Google Releases Gemini 3.8 Flash and Gemini 3.8 Flash Cyber

Google DeepMind has introduced Gemini 3.8 Flash and Gemini 3.8 Flash Cyber, expanding its Gemini family with a stronger focus on coding, reasoning, AI agents and cybersecurity.

Announced on September 2, 2026, Gemini 3.8 marks Google’s third Flash release in just six weeks. The company describes it as its best reasoning and coding model so far, while keeping the speed and introductory pricing of Gemini 3.7 Flash.

Alongside the general-purpose model, Google has introduced Gemini 3.8 Flash Cyber, a specialised cybersecurity model designed to help trusted defenders discover vulnerabilities and automate security fixes.

The launch shows how AI models are increasingly being developed not only for general productivity and coding, but also for specialised cybersecurity operations.

What Is Gemini 3.8 Flash?

Gemini 3.8 Flash is designed as Google’s latest high-performance workhorse model for software engineering, agentic workflows and complex reasoning.

Google says the model delivers significant improvements over Gemini 3.7 Flash, particularly when handling long-running coding tasks and workflows that require multiple steps and tool calls.

One important part of the model’s design is what Google calls working harder.

For complex tasks, Gemini 3.8 Flash can perform additional reasoning steps and use tools iteratively before producing an answer. This can improve performance on demanding tasks, although it can also result in higher token usage.

This makes the model particularly interesting for developers building AI agents that need to perform more than simple question-and-answer interactions.

Gemini 3.8 Flash Targets Agentic Coding

AI coding is moving beyond generating individual functions or answering programming questions.

Developers increasingly want AI agents that can understand an entire project, plan changes, use development tools, test their work and continue improving the result.

Gemini 3.8 Flash is designed for this type of long-horizon software engineering.

Google reports that the model performs strongly on DeepSWE v1.1, a benchmark focused on long-horizon software engineering tasks. It also reports improvements across specialised professional and reasoning benchmarks.

This could make Gemini 3.8 Flash useful for:

• Software development
• Code generation
• Debugging
• Testing
• Application development
• Research workflows
• Data analysis
• AI agents
• Multi-step automation

The broader trend is clear. AI coding assistants are evolving towards systems that can independently manage larger parts of the development process.

Introducing Gemini 3.8 Flash Cyber

The more specialised announcement is Gemini 3.8 Flash Cyber.

Google describes it as its most capable cybersecurity model, with frontier-level performance in vulnerability detection and automated patching. Unlike the standard Gemini 3.8 Flash, however, Cyber is not being released as a generally available model.

Access is being provided to trusted defenders through Google’s new Fairwind Program. The programme is aimed at organisations such as government authorities, critical infrastructure operators and software maintainers that need advanced AI-powered cyber defence capabilities.

This restricted-access approach is important because a model capable of finding and fixing vulnerabilities could also have significant offensive potential.

Google is therefore positioning Gemini 3.8 Flash Cyber primarily around defensive cybersecurity.

AI-Powered Vulnerability Detection

One of the biggest capabilities Google highlights is autonomous vulnerability discovery.

Gemini 3.8 Flash Cyber was evaluated using CyberGym, an industry benchmark for vulnerability discovery. Google says the model achieved frontier-level performance and surpassed both its previous 3.5 Flash Cyber model and significantly larger frontier models.

Google also evaluated the model against an internal benchmark covering complex codebases across 20 programming languages.

According to the company, the model achieved a success rate above 70% on this internal evaluation.

For security teams, the potential impact is significant.

Instead of relying entirely on manual code reviews and traditional vulnerability scanning, AI systems could help security researchers examine large codebases, identify weaknesses and prioritise issues much faster.

Gemini 3.8 Flash Cyber Can Help Fix Vulnerabilities

Finding a vulnerability is only part of the problem.

Security teams also need to understand the issue, create a safe fix, test the patch and deploy it without breaking the application.

Google says Gemini 3.8 Flash Cyber was specifically developed with vulnerability fixing in mind.

On the CWE-Bench benchmark, Google reports a pass@1 score of 47.2%, compared with 47.8% for a leading frontier model, while highlighting the lower operating cost of its model.

Google is also combining Gemini 3.8 Flash Cyber with its CodeMender system as part of the Fairwind initiative.

The goal is to allow defenders to find, verify and fix vulnerabilities at agentic scale.

That could eventually change how organisations approach software security.

Google Is Already Using the Model

The Gemini 3.8 Flash Cyber announcement is not limited to benchmark results.

Google says its own teams are already using the model to help secure its code.

According to Google, the Chrome Security team found that Gemini 3.8 Flash Cyber produced 2.6 times more correct vulnerability patches in Chrome than the best commercial models tested by the company.

