Google Launches Gemini 3.8 Flash and Cyber Model
Google pairs a broadly available agent model with a restricted cyber variant built for vulnerability discovery and automated patching.
One core model, two access tiers
Google released Gemini 3.8 Flash, a production model aimed at coding, professional analysis and long-running agent workflows, alongside Gemini 3.8 Flash Cyber, a security-specialized version reserved for vetted defenders. The general model is available through the Gemini API, AI Studio, Gemini Enterprise, Google Search’s AI Mode, Sheets and paid Gemini plans. It supports multimodal input, a one-million-token context window and up to 64,000 output tokens.
Google kept the introductory API price at $0.75 per million input tokens and $3.75 per million output tokens, matching Gemini 3.7 Flash. That rate expires after December 31, when both prices are scheduled to double. Google also cautions that the model may consume more tokens on difficult work because higher effort settings trigger additional reasoning and tool calls.
Cyber capability reaches deployment
The restricted Cyber variant uses the same underlying intelligence but has more permissive security controls for defensive work. Google says it exceeded a 70% success rate on an internal vulnerability-discovery test spanning 20 programming languages and scored 47.2% pass@1 on the external CWE-Bench patching benchmark. Chrome’s security team reported 2.6 times as many correct patches as it obtained from larger commercial models. In another internal deployment, the model reportedly identified a critical foundational vulnerability in under two hours.
Access is being managed through Google’s new Fairwind Program, initially serving national cyber authorities, critical-infrastructure operators and software maintainers. This separates a mass-market agent model from a more capable security configuration whose offensive potential requires tighter distribution.
The release matters because Google is putting frontier-adjacent reasoning into its high-volume Flash tier while simultaneously demonstrating why model access may increasingly depend on the task, customer and safeguards. The scheduled price increase and potentially higher token use, however, mean developers must validate total task cost rather than rely on the headline API rate.