Google introduces Gemini 3.8 Flash, its new reasoning and programming model, along with Gemini 3.8 Flash Cyber, a specialized cybersecurity variant. Both promise greater capacity for complex tasks without giving up the speed or lower cost of the Flash family.
Gemini 3.8 Flash bets on more autonomous agents
Gemini 3.8 Flash arrives just three weeks after Gemini 3.7 Flash and represents Google's third Flash version in six weeks. The company describes it as its smartest work model yet for software engineering, autonomous agents, and multi-step reasoning.
Its introductory price remains $0.75 per million input tokens and $3.75 per million output tokens, the same as Gemini 3.7 Flash. For a team running thousands of queries a day, that difference compared with larger models can be decisive.
The main innovation lies in how it handles difficult problems. Gemini 3.8 Flash can dedicate more reasoning steps, use tools iteratively, and review its own answers before finishing. In other words, it does not always respond faster when a task requires precision, but it can work more deeply.
The idea is simple: with complex problems, Gemini 3.8 Flash works longer before delivering a result.
On the DeepSWE v1.1 benchmark, which focuses on solving long-running software engineering problems, the model outperforms several larger frontier models when completing complex tasks from beginning to end.
It also records improvements in professional and specialized domains. Google says it outperforms Gemini 3.7 Flash and other frontier models on tests such as Vals Finance Agent V2 and Harvey's Legal Agent Benchmark. On HLE-Verified, an evaluation of reasoning in science, the humanities, and professional fields, it reaches a score of 54.9%.
More reasoning, potentially more usage
This additional capability comes with a technical cost: at the highest effort levels, the model may use more tokens to solve a task. That can increase consumption, although it can also improve results on work that requires planning, analysis, and tool use.
Developers can reduce that expense by using lower effort levels. For applications where computational efficiency is the priority, Google will also keep Gemini 3.7 Flash available as a compatible alternative.
Gemini 3.8 Flash Cyber focuses on defending systems
The second variant, Gemini 3.8 Flash Cyber, is designed to detect vulnerabilities and help fix them. It will not be generally available: Google will offer it to trusted defenders through the new Fairwind Program, aimed at government authorities, critical infrastructure operators, and software maintainers.
On CyberGym, a benchmark used to evaluate autonomous vulnerability discovery, Gemini 3.8 Flash Cyber achieves frontier-level performance and outperforms both Gemini 3.5 Flash Cyber and larger models.
Google also tested the system in an internal evaluation using complex codebases written in 20 programming languages. There, it achieved a success rate above 70% when finding different types of vulnerabilities.
Fixing vulnerabilities is a priority
Google says the model was trained with special attention to fixing flaws, not just discovering or exploiting them. On CWE-Bench, an external patch-generation test developed by Collinear, it achieved a pass@1 score of 47.2%, close to the 47.8% achieved by a leading frontier model, but at a considerably lower cost.
The pass@1 metric measures whether the model's first proposal successfully fixes the problem being evaluated. For security teams, this matters because a tool that generates useful patches on the first attempt can speed up review and reduce exposure time.
Results in Google's products and code
Google already uses Gemini 3.8 Flash Cyber in its own security processes. According to the company:
- Chrome's security team obtained 2.6 times more correct patches for vulnerabilities than with the best larger commercial models.
- Wiz recorded between 7.5% and 9.7% higher recall on its internal penetration-testing benchmark, at a cost between 2.3 and 5.2 times lower than other frontier models.
- The Cloud Vulnerability Research team found a critical vulnerability in a fundamental component in less than two hours. Google notes that this type of research typically takes months.
These figures come from evaluations by Google and its partners, so they should be interpreted alongside independent testing. Even so, they show an important trend: smaller, faster models can be especially useful when they need to analyze large volumes of code or run many iterations.
Security, limits, and access
Gemini 3.8 includes protections against misuse related to chemical, biological, radiological, and nuclear risks, as well as controls to reduce offensive uses in cybersecurity. The Cyber variant uses more permissive mitigations for defensive tasks, so access will be restricted to verified organizations.
Google also reports improved resistance to prompt injection, a type of attack in which malicious instructions attempt to manipulate a model through the content it processes. The evaluation, conducted by Gray Swan, aims to measure how well the system can protect its users against this risk.
Gemini 3.8 Flash will be available to different audiences:
- Developers: through the Gemini API, Google AI Studio, Android Studio, Google Antigravity, and Stitch.
- Businesses: through Gemini Enterprise.
- Consumers: for Google AI Pro and Ultra subscribers in the Gemini app, AI Mode in Google Search, and Gemini in Google Sheets.
- Cybersecurity teams: by applying to the Fairwind Program, if they meet the access requirements.
A race toward smaller models that work harder
Gemini 3.8 Flash reflects an increasingly clear strategy in the industry: everything does not depend on building gigantic models. Performance can also improve by having a fast model spend more time reasoning, use tools, and review its decisions.
For an entrepreneur, this could mean agents capable of completing programming tasks at a manageable price. For a company, it could translate into automating legal, financial, or technical analysis. And for a security team, it could mean more tests and patches without multiplying infrastructure costs.
The question is no longer just which model has the most parameters. It also matters how much it can do for each dollar, how many times it can iterate, and how reliable it is when the problem stops being a simple question and becomes a complete process.