Google's Gemini 3.8 Flash and Cyber: A new era of agentive reasoning and vulnerability patching for AI builders

Google released Gemini 3.8 Flash and Gemini 3.8 Flash Cyber on September 2, 2026, just three weeks after the previous Flash model. The general-purpose Gemini 3.8 Flash is designed for complex multistep reasoning and coding tasks, while Gemini 3.8 Flash Cyber is a gated cybersecurity variant available through the new Fairwind Program.

For AI builders, the important shift is that this model is built to "work harder" on complex tasks by executing extra reasoning steps and making iterative tool calls, even if that means higher token consumption. According to Google, Gemini 3.8 Flash outperformed Claude Opus 5 and GPT 5.6 Sol on nine of 16 AI benchmarks, including Terminal-Bench 1.1 for multistep coding and evaluations covering financial data analysis and chart comprehension. It scored 73.7% on DeepSWE-1.1, a long-horizon coding benchmark, placing it 1% ahead of GPT-5.6 Sol and a fraction behind Opus 5.

The cybersecurity variant, Gemini 3.8 Flash Cyber, scored 86.2% on the CyberGym benchmark for spotting vulnerabilities in C and C++ code, beating Claude Mythos 5 (83.8%) and GPT-5.6 Sol (83.6%). It is bundled with CodeMender, a Google DeepMind harness of prompts and code assets that help find, assess, and patch vulnerabilities. The Fairwind Program, which provides access to Flash Cyber and CodeMender, launched with over 650 participants including Snowflake, CrowdStrike, and Datadog.

Pricing and availability

Gemini 3.8 Flash is available through the Gemini API at $0.75 per million input tokens and $3.75 per million output tokens, matching the promotional pricing of its predecessor. The model supports a 1 million token context window. Gemini 3.8 Flash Cyber is gated behind the Fairwind Program and not publicly available.

What this means for builders

If you are building AI agents that need to perform long-horizon coding tasks, financial analysis, or multistep reasoning, Gemini 3.8 Flash is worth evaluating. Google's emphasis on "diligence" through extra reasoning steps and iterative tool calls suggests the model trades higher token usage for better outcomes on hard problems. For agent workflows that already tolerate higher latency and cost for accuracy, this could be a net win.

For security teams, Gemini 3.8 Flash Cyber with CodeMender offers an integrated pipeline for vulnerability discovery and patching. Google's internal Chrome team reported 2.6x more correct patches when using the model, and another team discovered a critical foundational vulnerability that would have taken months to find manually. If your organization qualifies for the Fairwind Program, this could significantly reduce the time from vulnerability discovery to patch.

Caveats to consider

All benchmark results and internal productivity claims are vendor-reported. The "works harder" approach means the model may use significantly more tokens than competitors on complex tasks, potentially offsetting its low per-token pricing. The Cyber variant is only available through a gated program, not the public API. The patching improvements are from Google's own teams and may not generalize to all codebases or workflows. Independent verification of the benchmark claims would be valuable before making infrastructure decisions.

For builders shipping AI products, Gemini 3.8 Flash is a strong option for coding and reasoning agents, especially if you already use the Gemini API. Security teams should apply for the Fairwind Program to evaluate CodeMender, but treat internal Google metrics as directional rather than guaranteed.