Google has introduced Gemini 3.8 Flash and Gemini 3.8 Flash Cyber, expanding its Gemini model family with a general-purpose model focused on long-horizon software engineering and autonomous agents and a restricted variant designed specifically for cybersecurity defense.
Announced on September 2, the two models represent Google’s third Flash release in six weeks, following Gemini 3.7 Flash. Google says Gemini 3.8 Flash improves on its predecessor in software engineering, agentic tasks and multi-step reasoning while retaining the Flash series’ emphasis on speed and lower operating costs.
Gemini 3.8 Flash is available to developers and enterprises, while consumers can access it through Google AI Pro and Ultra subscriptions. Gemini 3.8 Flash Cyber has a more limited distribution and is being offered to trusted defenders through Google’s new Fairwind Program.
Gemini 3.8 Flash targets autonomous software development
Google is positioning Gemini 3.8 Flash less as a conventional chatbot and more as a model for systems capable of performing extended, multi-step tasks.
The company says the model has made substantial gains over Gemini 3.7 Flash on long-horizon software engineering. On the DeepSWE v1.1 benchmark, which evaluates autonomous solutions to complex engineering problems, Google reports that Gemini 3.8 Flash outperforms most larger frontier models.
Google also reports gains in specialized professional tasks. The model performs strongly on benchmarks including Vals Finance Agent V2 and Harvey’s Legal Agent Benchmark, while achieving 54.9% on HLE-Verified, a benchmark that covers multi-step reasoning across STEM, humanities, and professional subjects.
The underlying approach is deliberately agentic. Google says Gemini 3.8 Flash can spend additional computational effort on difficult problems, performing more reasoning steps and making iterative tool calls. That behavior can improve results on complex tasks, but it can also increase token consumption.
Google therefore says that developers prioritizing compute efficiency can use lower-effort settings or continue using Gemini 3.7 Flash for efficiency-first workloads.
Pricing remains aggressive, but only temporarily
Gemini 3.8 Flash launches at an introductory price of $0.75 per million input tokens and $3.75 per million output tokens, matching the introductory pricing of Gemini 3.7 Flash.
That pricing is temporary. Google says the introductory rates expire on December 31, 2026. From January 1, 2027, pricing will increase to $1.50 per million input tokens and $7.50 per million output tokens.
The pricing strategy places the model directly in the competition for cost-sensitive agentic workloads, where developers may generate substantially more tokens than with conventional question-and-answer applications.
There is an important trade-off: Google’s own description acknowledges that 3.8 Flash “works harder” on complex tasks. Greater reasoning effort can improve performance, but additional token usage can raise the actual cost of completing a task even when the nominal token price remains competitive.
From coding assistant to autonomous agent
Google’s examples illustrate the intended shift.
Gemini 3.8 Flash was used through Google Antigravity to build a playable 3D game from a prompt, generate a functional DOS-style version of Google Maps and create an interactive hardware-anatomy visualization using Three.js. These examples are demonstrations rather than independent evidence of general-purpose autonomous performance, but they show the types of workflows Google is targeting.
The larger trend is toward AI systems that can plan, execute, evaluate, and revise work over multiple steps instead of simply producing a single response.
For software developers, that means a model can potentially take a broader engineering objective as its starting point and use tools repeatedly while working toward an outcome. Google’s emphasis on long-running agentic loops is therefore central to the 3.8 release rather than an incidental feature.
Gemini 3.8 Flash Cyber takes a different approach
Alongside the general-purpose model, Google has introduced Gemini 3.8 Flash Cyber, a cybersecurity-focused version intended to help defenders discover vulnerabilities and develop patches.
Unlike the standard model, Flash Cyber is not broadly available. Google says access is being provided to trusted government authorities, critical infrastructure operators, and software maintainers through the Fairwind Program.
The restriction reflects the dual-use nature of cybersecurity AI. A model capable of identifying vulnerabilities can potentially be useful to defenders while also creating risks if similar capabilities are made broadly available for offensive purposes.
Google says it has therefore prioritized vulnerability fixing over offensive capabilities such as exploitation in the Cyber variant.
Vulnerability discovery and automated patching
Google reports frontier-level performance from Gemini 3.8 Flash Cyber on CyberGym, a benchmark for autonomous vulnerability discovery. The company says the model also achieved a success rate above 70% on an internal benchmark covering vulnerabilities across complex codebases written in 20 programming languages.
On CWE-Bench, an external benchmark for vulnerability patching run by Collinear, Google reports a 47.2% pass@1 result, compared with 47.8% for a leading frontier model, while claiming significantly lower cost.
Google has also supplied examples from its own security operations. The Chrome Security team reported that Flash Cyber generated 2.6 times more correct patches for Chrome vulnerabilities than the larger commercial models it compared against. Google also says Wiz recorded 7.5% to 9.7% higher recall on an internal penetration-testing benchmark while using between 2.3 and 5.2 times lower cost than other leading frontier models.
These figures are Google’s reported results and partner evaluations rather than independent benchmark verification. They indicate the performance Google is claiming, but should not be interpreted as a universal measure of superiority across cybersecurity workloads.
Google says the model is already finding vulnerabilities
Google says Flash Cyber is already being used internally to secure its own code.
According to the company, Google’s Cloud Vulnerability Research team used the model to identify a critical foundational vulnerability in less than two hours, a task the company says would normally require months of research and discovery.
The claim is potentially significant because vulnerability discovery is one of the more labor-intensive areas of application security. If AI agents can reliably reduce the time required to identify and remediate flaws, security teams could theoretically examine larger codebases more frequently.
However, reliability remains the critical factor. Automated discovery and patch generation still require validation because an incorrect patch can introduce new defects or leave the original vulnerability unresolved.
Safety restrictions remain central
Google says standard Gemini 3.8 Flash includes safeguards against misuse involving chemical, biological, radiological, and nuclear risks as well as cyber offense.
Flash Cyber uses more permissive cybersecurity mitigations because it is designed for defensive applications, but Google is restricting access to trusted defenders as a result. The company also says the Gemini 3.8 models have improved resistance to prompt injection, based on measurements from Gray Swan.
The split between the two models reflects a broader challenge for AI developers: increasingly capable models can be valuable precisely because they can perform tasks that also carry meaningful security risks.
Where Gemini 3.8 Flash is available
Developers can access Gemini 3.8 Flash through Google AI Studio and the Gemini API, as well as through development environments and tools including Android Studio and Google Antigravity. Enterprises can access the model through Gemini Enterprise.
Consumers with Google AI Pro and Ultra subscriptions can use Gemini 3.8 Flash through the Gemini app, AI Mode in Google Search, and Gemini in Google Sheets.
Flash Cyber follows a separate access model through Fairwind, with Google prioritizing government authorities, critical infrastructure operators and software maintainers.
Join the conversation! Your thoughts help the community grow.