⏱️ Lectura: 10 min
Google announced today, September 2, 2026, two new models that share the same core intelligence: Gemini 3.8 Flash and Gemini 3.8 Flash Cyber, the third release in the Flash family in just six weeks. The first improves coding and reasoning with long-horizon agents; the second, reserved for verified defenders through the new Fairwind program, exceeds 70% accuracy detecting vulnerabilities across 20 different programming languages.
📑 En este artículo
The pace of release is as striking as the numbers themselves: Google had already launched Gemini 3.7 Flash just three weeks earlier, and now delivers an update that, according to the company, approaches the performance of pricier frontier models while keeping the same introductory pricing.
TL;DR
- Google launched Gemini 3.8 Flash and Gemini 3.8 Flash Cyber on September 2, 2026, the third Flash release in six weeks.
- Gemini 3.8 Flash costs $0.75 per million input tokens and $3.75 per million output tokens, the same as 3.7 Flash.
- On DeepSWE v1.1, 3.8 Flash outperforms larger frontier models in autonomous software engineering.
- 3.8 Flash scores 54.9% on HLE-Verified, the multi-step reasoning benchmark.
- Gemini 3.8 Flash Cyber exceeds a 70% success rate finding vulnerabilities across 20 languages, according to an internal benchmark.
- On CWE-Bench, Flash Cyber scores 47.2% pass@1 versus 47.8% for the leading frontier model, at a lower cost.
- Flash Cyber is only available to verified defenders via the Fairwind program, with no offensive capabilities.
- The Chrome security team is already using 3.8 Flash Cyber to secure code inside Google.
Introduction
Gemini 3.8 arrives in two variants with the same stated purpose: bringing mid-sized models (the Flash line, built for cost and speed rather than maximum power) closer to the performance of pricier frontier models. The first variant, Gemini 3.8 Flash, is general-purpose: coding, agents, and multi-step reasoning. The second, Gemini 3.8 Flash Cyber, is a cybersecurity-specialized model trained to find vulnerabilities and generate automatic patches.
Both models share the same base intelligence, according to Google’s official announcement, but were fine-tuned for different deployment environments. The shared improvement in coding and reasoning is attributed in part to rigorous training in the cybersecurity domain, a field that demands extreme technical precision.
What happened
On September 2, 2026, Google DeepMind formally announced Gemini 3.8 Flash and Gemini 3.8 Flash Cyber. It’s the third Flash version released in just six weeks, following Gemini 3.7 Flash. According to Google, both models are accelerated by long-horizon agentic loops that recursively evaluate and refine the underlying models during training.
Gemini 3.8 Flash is available immediately at the same introductory price as 3.7 Flash: $0.75 per million input tokens and $3.75 per million output tokens. Gemini 3.8 Flash Cyber, on the other hand, isn’t openly accessible: it’s distributed only to a group of verified defenders through the new Fairwind Program.
Context and background
Gemini’s Flash line was born as the low-cost, low-latency option compared to “Pro” or frontier models, designed for applications that need volume and speed more than maximum possible capability. What stands out in 2026 is the pace: Google went from 3.5 to 3.7 and now to 3.8 Flash within weeks, a sharp contrast to the annual cycles that dominated the LLM market just a couple of years ago.
The “Cyber” branch also has a history: 3.8 Flash Cyber succeeds 3.5 Flash Cyber, which it consistently outperforms in the benchmarks Google published. The decision to split off a dedicated cybersecurity model reflects a broader industry trend: training specialized variants for domains where technical precision is critical and mistakes have real consequences, instead of relying on a single generalist model for everything.
Technical details and performance of Gemini 3.8 Flash Cyber
On DeepSWE v1.1, a long-horizon software engineering benchmark, Gemini 3.8 Flash solves complex problems autonomously and end-to-end, outperforming most pricier frontier models. In specialized knowledge domains like finance and law, the model also beats 3.7 Flash and other frontier models on Vals Finance Agent V2 and Harvey’s Legal Agent Benchmark. In general reasoning, 3.8 Flash reaches 54.9% on HLE-Verified, a multi-step benchmark covering STEM, humanities, and professional fields.
Google explains this improvement with a specific design decision: 3.8 Flash “works harder.” On complex tasks it runs additional reasoning steps and calls tools iteratively, which can increase token consumption at higher effort levels.
💡 Tip: if compute cost is your main constraint, use lower effort levels in the API, or stick with Gemini 3.7 Flash, which Google keeps available for efficiency-focused workloads.
In cybersecurity, Gemini 3.8 Flash Cyber shows a clear leap. On CyberGym, the industry-standard benchmark for autonomous vulnerability discovery, it outperforms both 3.5 Flash Cyber and significantly larger frontier models. Since CyberGym is mostly limited to C/C++ code, Google also evaluated the model against an internal benchmark covering 20 different programming languages, where Gemini 3.8 Flash Cyber exceeds a 70% success rate, a notable leap over previous versions.
