Google introduced Gemini 3.8 Flash on September 2 for coding, agentic workflows and multi-step reasoning, alongside Gemini 3.8 Flash Cyber for vulnerability discovery and automated patching. The standard model is available through Google’s developer, enterprise and consumer services, while access to Cyber is restricted to trusted defenders through the new Fairwind Program.
Gemini 3.8 Flash builds on 3.7 Flash and initially retains its pricing: $0.75 per million input tokens and $3.75 per million output tokens. That introductory rate expires on December 31, 2026. From January 1, 2027, Google says prices will rise to $1.50 and $7.50 per million input and output tokens, respectively.
Google attributes the model’s gains to a design that can perform additional reasoning steps and call tools iteratively on complex assignments. This may increase token consumption, particularly at higher effort levels. For workloads where compute efficiency takes priority, the company suggests selecting a lower effort level or continuing to use the fully supported Gemini 3.7 Flash.
The company reports improvements across software engineering, autonomous agents, finance, law and other specialized fields. Gemini 3.8 Flash scored 54.9% on HLE-Verified, according to Google. That figure is a developer-published benchmark result for the stated test rather than a measure of performance in every production workflow.
For Gemini 3.8 Flash Cyber, Google reports a success rate above 70% on an internal vulnerability-discovery benchmark covering complex codebases in 20 programming languages. On the external CWE-Bench patching benchmark, the model recorded 47.2% pass@1, compared with 47.8% for what Google described as a leading frontier model. These results apply to the specified evaluations and do not establish performance across all infrastructures.
Google also cites deployments by its own teams and partners. It says Chrome Security obtained 2.6 times more correct vulnerability patches than from larger commercial models. Wiz reported 7.5% to 9.7% higher recall on its internal penetration-testing benchmark at 2.3 to 5.2 times lower cost than other leading frontier models. The announcement does not provide an independent reproduction of these participant-reported results.
Practical context: The release separates a broadly available development model from more sensitive cybersecurity capabilities distributed through controlled access. Teams evaluating Flash for agentic workflows should account for both task quality and token use at different effort levels. For Cyber, proposed patches should have defined reviewers and pass the organization’s normal testing process before deployment.
| Version | Availability | Price or access condition |
|---|---|---|
| Gemini 3.8 Flash | Developers, enterprises, and subscribers to specified Google services | Through December 31, 2026: $0.75 per million input tokens and $3.75 per million output tokens |
| Gemini 3.8 Flash Cyber | Trusted defenders through the Fairwind Program | Prioritized access for government authorities, critical-infrastructure operators, and software maintainers |
Cyber access is restricted
Google says Gemini 3.8 Flash Cyber uses a more permissive set of cybersecurity mitigations. It is therefore available only to trusted defenders requiring more comprehensive cyber capabilities.
Sources
Event date: 2026-09-02. Primary source date: 2026-09-02.
