exceeds larger frontier models.
On HLE-Verified, a benchmark testing multidisciplinary expert reasoning, Google reports a score of 54.9% for Gemini 3.8 Flash.
Google also reports strong results on DeepSWE v1.1, which evaluates long-horizon software engineering.
The company says the model performs particularly well on specialized agent evaluations including Vals Finance Agent V2 and Harvey's Legal Agent Benchmark.
These results are useful indicators of model capability, but benchmark scores should not automatically be interpreted as proof that one AI model will outperform another in every real-world application. Performance can vary substantially depending on prompts, tools, workload and deployment conditions.
Gemini 3.8 Flash Cyber Takes the Model Into Cybersecurity
The more specialized part of Google's announcement is Gemini 3.8 Flash Cyber.
Google describes it as its most capable cybersecurity model to date.
Rather than focusing primarily on offensive exploitation, Google says it has prioritized two defensive capabilities:
finding software vulnerabilities and fixing them automatically.
This distinction is central to how Google is positioning the product.
AI systems capable of deeply analyzing software security can potentially help defenders discover weaknesses faster, but advanced cybersecurity capabilities can also create misuse risks.
Google is therefore limiting who can access the specialized Cyber model.
Cyber Model Exceeds 70% on Google's Internal Vulnerability Test
Google evaluated Gemini 3.8 Flash Cyber on CyberGym, a benchmark designed to measure autonomous vulnerability discovery.
The company says the new model demonstrated frontier-level performance and improved significantly over its earlier Gemini 3.5 Flash Cyber model.
Google also developed an internal evaluation covering complex software codebases written across 20 programming languages.
On that internal test, Gemini 3.8 Flash Cyber achieved a vulnerability-discovery success rate exceeding 70%, according to Google.
Because this particular figure comes from Google's internal benchmark, it should be treated as a company-reported result rather than an independently verified measurement.
47.2% Score on Automated Patching Benchmark
Finding a vulnerability is only part of cybersecurity work.
Google is also emphasizing the model's ability to generate fixes.
On CWE-Bench, an external benchmark run by Collinear for evaluating vulnerability patching, Google reports that Gemini 3.8 Flash Cyber achieved a 47.2% pass@1 result.
A leading frontier model scored 47.8%, according to Google's comparison.
Google argues that Gemini's significance lies in approaching that level of performance while operating at substantially lower cost.
Google Says Cyber Model Produced 2.6 Times More Correct Chrome Patches
Google is already applying Gemini 3.8 Flash Cyber internally.
According to the company, its Chrome Security team found that the model generated 2.6 times more correct vulnerability patches than the best larger commercial models included in its comparison.
Google's Cloud Vulnerability Research team also used the model to discover what the company described as a critical foundational vulnerability in less than two hours.
Google said research and discovery of such vulnerabilities would ordinarily take months.
These are Google-reported results and should be interpreted in that context.
Wiz Reports Higher Recall at Lower Cost
Cybersecurity company Wiz also evaluated the model.
According to figures published by Google, Wiz found Gemini 3.8 Flash Cyber delivered 7.5% to 9.7% higher recall on its internal penetration-testing benchmark while operating at 2.3 to 5.2 times lower cost than other leading frontier models in the comparison.
Again, these figures relate to specific evaluations and should not be interpreted as universal performance guarantees.
They nevertheless indicate where Google sees one of Gemini 3.8 Flash Cyber's main competitive advantages: combining specialized cybersecurity reasoning with the speed and economics of the Flash model family.
Fairwind Program Restricts Access to Powerful Cyber Capabilities
Google is not releasing Gemini 3.8 Flash Cyber as an unrestricted general-purpose service.
Instead, the company has introduced the Fairwind Program, a limited-access initiative aimed at trusted cybersecurity defenders.
Google says prioritized access will be provided to groups including:
trusted government authorities, critical infrastructure operators and software maintainers.
The Fairwind Program combines Gemini 3.8 Flash Cyber with Google's CodeMender technology.
The goal is to enable defenders to autonomously discover vulnerabilities, verify them and generate software patches.
Google says the system is intended to produce validated, deployment-ready fixes inside an organization's secure cloud environment.
Why Google Is Restricting the Cyber Model
The access restrictions reflect a fundamental problem surrounding increasingly capable cybersecurity AI.
A model sophisticated enough to discover vulnerabilities can potentially assist defenders, but similar capabilities could be misused to identify weaknesses for malicious purposes.
Google says Gemini 3.8 Flash includes safeguards covering cyber offense as well as chemical, biological, radiological and nuclear (CBRN) misuse risks under its Frontier Safety Framework.
Gemini 3.8 Flash Cyber operates with more permissive cybersecurity mitigations because legitimate security professionals require deeper cyber capabilities.
That is precisely why Google says access is limited to trusted defenders rather than being opened broadly.
Improved Resistance to Prompt-Injection Attacks
Google also says the Gemini 3.8 generation has made significant improvements in resistance to prompt injection.
Prompt-injection attacks attempt to manipulate AI systems—particularly agents that can access external information or tools—into ignoring their intended instructions or performing unwanted actions.
The problem becomes increasingly important as AI models gain greater autonomy.
An ordinary chatbot responding incorrectly can create inaccurate information. An autonomous agent with access to software, tools or enterprise systems could potentially create much more serious consequences if successfully manipulated.
Security improvements therefore become increasingly important as Google and its competitors move from conversational AI toward models capable of taking actions.
Where Gemini 3.8 Flash Is Available
Unlike the restricted Cyber edition, Gemini 3.8 Flash is receiving broad distribution.
Google says developers can access the model through the Gemini API using Google AI Studio, as well as through Android Studio.
It is also available through Google's Antigravity agentic development platform.
Enterprise customers can access Gemini 3.8 Flash through Gemini Enterprise.
For consumers, Google is making the model available to Google AI Pro and Ultra subscribers through the Gemini app, AI Mode in Google Search and Gemini in Google Sheets.
Google's Flash Release Cycle Is Accelerating
The timing of Gemini 3.8 is itself notable.
Google says this is its third Flash release in only six weeks, with Gemini 3.8 Flash arriving three weeks after Gemini 3.7 Flash.
That pace reflects an increasingly rapid competitive cycle in frontier AI.
Rather than reserving major improvements exclusively for enormous flagship models, Google is putting substantial reasoning and coding capability into the Flash family—models designed to deliver stronger economics and lower latency for workloads that may require enormous volumes of inference.
This is particularly important for autonomous agents.
An agent may invoke an AI model repeatedly while completing a single assignment. Cost and speed therefore become as strategically important as raw intelligence.
Why Gemini 3.8 Flash Cyber Could Be the Bigger Story
Gemini 3.8 Flash improves Google's general AI offering, but the Cyber edition may reveal more about where advanced AI deployment is heading.
The industry is moving beyond AI systems that simply answer cybersecurity questions.
Google's vision involves models that can inspect large software projects, autonomously search for vulnerabilities, determine whether weaknesses are genuine, develop patches and validate those fixes.
If those capabilities prove reliable at scale, AI could significantly change how software vulnerabilities are discovered and repaired.
But increasingly autonomous security models also raise significant questions around access control and misuse.
Google's Fairwind approach provides an early example of how major AI companies may handle this dilemma: broad access to general-purpose models while placing more powerful specialized cyber capabilities behind additional restrictions.
Gemini 3.8 Flash is therefore another step in the AI model race.
Gemini 3.8 Flash Cyber is also a test of something potentially more consequential—how increasingly powerful AI capabilities can be deployed to defenders without making the same capabilities universally available to attackers.
