Google Releases Gemini 3.8 Flash and a Cyber Version for Vulnerability Detection

Google announced the launch of Gemini 3.8 Flash and its specialized variant, Gemini 3.8 Flash Cyber, on September 2, 2026. This is already the third Flash-family model released in six weeks, underscoring the pace at which the company is responding to competitive pressure from Anthropic and OpenAI, particularly in coding and agentic tasks.

A Third Flash in Six Weeks

The pace of consecutive Flash releases is surprising even for observers used to Google's fast release cycle. After Gemini 3.7 Flash three weeks earlier, the company didn't wait for its standard quarterly update cycle and instead shipped another iteration right away. Google describes 3.8 Flash as its most intelligent workhorse model yet, with clear improvements in software engineering, agentic tasks, and multi-step reasoning in specialized domains.

The performance gains stem from a philosophy Google calls "3.8 Flash works harder": the model takes additional reasoning steps and calls tools iteratively, sometimes using more tokens on complex tasks to produce a more accurate result. On the DeepSWE v1.1 benchmark, which measures autonomous engineering problem-solving, the model outperforms most much larger and more expensive models at the top of the market.

Pricing and Availability

Gemini 3.8 Flash is available at the same introductory pricing as its predecessor: $0.75 per million input tokens and $3.75 per million output tokens, in effect through the end of 2026. Starting January 1, 2027, rates will rise to $1.50 and $7.50 per million tokens. The model is now available to Google AI Pro and Ultra subscribers in the Gemini app and in Google Search, and developers can access it through Google AI Studio, Android Studio, and Vertex AI. Businesses get access via Gemini Enterprise.

A Model Specialized in Cybersecurity

Alongside the general-purpose version, Google introduced Gemini 3.8 Flash Cyber, the successor to the 3.5 Cyber model, designed exclusively for vulnerability detection and automated code patching. In Google's internal testing, the model achieved a threshold-level score on the CyberGym benchmark, which measures autonomous vulnerability discovery, and exceeded 70 percent accuracy in detecting vulnerabilities across twenty different programming languages.

The Chrome Security team used the model to generate security patches and obtained 2.6 times more correct fixes than with much larger commercial models available on the market. Even more striking is the case of the Google Cloud Vulnerability Research team, which used 3.8 Flash Cyber to find a critical, fundamental vulnerability in under two hours, work that typically takes months of research.

Access Limited to Trusted Defenders

Unlike the standard Flash version, the Cyber model is not being made available through the public API. Google is offering it exclusively through a new program called Fairwind, aimed at vetted security researchers, government agencies, and critical infrastructure operators. The company explains this restriction by citing the risk that a tool capable of autonomously detecting vulnerabilities across so many programming languages could be used offensively if it fell into the wrong hands without any access controls.

Google also cites results from tests conducted with external security partners: Wiz reported a 7.5 to 9.7 percentage point increase in vulnerability detection accuracy, alongside cost reductions of 2.3 to 5.2 times compared to the tools it previously used.

Our most intelligent workhorse model delivers significant reasoning improvements, evolving toward an AI partner that not only writes code but can also navigate complex, multi-step tasks. - Google AI

What This Means for Polish Companies and Developers

For Polish development teams using the Gemini API, this means access to a cheaper model that, in many agentic and engineering tasks, approaches the results of pricier frontier-class models while keeping pre-launch pricing. That matters amid growing price competition among large language model providers, with OpenAI and Anthropic also regularly adjusting their pricing.

For security teams and public administration bodies responsible for critical infrastructure, the Fairwind program could eventually open access to a tool that helps detect vulnerabilities in code, though Google has not yet disclosed details on recruiting participants from outside the United States or the conditions under which European institutions could apply.

The rapid pace of successive Flash releases, three in six weeks, suggests Google plans to maintain a similar update rhythm in the coming months rather than reverting to longer gaps between major model launches.