Google Launches Gemini 3.8 Flash and 3.8 Flash Cyber

Google has launched Gemini 3.8 Flash and Gemini 3.8 Flash Cyber, introducing what it calls its best reasoning and coding model yet alongside a cybersecurity variant for trusted defenders. The announcement marks Google's third Flash release in six weeks, according to the company.



The models arrive three weeks after Gemini 3.7 Flash and share the same underlying intelligence. Google says their coding and reasoning improvements were driven in part by rigorous cybersecurity training and longer-running agentic loops.


Gemini 3.8 Flash keeps the introductory pricing of 3.7 Flash at $0.75 per million input tokens and $3.75 per million output tokens. Described as Google's most intelligent workhorse model, it improves on its predecessor across software engineering, agentic tasks, and complex multi-step reasoning.

On DeepSWE v1.1, a benchmark for long-horizon software engineering, 3.8 Flash outperforms most larger frontier models at a fraction of the cost, according to Google. It also beats 3.7 Flash and other frontier models on Vals Finance Agent V2 and Harvey's Legal Agent Benchmark, while scoring 54.9 percent on HLE-Verified for multi-step reasoning across STEM, humanities, and professional fields.

Those gains come in part from having the model "work harder" on complex tasks, performing additional reasoning steps and calling tools iteratively. That can increase token usage, particularly at higher effort levels. Developers prioritizing compute efficiency can lower the effort setting or continue using 3.7 Flash, which remains fully supported.

Gemini 3.8 Flash Cyber brings the same underlying intelligence to vulnerability discovery and automated patching, with access restricted to trusted defenders through Google's new Fairwind Program. On CyberGym, a benchmark for vulnerability discovery, it surpasses both 3.5 Flash Cyber and significantly larger frontier models, according to Google. The model also achieved a success rate above 70 percent on an internal benchmark covering vulnerabilities across 20 programming languages.


For automated patching, 3.8 Flash Cyber scored 47.2 percent pass@1 on Collinear's CWE-Bench, compared with 47.8 percent for a leading frontier model, while Google says its model is offered at a significantly lower cost. The company says vulnerability fixing was prioritized over offensive capabilities such as exploitation during development.

Google is already deploying 3.8 Flash Cyber internally. Its Chrome Security team found that the model produced 2.6 times more correct patches for Chrome vulnerabilities than the best commercial models it evaluated. Wiz reported 7.5 to 9.7 percent higher recall on its internal penetration-testing benchmark at 2.3 to 5.2 times lower cost than other leading frontier models. Meanwhile, Google's Cloud Vulnerability Research team used the model to find a critical foundational vulnerability in less than two hours, in an area where research and discovery usually takes months.

Gemini 3.8 Flash includes safeguards against misuse involving chemical, biological, radiological, and nuclear threats and cyber offense under Google's Frontier Safety Framework. Flash Cyber uses more permissive cybersecurity mitigations, requiring Google to restrict access to trusted defenders. The company also reports significantly improved prompt injection robustness across the Gemini 3.8 models in testing by Gray Swan.

Developers can access 3.8 Flash through Google Antigravity, the Gemini API via Google AI Studio and Android Studio, and Stitch. It is also available through Gemini Enterprise and to Google AI Pro and Ultra subscribers in the Gemini app, AI Mode in Google Search, and Gemini in Google Sheets. Trusted government authorities, critical infrastructure operators, and software maintainers can apply for 3.8 Flash Cyber access through the Fairwind Program.