Google Introduces Gemini 3.8 Flash and 3.8 Flash Cyber for Advanced AI and Cybersecurity

Google has introduced Gemini 3.8 Flash and Gemini 3.8 Flash Cyber, two new models aimed at pushing AI further into autonomous software engineering, enterprise workflows and cybersecurity.

The announcement, published on September 2, 2026, describes Gemini 3.8 Flash as a model designed for long-horizon coding and agentic workflows. Gemini 3.8 Flash Cyber takes a more specialised approach, focusing on vulnerability discovery and automated security patching for trusted defenders.

Google says the new models are designed to combine stronger reasoning with the speed and efficiency associated with its Flash family.

Gemini 3.8 Flash Targets Long-Horizon Coding

Gemini 3.8 Flash is positioned as Google's latest workhorse model for complex coding and autonomous agent tasks.

According to Google, the model delivers substantial improvements over Gemini 3.7 Flash and can approach the performance of larger frontier models in several workloads.

One highlighted evaluation is DeepSWE v1.1, which focuses on long-horizon software engineering. Google says Gemini 3.8 Flash outperformed most larger frontier models on this benchmark when autonomously solving complex engineering problems from beginning to end.

The model is also being evaluated beyond traditional coding tasks. Google reports improvements in specialised areas such as quantitative analysis, finance and legal knowledge work.

Building More Complex Applications

Google also demonstrated Gemini 3.8 Flash creating interactive software through relatively simple instructions.

Examples highlighted in the announcement include:

• A playable 3D game created using Google Antigravity

• A functional DOS-style version of Google Maps

• Interactive geographic visualisations using U.S. Geological Survey datasets

• A 3D hardware visualisation application using Three.js

These examples illustrate Google's broader focus on AI systems that can perform extended sequences of development tasks rather than simply generate isolated pieces of code.

Gemini 3.8 Flash Cyber Focuses on Defensive Security

The more security-specific announcement is Gemini 3.8 Flash Cyber.

Google says the model is available to a selected group of trusted defenders through its Fairwind Program. The model is intended to provide specialised cybersecurity capabilities while retaining the speed and cost characteristics of the Flash series.

Rather than focusing primarily on offensive exploitation, Google says it prioritised capabilities that help defenders identify and fix vulnerabilities.

That distinction is important because increasingly capable AI systems can potentially assist both security researchers and attackers. Google says Gemini 3.8 Flash Cyber therefore uses a more permissive cybersecurity mitigation approach than the standard Gemini 3.8 Flash model, while restricting access to trusted defenders.

Autonomous Vulnerability Discovery

One of the central capabilities highlighted by Google is automated vulnerability discovery.

On CyberGym, an industry benchmark for autonomous vulnerability discovery, Google says Gemini 3.8 Flash Cyber demonstrates frontier-level performance and surpasses Gemini 3.5 Flash Cyber as well as significantly larger frontier models.

Google also evaluated the model against an internal benchmark intended to represent more diverse real-world software environments.

That evaluation covered complex codebases spanning 20 programming languages. Google reports that Gemini 3.8 Flash Cyber achieved a success rate above 70% on this internal evaluation.

The result highlights an important direction in AI-assisted security: moving beyond vulnerability analysis in a limited set of programming languages towards broader automated analysis across heterogeneous software environments.

Automated Patching Becomes a Major Focus

Finding a vulnerability is only part of the security process. Developers and security teams also need to determine how to fix it without introducing new problems.

Google says Gemini 3.8 Flash Cyber was designed with vulnerability remediation as a major priority.

On CWE-Bench, an external benchmark operated by Collinear, Google reports a 47.2% pass@1 score, compared with 47.8% for a leading frontier model, while describing Gemini 3.8 Flash Cyber as being on the benchmark's Pareto frontier with lower cost.

The focus on patching reflects a practical defensive use case for AI.

A security system that can identify a vulnerability but cannot help engineers produce a suitable remediation still leaves much of the operational work to humans. Automated patch generation can potentially shorten that remediation loop, although generated patches still require appropriate testing and validation before deployment.

