On Wednesday, Google announced two variants of its new Gemini 3.8 Flash: a standard Flash "workhorse" model tuned for agentic tasks, software development, and multi-step reasoning, and Flash Cyber, optimized for vulnerability discovery and automated patching.
Improvements in 3.8 Flash
Google CEO Sundar Pichai said in an X post that 3.8 Flash delivers "significant leaps" over 3.7 Flash in software engineering, agentic tasks, and multi-step reasoning. For example, Google reported that the model outperformed many large frontier models on the DeepSWE coding benchmark at a much lower cost.
Google evaluated 3.8 Flash across numerous benchmarks covering coding, multimodal capabilities, computer use, long-context and knowledge work, and scientific reasoning. The company says the model also performs well in specialized knowledge domains that require deeper analysis and reporting: it beat its predecessor and some frontier models on finance and legal benchmarks (Vals Finance Agent V2 and Harvey's Legal Agent Benchmark, respectively). On the Humanity’s Last Exam (HLE)-Verified benchmark the model scored 54.9%, reflecting its multi-step reasoning ability across subjects such as math, science, and the humanities.
Token windows, multimodality and behavior
3.8 Flash supports a 1 million-token input window and a 64K-token output limit, and can ingest text, images, audio, video, and PDF files. Google senior product director Tulsee Doshi and Gemini security lead Raluca Ada Popa wrote that 3.8 Flash "works harder" and shows "greater diligence" on complex tasks by executing extra reasoning steps, though this may sometimes use more tokens to maximize performance.
Google shared examples including a game built from a simple prompt using looping techniques on the Antigravity platform, a fully-functional DOS-style Google Maps with interactive locations and street views, a 3D visualizer that decomposes devices into inspectable layers, and topographic maps generated from U.S. Geological Survey datasets with real-time cross-sections and scientific explanations.
Arena.ai ranked 3.8 Flash No. 14 in Agent Arena (above DeepSeek-V4-Pro) and noted a significant jump from Gemini 3.7 Flash (No. 32). The model debuted at No. 7 in Text Arena, ahead of Claude Opus 5 and Gemini 3.7 Flash. Improvements over 3.7 Flash were reported in multi-turn requests, writing and literature, longer queries, hard prompts, coding, instruction following, software and IT services, and business, management and financial operations.
Pricing and availability
3.8 Flash is available now in Gemini Enterprise; developers can access it via the Gemini API through Google AI Studio, Google Antigravity, Android Studio, or generate UIs in Stitch. Introductory pricing matches Gemini 3.7 Flash: $0.75 per million input tokens and $3.75 per million output tokens. Users can customize the model's effort levels to balance quality, cost, and latency, or continue using 3.7 Flash for efficiency-first workloads, which Google continues to fully support.
Flash Cyber: focused on defense
Pichai described Flash Cyber as Google’s "most capable" cybersecurity model. The model achieved 86.2% on the CyberGym cybersecurity benchmark and 47.2% on CWE-Bench, which evaluates AI patching abilities. In an internal Google benchmark, Flash Cyber achieved more than a 70% success rate discovering vulnerabilities across 20 programming languages.
Flash Cyber is initially being rolled out to "trusted defenders" through Google’s Fairwind Program, which prioritizes government authorities, critical-infrastructure operators, and other partners seeking advanced cyber defense capabilities; organizations can apply for access. Google says the version underwent "rigorous training" in the cybersecurity domain and represents a "significant leap in prompt injection robustness." The company also says it prioritized vulnerability fixing over offensive capabilities like exploitation.
Because the Flash Cyber release ships with a more permissive set of mitigations for cybersecurity safeguards, Google is sharing it only with limited partners for now and has built protections against misuse in cyber offense and in sensitive domains such as chemical, biological, radiological, and nuclear (CBRN).
Real-world results and internal use
Google reports that it is already using 3.8 Flash Cyber to secure its own code: the model produced 2.6 times more correct patches for Chrome vulnerabilities compared with much larger commercial models. Wiz — which Google acquired earlier this year in a $32 billion deal — reported that 3.8 Flash Cyber achieved 7.5% to 9.7% higher recall of real-world vulnerabilities on an internal penetration testing benchmark at 2.3 to 5.2 times lower cost than leading frontier models. Google’s Cloud Vulnerability Research also found a critical foundational vulnerability in under two hours using 3.8 Flash Cyber; Google says the same discovery would typically take months.
Google researchers warn that AI agents are "incredibly skilled" at finding and exploiting vulnerabilities while defenders are overwhelmed scanning large codebases because scanning with big AI models is expensive. As Raluca Ada Popa noted, attackers need only find one significant flaw among millions of lines of code; defenders must remove every flaw to protect software.
Doug Turner, engineering director for Chrome, described a recent "vulnerability apocalypse" as generative AI led to a sharp increase in reported software vulnerabilities. He recounted that 3.8 Flash Cyber discovered a subtle bug that had existed in Chromium and Chrome for 13 years — an issue dozens or hundreds of engineers had reviewed without flagging. Turner said Gemini 3.8 Flash Cyber will help produce better suggested fixes and make developers' lives easier.
Emphasis on defense over offense
Google frames the Gemini 3.8 Flash releases as tools to strengthen defenders' capabilities rather than amplify offensive use. By making Flash Cyber initially available only to vetted partners and embedding safeguards, Google aims to provide advanced automated discovery and patching while limiting the risk of malicious misuse.
