Introducing Gemini 3.8 Flash and 3.8 Flash Cyber

2026-09-03 · Google DeepMind

Release Overview

Building on the momentum of 3.7 Flash from three weeks ago — and marking the third Flash release in only six weeks — Google today introduced Gemini 3.8, described as its best reasoning and coding model yet, delivered at the same speed and low cost of 3.7. Gemini 3.8 comes in two variants:

  • Gemini 3.8 Flash: the most intelligent workhorse model, delivering significant improvements over 3.7 Flash across software engineering, agentic tasks, and critical multi-step reasoning in specialized domains. It is available at the same introductory price as 3.7 Flash: $0.75 per million input tokens and $3.75 per million output tokens.
  • Gemini 3.8 Flash Cyber: the most capable cybersecurity model, with frontier-level performance in vulnerability detection and automated patching, available to trusted defenders through the new Fairwind Program.

While tailored for different deployment environments, both releases are powered by the same foundational intelligence, further accelerated by long-running agentic loops designed to recursively evaluate and refine the underlying models. The coding and reasoning gains across this shared core were driven by several innovations, including rigorous training in the highly demanding domain of cybersecurity.

Gemini 3.8 Flash: Built for Long-Horizon Coding and Autonomous Agents

Gemini 3.8 Flash delivers substantial gains over 3.7 Flash, often approaching the performance of higher-cost frontier models.

  • On DeepSWE v1.1 (Long-Horizon Software Engineering), 3.8 Flash outperforms most larger frontier models in autonomously solving complex engineering problems end to end — at a fraction of the cost.
  • In quantitative and professional fields requiring advanced analysis and reporting, it outperforms 3.7 Flash and other frontier models on benchmarks such as Vals Finance Agent V2 and Harvey's Legal Agent Benchmark.
  • It achieves 54.9% on HLE-Verified, demonstrating multi-step reasoning across STEM, humanities, and professional fields.

These gains stem from a core design choice: 3.8 Flash works harder. On complex tasks, it exhibits greater diligence — executing extra reasoning steps and calling tools iteratively. At times, the model may use more tokens to maximize performance, especially at higher effort levels.

For applications where compute efficiency is the primary constraint, developers can use lower effort levels to minimize token overhead, or continue relying on Gemini 3.7 Flash, which remains fully supported for efficiency-first workloads.

Demo Applications

  • 3D game: Built with a simple prompt using a looping instruction in Google Antigravity, the game uses puzzles, environmental storytelling, and textures generated with Nano Banana to create an immersive 3D level in which you play a wizard navigating a castle.
  • DOS Google Maps: A fully functional DOS version of Google Maps built in a single prompt in Antigravity, fully playable with locations, directions, and Street View.
  • Topographic map: Realtime cross-sections, 2D projections, and scientific explanations of famous geographical sites, built using real datasets from the U.S. Geological Survey.
  • Hardware Anatomy: An interactive 3D visualizer built in Google AI Studio that generates realistic Three.js renderings of physically-proportioned hardware teardowns, automatically decomposing devices into layers you can explode and inspect with a deconstruction slider.

Gemini 3.8 Flash Cyber: Expert Cyber Performance

Available to trusted defenders via the Fairwind Program, 3.8 Flash Cyber provides a decisive advantage in today's complex cybersecurity landscape, with Flash speed and cost enabling quick iteration.

Autonomous Vulnerability Discovery

  • On CyberGym, the standard industry benchmark for finding vulnerabilities, the model demonstrates frontier-level performance, surpassing both 3.5 Flash Cyber and significantly larger frontier models.
  • Because real-world defensive needs go beyond the C/C++ codebases covered by CyberGym, Google also evaluated the model on a comprehensive internal benchmark requiring vulnerability discovery across complex codebases spanning 20 programming languages. There, it showed an impressive leap over previous models, reaching a success rate exceeding 70%.

Automated Patching

Google focused specifically on equipping defenders with expert capabilities that give them an advantage over attackers — investing in vulnerability fixing from the start and prioritizing it over offensive capabilities like exploitation.

On CWE-Bench, a challenging external patching benchmark run by Collinear, 3.8 Flash Cyber sits on the Pareto frontier: a pass@1 of 47.2%, compared to 47.8% for a leading frontier model — yet offered at a significantly lower cost.

Real-World Impact: Securing Google's Code

Gemini 3.8 Flash Cyber is already being used to secure code across Google:

  • The Chrome Security team found that 3.8 Flash Cyber produced 2.6 times more correct patches for Chrome vulnerabilities than the best — and much larger — commercial models.
  • Wiz found that Gemini 3.8 Flash Cyber achieves +7.5–9.7% higher recall on their internal penetration testing benchmark (source text ends here).

Source