Google Is Already Applying the Model to Its Own Code

Google says Gemini 3.8 Flash Cyber is already being used to help secure code across the company.

The announcement highlights several examples.

Chrome Security

Google's Chrome Security team reportedly found that Gemini 3.8 Flash Cyber generated 2.6 times more correct vulnerability patches than the best commercial models tested by the team, which Google describes as substantially larger models.

Wiz Penetration Testing

Google also cites results from Wiz's internal penetration-testing benchmark.

According to the announcement, Gemini 3.8 Flash Cyber delivered 7.5% to 9.7% higher recall, while costing 2.3 to 5.2 times less than other leading frontier models evaluated in that testing.

Cloud Vulnerability Research

Google's Cloud Vulnerability Research team also used the model to identify a critical foundational vulnerability in less than two hours.

Google says this type of research and discovery would usually take months, according to its announcement.

These examples are particularly significant because they move the discussion from benchmark performance towards the use of AI in operational security workflows.

Safety Controls Remain Part of the Model Strategy

Google says Gemini 3.8 models were developed with safeguards covering areas including chemical, biological, radiological and nuclear risks, as well as cyber offense.

The standard Gemini 3.8 Flash model has safeguards intended to limit misuse in cybersecurity and other high-risk domains.

Gemini 3.8 Flash Cyber uses a more permissive cybersecurity mitigation configuration because it is designed for more comprehensive defensive security work. Google says access is therefore limited to trusted defenders who require these capabilities.

Google also reports improvements in prompt-injection robustness, based on evaluations from Gray Swan.

Prompt injection is particularly relevant to agentic AI because an AI system that can access tools, codebases or external information may encounter malicious instructions embedded within the material it processes.

Improving resistance to such attacks is therefore an important part of making autonomous AI systems safer to deploy.

What Gemini 3.8 Flash Cyber Means for Enterprise Security

The announcement highlights a broader industry shift toward using AI not only to analyse security alerts but also to participate in the software-security lifecycle.

Traditional application security can involve several separate steps:

Code review → Vulnerability discovery → Security validation → Developer remediation → Testing → Deployment

AI-assisted systems are increasingly being positioned as a layer connecting these activities.

For enterprises, this could mean security teams using AI to analyse larger codebases, identify potential weaknesses and accelerate remediation workflows.

However, the announcement does not establish that AI-generated patches can be deployed without human review. Security teams still need appropriate validation, testing and change-management processes.

Gemini 3.8 Flash vs Gemini 3.8 Flash Cyber

The two models are therefore related but serve different purposes. Gemini 3.8 Flash is positioned as a broad agentic model, while Gemini 3.8 Flash Cyber is specifically tuned toward defensive cybersecurity work.

Availability

Google says developers can build with Gemini 3.8 Flash and explore agent-first workflows through Google Antigravity, while the model is also available through the Gemini API via Google AI Studio and Android Studio. Google also points to Stitch for UI generation and Gemini Enterprise for enterprise access.

Gemini 3.8 Flash Cyber has a more restricted availability model. Google says it is currently available to a set of trusted defenders through the Fairwind Program.

Additional details were not disclosed in the announcement about broader public availability of Gemini 3.8 Flash Cyber.

The Bigger Picture

The release illustrates how AI development is increasingly moving from simple question-and-answer systems toward long-running agents capable of planning, coding, testing and revising their work.

Cybersecurity is one of the clearest areas where this transition could have practical consequences.

An AI system capable of finding vulnerabilities can potentially help defenders analyse software faster. An AI system capable of producing patches can potentially shorten the gap between discovering a weakness and beginning remediation.

At the same time, more capable cybersecurity AI increases the importance of access controls, safety mitigations, evaluation and monitoring.

The announcement highlights this balance directly: Google is expanding the defensive capabilities of its models while placing stronger restrictions around the specialised cyber version.

For enterprises, the development reflects growing demand for security tooling that can operate at the speed and scale of modern software development.

The most important question will not simply be whether AI can find more vulnerabilities. It will be whether organisations can integrate these capabilities into secure, auditable workflows where findings are validated and fixes are safely tested before deployment.