Google also says its Cloud Vulnerability Research team used the model to identify a critical foundational vulnerability in less than two hours, a task the company says would traditionally take months of research and discovery.

These claims are based on Google’s own evaluations and should therefore be viewed in that context, but they demonstrate the direction in which AI-powered cybersecurity is moving.

Why a Dedicated Cyber AI Model Matters

The launch of Gemini 3.8 Flash Cyber points to an important shift in the AI industry.

General-purpose AI models can already write code, analyse systems and assist security researchers. But cybersecurity requires specialised knowledge and careful controls.

A dedicated cyber model can be trained and evaluated specifically around tasks such as:

• Vulnerability discovery
• Secure code analysis
• Patch generation
• Security testing
• Threat detection
• Code verification
• Defensive automation

This specialisation could make AI significantly more useful for security teams.

At the same time, it creates a difficult safety challenge.

A model that becomes better at finding vulnerabilities could potentially make offensive cyber operations easier as well.

Google’s Fairwind Program

Google’s response is to limit access to Gemini 3.8 Flash Cyber through its Fairwind Program.

The programme provides advanced cyber defence tools to trusted partners, including government authorities, critical infrastructure operators and software maintainers.

Google says Fairwind brings together Gemini 3.8 Flash Cyber and CodeMender to help defenders autonomously find, verify and fix vulnerabilities.

Google also says the programme already has more than 650 participating partners globally.

This approach reflects a growing industry debate around access to highly capable AI cybersecurity systems.

Should these models be widely available to developers, or should advanced cyber capabilities be restricted to organisations that can demonstrate a legitimate defensive need?

Google appears to be taking the second approach with Gemini 3.8 Flash Cyber.

Gemini 3.8 Flash Pricing

Gemini 3.8 Flash is launching at the same introductory API price as Gemini 3.7 Flash.

Google lists the introductory price at:

• $0.75 per million input tokens
• $3.75 per million output tokens

These introductory prices are scheduled to remain until December 31, 2026.

From January 1, 2027, Google says the price will increase to $1.50 per million input tokens and $7.50 per million output tokens.

However, lower pricing does not necessarily mean every task will cost less.

Because Gemini 3.8 Flash may use additional reasoning steps and more tokens for difficult tasks, actual costs can depend on how developers configure and use the model.

Gemini 3.8 Flash and the Future of AI Agents

The latest release also highlights Google’s broader strategy around AI agents.

AI agents are increasingly expected to perform complete workflows rather than simply respond to prompts.

For example, an AI coding agent could potentially:

1. Understand a software requirement.
2. Inspect an existing codebase.
3. Identify the required changes.
4. Write new code.
5. Run tests.
6. Detect failures.
7. Modify the implementation.
8. Produce a finished result.

Gemini 3.8 Flash is designed for these longer and more autonomous workflows.

That makes the release relevant not only to AI developers but also to businesses looking at ways to automate software development and knowledge work.

Security Is Becoming a Core AI Capability

The cybersecurity side of the launch may ultimately be just as important as the improvements in coding.

As AI agents become more capable, they will increasingly interact with code, databases, cloud infrastructure and business systems.

That means security cannot remain an afterthought.

AI systems that can identify vulnerabilities and generate patches could become an important part of modern software security.

At the same time, organisations will need strong access controls, human oversight, testing and monitoring before allowing AI agents to make changes to production systems.

Google’s decision to restrict Gemini 3.8 Flash Cyber access shows that the company recognises the risks associated with highly capable cyber AI.

What Gemini 3.8 Means for Developers and Businesses

For developers, Gemini 3.8 Flash represents another step towards autonomous software engineering.

For businesses, the bigger opportunity could be AI agents that handle complex workflows with less human intervention.

For security teams, Gemini 3.8 Flash Cyber demonstrates what specialised AI could eventually bring to vulnerability management.

The combination of faster models, stronger reasoning and agentic capabilities could make AI useful across the entire software lifecycle.

However, organisations should not treat AI-generated code or security fixes as automatically safe.

Human review, automated testing, secure deployment practices and continuous monitoring will remain essential.

Final Thoughts

Gemini 3.8 Flash represents Google’s latest push to make AI faster, more capable and more useful for complex agentic workflows.

But Gemini 3.8 Flash Cyber may be the more interesting development.

By creating a specialised model for vulnerability discovery and automated patching, Google is showing how AI capabilities are becoming increasingly tailored to specific professional domains.

The restricted availability of Gemini 3.8 Flash Cyber also highlights an important reality: as AI becomes more powerful at cybersecurity, access and safety controls become increasingly important.

Google’s latest Gemini release is therefore about more than another AI model upgrade. It points towards a future where AI agents can actively build software, analyse vulnerabilities and help secure the digital systems they operate within.