Google launches Gemini 3.8 Flash Cyber for vulnerability repair

• Google shipped Gemini 3.8 as a broadly available Flash model and a defender-only Flash Cyber variant, in GoogleDeepMind's launch announcement.
• Flash keeps Gemini 3.7 Flash's introductory API price, $0.75 per million input tokens and $3.75 per million output tokens, according to Google's price announcement.
• Flash Cyber posts 86.2% on CyberGym vulnerability discovery and 47.2% pass@1 on CWE-Bench patching, per Google's benchmark post.
• The public model takes smaller steps and verifies work more often, a behavior that can raise token use, as _philschmid's deployment note describes.
• Google says its Chrome security team saw 2.6 times more correct vulnerability patches than with much larger commercial models in GoogleDeepMind's Chrome result.

The Cloud model reference assigns the public model a 1,048,576-token context window and a 65,536-token output cap. Simon Willison's same-day plugin release adds low, medium, and high thinking levels for gemini-3.8-flash, and records an HTML generation that took 13 seconds and cost 1.8 cents.

• Gemini 3.8 Flash is rolling out through Antigravity, the API, Google AI Studio, and Android Studio, as GoogleDeepMind's rollout notice lists.
• Gemini Enterprise, the Gemini app, Search AI Mode, and Gemini in Sheets are additional day-one surfaces in Google's availability list.
• Gemini 3.8 Flash Cyber targets vulnerability detection and automated patching, with applications for Fairwind access in Google's Fairwind application post.
• Flash holds the $0.75-per-million input and $3.75-per-million output introductory rate from 3.7 Flash, in Google's pricing post.
• This is Google's third Flash release in six weeks, according to Google's launch thread.

First-party

• Terminal-Bench 2.1: 85.8% → 89.4%, +3.6 points, in Google's launch comparison.
• HLE-Verified: 53.6% → 54.9%, +1.3 points, in Google's launch comparison.
• OSWorld 2.0: 50.6% → 59.0%, +8.4 points, in Google's launch comparison.
• CyberGym: 83.2% in 3.5 Flash Cyber's five-call CodeMender configuration → 86.2% for 3.8 Flash Cyber, +3.0 points. The 3.5 announcement specifies the earlier harness; the current launch post gives the updated score.

Third-party evaluators

• CWE-Bench pass@1: the cited leading frontier-model result of 47.8% → Flash Cyber's 47.2%, -0.6 points, in Google's account of Collinear's benchmark and Google's benchmark post.

Customer-reported

• Chrome correct-patch yield: leading commercial-model baseline, 1.0x → 2.6x, +160%, in GoogleDeepMind's Chrome result.
• Wiz internal penetration-test recall: baseline → baseline plus 7.5 to 9.7 points, +7.5 to +9.7 points, as Google's field-results post reports.

Google's benchmark chart shows no displayed 3.8-versus-3.7 regression, but the new Flash does not lead every cross-model result. Terminal-Bench 4.0 is 19.1% for Flash versus 51.8% for Claude Opus 5, a 32.7-point gap, while OSWorld 2.0 is 59.0% versus 75.4%, a 16.4-point gap.

Google's migration guide explicitly trades higher accuracy and reliability for higher token consumption relative to 3.7 Flash. It identifies lower thinking levels and 3.7 Flash as compute-efficiency options.

Google describes Flash and Flash Cyber as sharing foundational intelligence, with long-running agentic loops that recursively assess and refine outputs in Google's launch thread. Cyber adds training emphasis for vulnerability discovery and repair in the official launch post.

The public model's ID is gemini-3.8-flash. The Cloud model reference lists thinking, system instructions, structured output, and implicit context caching as supported, while Gemini Live API is not supported.

• Antigravity and Managed Agents use 3.8 Flash as their default model, according to _philschmid's deployment note.
• An app response identified itself as Gemini 3.8 Flash in HCSolakoglu's app screenshot.
• A separate web-interface capture surfaced the same model identity in chetaslua's web screenshot.

Fairwind begins with national cyber authorities and essential-service providers such as telecommunications and energy operators, in GoogleDeepMind's access announcement. Google's program announcement pairs Flash Cyber with CodeMender, limits use to cybersecurity and incident-response employees, and requires multi-factor authentication.

Fixes run within an organization's cloud environment, according to GoogleDeepMind's security thread. Google also reported that its Cloud Vulnerability Research team found a critical foundational vulnerability in under two hours, work it said typically takes months, in Google's field-results post.