Gemini 3.8 Flash Cyber is Google’s vulnerability-hunting variant of Gemini 3.8 Flash, released on September 2, 2026 to vetted defenders only, through a new access scheme called the Fairwind Program. It finds bugs and writes the patches for them. In one example from Google’s Chrome team, it found a flaw that had been in Chromium and Chrome for 13 years, a “very subtle bug” that dozens or hundreds of engineers had looked at without flagging. If you maintain widely used software, run critical infrastructure or sit on a government security team, you can apply for access now. If you do not, the launch still reaches you, because models like this one change how many patches land on your desk.
On September 26 we covered attackers putting agents to work in our offensive AI analysis, and this is the defender’s side of the same curve. We read the announcement, the model page and the benchmark papers behind it. The capability is real, the scores need a footnote, and the way Google shipped it matters as much as the scores.
What Google released on September 2
- June 3, 2025: Researchers publish CyberGym, a benchmark of 1,507 real vulnerabilities across 188 software projects. The best agents reproduce about 20 percent of them.
- July 21, 2026: Google pilots Gemini 3.5 Flash Cyber with governments and trusted partners through CodeMender, its remediation agent. On the V8 JavaScript engine it confirms 55 unique issues, against 47 for 3.5 Flash and 36 for Opus 4.6.
- September 2, 2026: Google releases 3.8 Flash and 3.8 Flash Cyber and opens the Fairwind Program. The same day, The Hacker News reports parallel cyber model, safeguard and access announcements from Anthropic and OpenAI.
Two models share one foundation. Gemini 3.8 Flash is the general release, while its sibling is tuned for vulnerability detection and automated patching and ships with what Google calls “a more permissive set of mitigations for cybersecurity”. In plain terms it is allowed to go further into security work than the general model, and that permission is exactly why access is restricted.
Fairwind is the gate. Google’s Fairwind announcement pairs the model with its CodeMender remediation harness, counts more than 650 participating partners, and sets the operating conditions. Participants must limit access to their internal cybersecurity, incident response or penetration testing teams and deploy protections such as multi-factor authentication.
The 13-year-old Chrome bug, and the rest of Google’s evidence
Go back to that Chrome flaw, because it is the most useful single fact in the launch. Benchmarks measure bugs someone already knows about. This one was unknown, in one of the most scrutinized codebases on earth, and human reviewers had passed over it for 13 years. Weigh that above any leaderboard.
Google’s announcement adds three more field results. The Chrome Security team measured 2.6 times more correct patches than the best commercial models, which are much larger. Google Cloud’s Vulnerability Research team found a critical foundational vulnerability in less than two hours, work that usually takes months. And Wiz, one of the launch partners, measured 7.5 to 9.7 percent higher recall on its internal penetration testing benchmark at 2.3 to 5.2 times lower cost than other leading frontier models.
Notice what the strongest claims have in common. They are about correct patches and cost, not raw finds. A model that floods a team with unvalidated findings costs more than it saves, and we have watched static analysis rollouts die of exactly that. So the 2.6 times patch figure matters more to us than any discovery score.
Gemini 3.8 Flash Cyber benchmarks, and what they actually measure
The model page carries the leaderboard numbers. Google reports 86.2 percent pass@1 on CyberGym, narrowly ahead of 85.6 percent for OpenAI’s GPT-5.5-Cyber. It reports 71.0 percent on an internal real-world discovery test spanning 20 languages, up from 46.6 percent for 3.5 Flash Cyber. On CWE-Bench it scores 47.2 percent, and Google’s own comparison shows Anthropic’s Fable 5 slightly ahead at 47.8 percent, at higher cost.
