Google released Gemini 3.8 Flash and a security-tuned variant, 3.8 Flash Cyber, on September 2, 2026. The cyber model trails a larger rival on the CWE-Bench patching benchmark, scoring 47.2% pass@1 against 47.8%.
The Big Picture
- Google shipped two Gemini 3.8 Flash models, one general and one for cybersecurity, three weeks after 3.7 Flash.
- Gemini 3.8 Flash costs $0.75 per million input tokens and $3.75 per million output tokens through December 31.
- Gemini 3.8 Flash scored 54.9% on HLE-Verified, a multi-step reasoning test spanning science and professional fields.
- Gemini 3.8 Flash Cyber sits just under a larger frontier model on CWE-Bench, at far lower cost.
Google splits Gemini 3.8 into general and cyber builds
Google built both releases on the same foundational intelligence, then aimed each at a different deployment. Gemini 3.8 Flash reaches developers through Google Antigravity, AI Studio and the Gemini API, plus AI Pro and Ultra subscribers in the Gemini app. Flash Cyber goes only to applicants accepted into the new Fairwind Program, open to government authorities, infrastructure operators and software maintainers.
“3.8 Flash works harder,” Google said in its launch announcement, describing extra reasoning steps and iterative tool calls. That diligence carries a bill. The model may spend more tokens at higher effort levels, and 3.7 Flash stays supported for efficiency-first workloads.
Introducing Gemini 3.8, our best reasoning & coding model yet.
— Google (@Google) September 2, 2026
By leveraging long-running agentic loops, we’re building on the momentum of 3.7 Flash from just three weeks ago to release two new 3.8 variants:
Meet Gemini 3.8 Flash and Gemini 3.8 Flash Cyber 🧵 pic.twitter.com/X5xItxlHkn
Where the cyber numbers land?
Flash Cyber posts 47.2% pass@1 on CWE-Bench, the patching benchmark run by Collinear, against 47.8% for the leading frontier model. Google places it on the Pareto frontier, a claim about cost per result rather than accuracy. Google also claims CyberGym results above 3.5 Flash Cyber and significantly larger models.
One headline number travels less well. Google reports a success rate above 70% on an internal benchmark spanning 20 programming languages, a test no outside party can reproduce. Adoption context sits in these Google Gemini usage statistics.
What the deployment results leave open?
Chrome Security found 2.6 times more correct patches to Chrome vulnerabilities than far larger commercial models produced. Wiz measured 7.5% to 9.7% higher recall on its internal penetration testing benchmark at 2.3 to 5.2 times lower cost. Google’s Cloud Vulnerability Research team found a critical foundational vulnerability in under two hours, work that usually takes months.
Each figure measures discovery and patch generation inside Google’s own pipelines, and omits how many patches shipped or the false positive rate at volume. Three questions stay open:
- How many Fairwind applicants get access, and on what timeline?
- What review sits between model output and a merged fix?
- Does the CWE-Bench cost advantage hold beyond C and C++ code?
Teams already on 3.7 Flash should watch token spend, since Google flags heavier consumption at higher effort levels. The NCSC warning on an AI-driven patch wave frames what hits patch queues.
SQ Magazine’s Takeaway
Google is selling a price curve. A model that scores just under the best patcher at a fraction of the cost changes what a security team can afford to run continuously, which matters more for triage volume than for one hard bug. The gating carries its own signal: Google prioritized fixing over offensive capability and released the permissive build only to vetted defenders.
Developers can build on 3.8 Flash today, while security teams wait on Fairwind decisions. The introductory price runs to the end of December, so the real cost test arrives with the standard rate. Automated patching at this price helps reduce risk across large codebases, and human review still belongs between a generated fix and production, as the first AI-assisted zero-day cyberattack made clear.