On automatic patching, Google’s stated priority, the model is measured against CWE-Bench (operated by Collinear), an external benchmark that evaluates the ability to patch real vulnerabilities classified by Common Weakness Enumeration. There, Flash Cyber lands on the Pareto frontier: 47.2% pass@1 versus 47.8% for the leading frontier model, but at a significantly lower cost.
| Model | Price (input / output per million tokens) | Access | Main focus |
|---|---|---|---|
| Gemini 3.7 Flash | $0.75 / $3.75 | Public (API / AI Studio) | General use, efficiency |
| Gemini 3.8 Flash | $0.75 / $3.75 | Public (API / AI Studio) | Coding and long-horizon agents |
| Gemini 3.8 Flash Cyber | Not published | Restricted (Fairwind Program) | Vulnerability detection and patching |
flowchart TD
A["Code submitted"] --> B["Gemini 3.8 Flash Cyber"]
B --> C["Vulnerability detection"]
C --> D[("Patch generated")]
subgraph Fairwind Program
B
C
endHow to start testing it
Gemini 3.8 Flash (the public variant) is used just like any other Gemini model via the API or Google AI Studio. The official SDK installs with pip, the same way on Windows, macOS, and Linux:
pip install -U google-genaiNext, you need to set the API key as an environment variable. The syntax varies depending on the terminal:
# Windows (PowerShell)
$env:GEMINI_API_KEY="your_api_key"
# macOS / Linux (bash or zsh)
export GEMINI_API_KEY="your_api_key"With that, a minimal call in Python looks like this:
from google import genai
client = genai.Client()
response = client.models.generate_content(
model="gemini-3.8-flash",
contents="Explain what a buffer overflow is in two sentences."
)
print(response.text)This example makes a single text query and returns the response as a string. For a more realistic case, geared toward a code review workflow, calling the REST API directly with curl lets you adjust parameters like temperature:
curl -X POST \n "https://generativelanguage.googleapis.com/v1beta/models/gemini-3.8-flash:generateContent" \n -H "x-goog-api-key: $GEMINI_API_KEY" \n -H "Content-Type: application/json" \n -d '{
"contents": [{
"parts": [{"text": "Review this diff for SQL injection and propose a patch."}]
}],
"generationConfig": { "temperature": 0.2 }
}'This second block sends the diff as plain text inside the contents field and lowers the temperature for more deterministic responses, which is advisable when the goal is a reproducible patch rather than creative text. To confirm which model version responded, just inspect the modelVersion field in the JSON response, or check the model card with a GET request to /v1beta/models/gemini-3.8-flash.
Gemini 3.8 Flash Cyber can’t be invoked this way without prior approval: it requires requesting access to the Fairwind Program, aimed specifically at security teams and verified defenders.
Impact and analysis
The most significant data point isn’t just the accuracy rate, but the priority Google explicitly states: it invested in patching capability from the start and prioritized it over offensive capabilities like exploitation. That’s a design stance, not a minor detail, at a time when several AI labs are competing to dominate both attack and defense in cybersecurity.
Google already reports real internal use: the Chrome security team uses Gemini 3.8 Flash Cyber to secure code inside the company itself, though the announcement doesn’t detail specific figures for that particular case.
📌 Note: Flash Cyber’s restricted access through the Fairwind Program means that, unlike Gemini 3.8 Flash, you can’t just generate an API key and start using it today.
For developers outside the security field, the most tangible part is Gemini 3.8 Flash applied to Google Antigravity: Google shows demos built with a single prompt, from a 3D game with textures generated by Nano Banana to a playable version of Google Maps with a DOS aesthetic, complete with working addresses and Street View. These are product examples, not formal benchmarks, but they illustrate the type of “multi-step, tool-using” task Google says the model improved at.
The honest limitation is right there in Google’s own announcement: on complex tasks, the model can use more tokens to maximize performance, especially at higher effort levels. That means the cost savings compared to frontier models aren’t automatic: it depends on how you configure the effort level on each call, and for workloads where compute efficiency is what matters most, Google directly recommends sticking with 3.7 Flash.
What’s next
Google hasn’t announced a public opening date for Flash Cyber beyond the Fairwind Program, so for now it remains a restricted-access tool. It’s reasonable to expect the company to gradually expand the program to more security organizations, following the same pattern other labs have been applying with models fine-tuned for cyberdefense. The release pace (three Flash versions in six weeks) also suggests Gemini 3.9 could arrive before the end of the year if Google keeps up the cadence.
📖 Summary on Telegram: View summary
Try it yourself: run pip install -U google-genai today and make your first call to gemini-3.8-flash with your Google AI Studio account key.
Frequently Asked Questions
What’s the difference between Gemini 3.8 Flash and Gemini 3.8 Flash Cyber?
3.8 Flash is the general-purpose model for coding and agents; Flash Cyber shares the same core but was trained specifically to find and patch vulnerabilities, and is only available to verified defenders through the Fairwind program.
How much does it cost to use Gemini 3.8 Flash?
Google keeps the introductory price of 3.7 Flash: $0.75 per million input tokens and $3.75 per million output tokens.
Can I access Gemini 3.8 Flash Cyber?
Not openly. Google distributes it through the Fairwind Program, aimed at security teams and verified defenders, prioritizing defense over offensive capabilities.
What is DeepSWE v1.1?
It’s a long-horizon software engineering benchmark that evaluates whether a model can solve complex tasks autonomously, end-to-end, comparing it against pricier frontier models.
What is CWE-Bench?
An external benchmark, operated by Collinear, that measures a model’s ability to patch real vulnerabilities classified by Common Weakness Enumeration (CWE).
Does Gemini 3.8 Flash replace Gemini 3.7 Flash?
No. Google keeps 3.7 Flash available for workloads where compute efficiency is the priority, while 3.8 Flash targets tasks that require more reasoning steps and tool use.
References
- Google Blog: official announcement of Gemini 3.8 Flash and 3.8 Flash Cyber.
- Gemini API Docs: official documentation for integrating Gemini models via API.
- Google DeepMind: the lab responsible for developing the Gemini family of models.
📱 Like this content? Follow @programacion on Telegram for daily tech content in Spanish: quick summaries, fresh content every day.
Imagen destacada: Foto de Jefferson Santos en Unsplash
0 Comments