CyberGym is the number worth unpacking. The benchmark gives an agent a vulnerability’s text description plus the codebase and asks it to write a proof-of-concept that reproduces the bug. When the paper appeared in June 2025, the best agent and model combinations managed about 20 percent. Fifteen months later Google reports two models at roughly 86 percent. We read that two ways. The capability jump is real, and it matches what attackers are doing with the same class of model. The benchmark is also running out of headroom, so the next round of comparisons will move to end-to-end tests such as CyberGym-E2E, which scores discovery, proof-of-concept and patch generation together across 920 vulnerabilities in 139 projects. Google does not say whether its run matches the original configuration, so treat the gap as directional rather than exact.
Note also what CyberGym is not. It measures reproducing a described bug, not finding an unknown one, which is why the internal discovery figure and the Chrome anecdote deserve more weight in an adoption decision. One more line on the model page matters to anyone planning a deployment. Google reports a 6.0 percent attack success rate for indirect prompt injection on Gray Swan’s benchmark. Lower is better, and yet it is not zero, and a vulnerability hunter spends its whole working day reading code and comments that somebody else wrote.
Why the cyber models ship behind gates
All three labs paired their cyber capability with gates and safeguards rather than an open release, because the capability that writes a patch can also write an exploit. Google frames Fairwind as giving “trusted defenders a vital adaptation window to harden their systems before bad actors have a chance to exploit new capabilities.”
We think Google chose the right word. It is a window, not a wall. The attacker campaigns in our offensive AI piece ran on general-purpose models wrapped in agent harnesses, and nothing about Fairwind slows that down. Meanwhile the supply of vulnerabilities is already moving. Doug Turner, Chrome’s engineering director, told VentureBeat that generative AI brought “a hockey stick increase” in reports to Chrome’s vulnerability research program, and that it happened “simply overnight.” Models like 3.8 Flash Cyber push the same curve further. More bugs found means more patches shipped, and every published fix hands attackers a description to work from.
What to do if you run security or engineering teams
If you qualify, apply, and plan for the conditions before access arrives. That means named security staff, MFA, and a point in your pipeline where a human reviews every generated patch before it merges. Then run a bake-off on your own code before trusting any vendor number, measuring correct patches accepted per engineer hour and the false positives your team had to triage, not pass@1. Comparable programs from other labs exist and deserve the same test, as options to evaluate rather than answers.
Govern the model like any other privileged tool. Give it least-privilege repository access, keep production credentials away from it, and treat everything it reads as untrusted input, which is the same discipline we laid out in our prompt injection defense guide. When we help teams put a model like this into a vulnerability workflow through our secure AI deployment work, the review gate and the tool permissions take more design time than the model choice, and they should.
If you do not qualify, the practical change is volume. Size your patch intake for more advisories arriving faster, and shorten the path from vendor fix to deployed fix on anything internet-facing.
Frequently asked questions
How do you get access to Gemini 3.8 Flash Cyber?
By applying to Google’s Fairwind Program, which prioritizes government authorities, critical infrastructure operators and maintainers of widely used software. Participants must restrict use to cybersecurity, incident response and penetration testing staff and protect access with multi-factor authentication.
What is the difference between Gemini 3.8 Flash and 3.8 Flash Cyber?
They share one foundation. Gemini 3.8 Flash is the general model and is broadly available. The Cyber variant is tuned for vulnerability detection and automated patching, runs with more permissive cybersecurity mitigations, and is available only through Fairwind.
How much does Gemini 3.8 Flash Cyber cost?
Gemini 3.8 Flash lists at $0.75 per million input tokens and $3.75 per million output tokens. Help Net Security reports the Cyber variant carries the same introductory pricing for Fairwind participants.
Is Gemini 3.8 Flash Cyber better than other cyber models?
On Google’s own figures it leads narrowly on CyberGym and trails slightly on CWE-Bench at lower cost. Use vendor numbers to build a shortlist, then decide with a test on your own code.
Bottom line
If you are eligible, apply for Fairwind and put a human review gate in front of every patch the model writes. If you are not, assume models like this are already finding bugs in the software you run, for both sides, and shorten your patch cycle to match. A bug that hid for 13 years is good news only for whoever acts on it first.