Google shipped Gemini 3.8 Flash and 3.8 Flash Cyber yesterday—two variants of the same foundational model, tuned for different deployment contexts. The headline: frontier-level reasoning and coding performance at the speed and cost of a Flash model.
What Changed: 3.8 Flash vs 3.7 Flash
Same price, measurably harder work. 3.8 Flash stays at $0.75 per million input tokens and $3.75 per million output tokens (introductory pricing through December 31, 2026; then $1.50/$7.50). But internally, the model executes more reasoning steps and makes iterative tool calls on complex tasks—it "works harder" in Google's phrasing.
On DeepSWE v1.1 (long-horizon software engineering), 3.8 Flash outperforms most larger frontier models in autonomously solving complex problems end-to-end. On Vals Finance Agent V2 and Harvey's Legal Agent Benchmark, it beats 3.7 Flash and other frontier models. It achieves 54.9% on HLE-Verified, demonstrating multi-step reasoning across STEM, humanities, and professional domains.
For developers where compute efficiency is the primary constraint, Google says you can use lower effort levels to minimize token overhead, or stick with 3.7 Flash.
Gemini 3.8 Flash Cyber: Frontier Vulnerability Detection
3.8 Flash Cyber is the specialized security variant, available only through Google's new Fairwind Program (limited to trusted government authorities, critical infrastructure operators, and software maintainers). It's trained heavily on cybersecurity and ships with weaker safeguards around cyber offense—a tradeoff Google made intentionally to favor defensive capabilities.
On CyberGym (the standard industry benchmark for vulnerability discovery), 3.8 Flash Cyber surpasses 3.5 Flash Cyber and larger frontier models. On an internal benchmark covering 20 programming languages, the model achieves a success rate exceeding 70% in discovering vulnerabilities across complex codebases.
For patching (the harder problem), 3.8 Flash Cyber achieves 47.2% pass@1 on CWE-Bench, matching a leading frontier model at 47.8% but at significantly lower cost—putting it on the Pareto frontier for cost-per-rollout.
Real Impact: Numbers from Google's Internal Use
Google is already running 3.8 Flash Cyber at scale:
- Chrome Security: 3.8 Flash Cyber produced 2.6× more correct patches than leading commercial models—models much larger than Flash.
- Wiz partnership: +7.5–9.7% higher recall on Wiz's internal penetration testing benchmark, at 2.3–5.2× lower cost vs other frontier models.
- Google Cloud Vulnerability Research: Found a critical foundational vulnerability in less than 2 hours using 3.8 Flash Cyber; similar research normally takes months.
Where to Use It
Gemini 3.8 Flash is live across:
- Google AI Studio (web)
- Android Studio (IDE integration)
- Stitch (UI generation)
- Gemini API docs: https://ai.google.dev/gemini-api/docs/latest-model
- Gemini Enterprise console (Google Cloud)
- Google AI Pro/Ultra subscribers (Gemini app, Google Search, Google Sheets)
Gemini 3.8 Flash Cyber requires Fairwind Program enrollment. Apply at: https://deepmind.google/fairwind-program/
The Catch: Token Overhead
3.8 Flash's extra reasoning steps mean higher token consumption on complex tasks. Google doesn't publish exact overhead, but the implication is clear—for latency-sensitive applications where you can't afford the reasoning time, 3.7 Flash remains the choice. For agentic workflows where the model's ability to iterate and refine matters more than raw speed, 3.8 Flash shifts the calculus.
Prompt injection robustness also improved measurably: 3.8 Flash shows a significant leap on the Gray Swan benchmark, protecting against prompt-injection attacks.
Why It Matters
The pricing stays flat while reasoning capability jumps. That's the opposite of most model releases—usually you pay more for better reasoning. 3.8 Flash lets you keep your inference budget flat while deploying agents that can handle longer, more complex reasoning chains. For coding and vulnerability detection, that's a direct win on economics. The Cyber variant signals Google's intent to move security tooling out of pure offense-defense dynamics and into defender-favoring territory, with metrics to back it.