Google officially released Gemini 3.8 Flash early this morning (September 2, US time), just three weeks after the previous-generation 3.7 Flash, marking the third Flash model version Google has launched within six weeks. The release includes two variants: the general-purpose Gemini 3.8 Flash and the Gemini 3.8 Flash Cyber, designed specifically for cybersecurity defense. Google stated that 3.8 Flash is currently its smartest general-purpose workhorse model, with significant improvements in software engineering, agentic workflows, and multi-step reasoning, while maintaining the same speed and cost as 3.7 Flash.
Gemini 3.8 Flash performance: DeepSWE 73.7%, surpassing most larger frontier models.
Gemini 3.8 Flash demonstrates performance approaching that of high-cost frontier models across multiple benchmarks. In the DeepSWE v1.1 (long-horizon software engineering) test, 3.8 Flash scored 73.7%, surpassing most larger frontier models and autonomously solving complex end-to-end engineering problems at extremely low cost.
In quantitative and professional fields that require specialized analysis and reporting, 3.8 Flash also performs impressively. In tests such as Vals Finance Agent V2 and Harvey’s Legal Agent Benchmark, 3.8 Flash surpassed 3.7 Flash and other frontier models. In the HLE-Verified multi-step reasoning test, 3.8 Flash reached 54.9%, covering STEM, humanities, and professional fields.
These performance gains stem from a core design choice: 3.8 Flash demonstrates greater diligence on complex tasks, executing additional reasoning steps and iteratively calling tools. Google also acknowledged that the model may use more tokens at higher effort levels to maximize performance. For applications where computational efficiency is the top priority, developers can use lower effort levels or continue using 3.7 Flash.
Gemini 3.8 Flash Cyber: Built for security defenders
Another highlight of this release is Gemini 3.8 Flash Cyber, Google’s most powerful security-specific model, designed specifically for vulnerability detection and automated patching. On CyberGym, the standard industry benchmark for vulnerability discovery, 3.8 Flash Cyber achieved 86.2%, demonstrating cutting-edge autonomous vulnerability discovery capabilities. In Google’s internal comprehensive tests covering 20 programming languages, the success rate exceeded 70%.
In automatic patching, 3.8 Flash Cyber achieved a pass@1 score of 47.2% on the CWE-Bench test, comparable to the 47.8% of leading frontier models, but at significantly lower cost.
Google internal testing shows: Chrome team’s patching efficiency improved 2.6-fold.
Google has extensively used 3.8 Flash Cyber internally to enhance code security. According to the official benchmark results:
- Chrome Security Team3.8 Flash Cyber was found to produce 2.6 times as many correct vulnerability patches as other larger commercial models.
- Google Cloud Vulnerability Research TeamUsing 3.8 Flash Cyber, a critical infrastructure vulnerability was discovered in less than 2 hours—research and discovery that typically takes months.
- Wiz
Fairwind Program: Access Restriction Mechanism for the Dedicated Information Security Model
Gemini 3.8 Flash Cyber is not available to everyone. Google also launched the “Fairwind Program,” a restricted access program offered only to government agencies, critical infrastructure operators, and cybersecurity partners. More than 650 partners worldwide have already joined the program. Google combines 3.8 Flash Cyber with its own CodeMender tool, allowing defenders to autonomously discover and patch vulnerabilities in a secure cloud environment, cutting manual patching processes that once took weeks down to minutes.
Google emphasized that 3.8 Flash Cyber was designed to give defenders an advantage, not to enhance offensive capabilities. The model has safety guardrails in areas such as chemical, biological, radiological, and nuclear (CBRN) as well as cyber attacks, while the Cyber version provides broader permission settings for security scenarios, so it is restricted to trusted defenders only.
Pricing and How to Obtain
Google has chosen the exact same price tier as 3.7 Flash for its pricing strategy, meaning developers can get better model performance without increasing costs. Compared to other frontier models that often charge tens of dollars per token, the pricing advantage of 3.8 Flash is quite clear, and this also reflects the “high efficiency, low cost” technical approach Google has consistently maintained across the Flash series.
Gemini 3.8 Flash maintains the same launch promotional price as 3.7 Flash: $0.75 USD per million input tokens and $3.75 USD per million output tokens (approximately NT$24 and NT$122). This promotional price is valid until December 31, 2026.
The method of acquisition is as follows:
- developer：Google Antigravity、Google AI Studio、Android Studio[8]
- Enterprise users：Gemini Enterprise
- ConsumerGoogle AI Pro and Ultra subscribers can use it in the Gemini app, Search AI Mode, and Google Sheets.
- Cybersecurity defender.Apply for 3.8 Flash Cyber access through the Fairwind Program[9]
Technical core: iterative reasoning driven by long-cycle Agent loops
Google specifically emphasized in its official blog that the performance improvements in 3.8 Flash come from the technical approach of “long-running agentic loops.” This is a mechanism that allows the model to autonomously execute multiple rounds of reasoning, evaluation, and correction when handling complex tasks. In simple terms, 3.8 Flash doesn’t just “answer questions”—it repeatedly reviews and refines its own output, much like a human engineer would.
This design also comes with a trade-off: at high effort levels, 3.8 Flash may consume more tokens in exchange for higher accuracy. For cost-sensitive use cases, Google recommends developers use a lower effort level or continue adopting 3.7 Flash as an efficiency-first option.
In terms of security, Google said the 3.8 model has made significant advances in prompt injection defense, showing stronger defensive capabilities in Gray Swan tests and more effectively protecting users from malicious prompt injection attacks.
Conclusion
Google’s release of three Flash versions within six weeks highlights the intense competition in the current AI model landscape. The 3.8 Flash pushes reasoning and coding capabilities closer to frontier model levels while maintaining low costs, making it practically appealing to enterprises that need to deploy AI agents at scale. The 3.8 Flash Cyber, meanwhile, represents Google’s strategic positioning in AI cybersecurity—using the Fairwind Program to concentrate the strongest security AI capabilities in the hands of trusted defenders rather than opening them up without restriction.