Google Launches Gemini 3.8 Flash and 3.8 Flash Cyber: Frontier-Level Coding at 3.7 Prices, a Cyber Model Behind the Fairwind Gate

On September 2, 2026, Google launched Gemini 3.8 Flash, its third Flash release in six weeks following 3.7 Flash, positioning it as its best reasoning and coding model yet at 3.7’s speed and price. The more consequential half of the announcement is its sibling: Gemini 3.8 Flash Cyber, Google’s most capable model for vulnerability discovery and automated patching, which will not be sold to everyone. Access runs exclusively through the new, limited Fairwind Program for trusted defenders.

The Core Model: “Works Harder”

The stated design idea behind the 3.8 jump: the model works harder, taking extra reasoning steps and iterative tool-calling on complex tasks, even at the cost of more tokens at higher effort levels. If compute is the constraint, lower effort levels trim token overhead, and 3.7 Flash remains fully supported for efficiency-first workloads.

The disclosed numbers from Google:

DeepSWE v1.1 (long-horizon software engineering): 3.8 Flash outperforms most larger frontier models in autonomously solving complex engineering problems end to end, at a fraction of the cost.
HLE-Verified: 54.9% on multi-step reasoning across STEM, humanities, and professional domains.
Vals Finance Agent V2 and Harvey’s Legal Agent Benchmark: outperforms 3.7 Flash and other frontier models on professional financial and legal analysis.

The launch demos telegraph the positioning: a full 3D game built from a single prompt in Google Antigravity, a playable DOS version of Google Maps, and interactive topographic cross-sections built on real USGS datasets.

Pricing: Introductory Through Year-End

The introductory price is $0.75 per million input tokens and $3.75 per million output, identical to 3.7’s introductory rate. The planning-relevant catch: it expires December 31, 2026, after which the price becomes $1.50/$7.50 starting January 1, 2027, which doubles both rates. The model is generally available now in Google AI Studio and the Gemini Enterprise Agent Platform as gemini-3.8-flash, plus Antigravity, Android Studio, Stitch, and the Gemini app for AI Pro/Ultra subscribers (see our earlier frontier API pricing guide for the broader picture).

3.8 Flash Cyber: Cyber Capability Behind a Credential Gate

This is where the story intersects with OpenAI’s Astra announcement a day earlier: frontier cyber capability is no longer being shipped to the public.

Comparison: Gemini 3.8 Flash vs Gemini 3.8 Flash Cyber

Capability / Dimension	Gemini 3.8 Flash	Gemini 3.8 Flash Cyber
Primary Domain	General reasoning, coding, autonomous agents	Autonomous vulnerability discovery & auto-patching
Distribution / Access	Public API, AI Studio, Antigravity, Android Studio	Restricted exclusively to Fairwind Program participants
Cyber Mitigations	Strict standard refusals on cyber exploits	Permissive defensive mitigation set for security tooling
Benchmark Performance	54.9% HLE-Verified; outpaces larger models on SWE	>70% discovery across 20 languages; 47.2% CWE-Bench
Pricing Model	$0.75 / $3.75 per MTok ($1.50 / $7.50 in 2027)	Enterprise credentialed pricing / contract-gated

Google Fairwind Defensive Vulnerability Pipeline

1. Codebase Ingestion Multi-Language Code

Defender passes enterprise repository or platform binary into isolated analysis harness.

2. Gemini 3.8 Flash Cyber Fairwind Model

Autonomous vulnerability hunting achieves >70% detection across 20 languages with deep semantic reasoning.

Candidate Vulnerability Identified

3. Automated Remediation & Patch Verification 47.2% CWE-Bench Pass@1

Synthesizes functional security patch, verifies regression suite passes, and outputs git diff for human approval.

Gemini 3.8 Flash Cyber shares the same foundational intelligence but ships with a deliberately more permissive mitigation set in the cyber domain. This is precisely why it is gated behind the Fairwind Program, open to governments and national cyber authorities, critical infrastructure operators, and core technology platforms and software maintainers. The disclosed numbers:

CyberGym: frontier-level autonomous vulnerability discovery, surpassing 3.5 Flash Cyber as well as significantly larger frontier models.
An internal benchmark spanning 20 programming languages: a success rate exceeding 70% discovering real-world vulnerabilities across complex codebases.
CWE-Bench (run by Collinear) for automated patching: 47.2% pass@1 versus 47.8% for a leading frontier model, sitting on the Pareto frontier at a much lower cost.

Beyond benchmarks, Google disclosed internal production use: Chrome Security found the model produced 2.6× more correct patches for Chrome vulnerabilities than the best, much larger commercial models; Wiz measured +7.5–9.7% higher recall on their internal pentesting benchmark at 2.3–5.2× lower cost; and Google’s Cloud Vulnerability Research team found a critical foundational vulnerability in under 2 hours, work that normally takes months.

Safety: One Thread Ties Both Releases

Both models ship with safeguards under Google’s Frontier Safety Framework covering CBRN and cyber offense, plus a disclosed jump in prompt-injection robustness on Gray Swan’s benchmarks, directly relevant if you build agents that read untrusted web content. The difference: Cyber carries a more permissive mitigation set by design, and that is exactly why it sits behind Fairwind.

What Developers Should Do Now

Migrating to 3.8 Flash is nearly free in 2026, but budget 2027 against the doubled price ($1.50/$7.50), and watch effort levels, because the extra “diligence” shows up as a token bill on complex tasks.
Stay on 3.7 Flash for cost-sensitive workloads; Google explicitly committed to continuing support.
Advanced cyber capability is no longer buy-on-demand: if your organization relies on model-driven vuln discovery, start Fairwind paperwork early: limited programs fill rapidly.
For security teams concretely: CWE-Bench numbers and the “critical vuln found in 2 hours” datapoint indicate model-assisted patching is maturing from research curiosity into operational tooling. Plan its place in your defense pipeline as an accelerator rather than a replacement for your security team.

Python SDK (google-genai)

from google import genai

client = genai.Client()

response = client.models.generate_content(
    model="gemini-3.8-flash",
    contents="Refactor the authentication middleware to use constant-time token comparison.",
    config={
        "thinking_config": {
            "thinking_budget": 4096
        },
        "temperature": 0.2
    }
)

print(response.text)

The Takeaway

On its own, 3.8 Flash is an excellent routine upgrade: more intelligence at the same price, a trade everyone understands. The strategic news is the sibling: with Fairwind, Google formally joins the access-gated cyber-model era that OpenAI’s Astra and Anthropic’s Mythos are shaping. If you build defensive tooling, get used to a new idea: the capability is coming, but with a credential key.