Google Launches Gemini 3.8 Flash and Flash Cyber for Coding, Agents and Cyber Defense

Summary

Google has released Gemini 3.8 Flash, its newest general-purpose Flash model, alongside Gemini 3.8 Flash Cyber, a restricted cybersecurity variant for approved defenders. Google positions the shared Gemini 3.8 core as its strongest reasoning and coding model so far, with the regular Flash version aimed at long-running software engineering, autonomous agents, and complex enterprise workflows.

For developers, the unusual part is not a new price cut. Gemini 3.8 Flash keeps the same introductory paid-tier rates as Gemini 3.7 Flash — $0.75 per million input tokens and $3.75 per million output tokens through December 31, 2026 — while Google reports higher performance on several agentic and professional-work benchmarks. The cyber variant follows a different deployment model: it is limited to trusted organizations through Google's new Fairwind Program.

Quick Take

• Gemini 3.8 Flash is generally available with a 1,048,576-token input limit and 65,536-token output limit.
• Introductory API pricing remains $0.75 input / $3.75 output per 1M tokens through December 31, 2026.
• Google reports gains over 3.7 Flash in finance-agent, legal-agent, and multidisciplinary reasoning evaluations.
• Higher reasoning effort can consume more tokens, so the same per-token price does not guarantee the same per-task cost.
• Gemini 3.8 Flash Cyber is restricted to approved defenders through the Fairwind Program.

What Google Actually Launched

Gemini 3.8 arrives only three weeks after Gemini 3.7 Flash, making this Google's third Flash release in six weeks. Google says both 3.8 variants are powered by the same foundational intelligence, but they are designed for different deployment environments.

The regular Gemini 3.8 Flash is the broadly available model. Google lists distribution through the Gemini API, Google AI Studio, Gemini Enterprise Agent Platform, the Gemini app, AI Mode, and Google Antigravity. The API model code is gemini-3.8-flash.

Gemini 3.8 Flash Cyber is different. Google describes it as its most capable cybersecurity model, but access is controlled through Fairwind, a program for approved government authorities, critical-infrastructure operators, software maintainers, and other trusted defenders. Google says the Cyber version uses more permissive cybersecurity mitigations than the public Flash model, which is why access is restricted.

That public-versus-trusted split is one of the most important parts of the release. Google is not simply offering a faster model and a slower model; it is separating deployment policy according to the risk profile of the capability.

Gemini 3.8 Flash Specs and Current Pricing

The model also supports code execution, file search, search grounding, function calling, structured outputs, URL context, and computer use in preview. Google's developer documentation explicitly lists image generation and the Live API as unsupported for this model.

For buyers, the pricing date matters. The attractive $0.75/$3.75 rate is temporary introductory pricing, not a permanent list price. On January 1, 2027, Google's published standard input and output prices double to $1.50 and $7.50 per million tokens.

Where 3.8 Flash Improves on 3.7 Flash

Google's own published evaluations show a pattern that is more useful than a generic “smarter model” claim: the gains are concentrated in long-horizon agentic work and professional workflows.

These are provider-reported results, not AI World Scope testing. Benchmark harnesses, model settings, tool access, and scoring methodology can materially affect outcomes, so the numbers should be read as evidence of Google's intended improvement areas rather than a universal ranking.

Google also emphasizes long-horizon software engineering through DeepSWE v1.1 and says 3.8 Flash can take more reasoning steps and call tools repeatedly when a task is difficult. That behavior is important for autonomous agents because completion quality depends not only on the first answer, but on whether a system can recover from obstacles and continue working.

Same Token Price Does Not Mean Same Cost per Task

This is the biggest practical caveat for developers.

Google kept the introductory per-token price unchanged from Gemini 3.7 Flash, but its model card warns that 3.8 Flash can use more tokens at higher effort levels to maximize performance. Google explicitly points efficiency-first workloads back toward lower effort settings or continued use of Gemini 3.7 Flash.

That means a simple price table can be misleading. If 3.8 Flash solves a difficult coding task in fewer failed attempts, its total cost may improve even if it reasons longer. But if a workload does not benefit from the extra reasoning, the model can consume more tokens without creating equivalent business value.

The right metric is therefore increasingly cost per completed task, not just dollars per million tokens.

AI World Scope implication: 3.8 Flash is most compelling when the extra reasoning and tool use materially improve completion rates. For lightweight, predictable workloads, 3.7 Flash can remain the more conservative efficiency choice.

Flash Cyber Turns Access Policy Into a Product Feature

Gemini 3.8 Flash Cyber is the more unusual half of the announcement.

Through Fairwind, Google is giving approved defenders access to a cyber-specialized deployment designed for vulnerability discovery and automated patching. Google says Fairwind participants can use Flash Cyber as a standalone model or with its CodeMender security agent.

Google reports 86.2% on CyberGym Pass@1 for vulnerability discovery, ahead of Gemini 3.5 Flash Cyber in its published comparison. On CWE-Bench, a patching benchmark run by Collinear, Google reports 47.2% pass@1 for Flash Cyber. Google also says an internal benchmark spanning complex codebases in 20 programming languages produced a vulnerability-discovery success rate above 70%.

Again, these figures should be treated according to their provenance: Google is publishing the results, and some are based on internal evaluation sets. They are useful signals, but not a substitute for independent testing in a buyer's own environment.

The governance model is just as important as the benchmark scores. Fairwind restricts access to approved organizations and limits use to defensive and research contexts. Google says partner access cannot be redistributed or resold, and participating organizations must apply controls such as strong authentication and role-limited access.

Who Should Care — and Who Should Wait

Developers building coding agents should evaluate 3.8 Flash if their workloads involve long task chains, tool calls, retries, or large multimodal context. The unchanged introductory token price lowers the barrier to testing.

Teams running high-volume, predictable automation should not assume an automatic migration is necessary. Google continues to support 3.7 Flash and explicitly positions lower effort levels or 3.7 as options when compute efficiency matters most.

Enterprise buyers should pay attention to the January pricing change. A production workload that looks unusually inexpensive in September can have a very different 2027 cost profile.

Security teams should separate the two products clearly. Public Gemini 3.8 Flash includes cyber safeguards; Flash Cyber is a controlled-access offering with a different mitigation profile and Fairwind eligibility requirements.

What to Watch Next

The first question is whether independent evaluations confirm Google's claimed long-horizon gains. Coding-agent benchmarks are increasingly sensitive to harness design, tool budgets, and inference effort, so real-world completion rate and cost per successful task will matter more than a single leaderboard score.

The second question is migration behavior. Because Gemini 3.7 Flash remains supported, Google is effectively giving developers a choice between a newer model that can work harder and an older model that may remain attractive for efficiency-first workloads.

Finally, Fairwind is worth watching as a broader industry signal. Anthropic and OpenAI are also experimenting with differentiated access to sensitive frontier capabilities. Google's decision to package a cyber-specialized variant behind managed access suggests that capability tiering by risk, not only by speed or intelligence, may become a standard frontier-model deployment pattern.

AI World Scope Take

Gemini 3.8 Flash is more interesting than a routine point release because Google is trying to increase the amount of useful work a Flash-priced model can finish, not merely improve static benchmark scores. The combination of a 1M-token context window, broad multimodal input, tool use, and unchanged introductory token rates makes it a serious candidate for production agent workloads.

But the economics need to be read carefully. The current low rates expire at the end of 2026, and higher reasoning effort can increase token consumption. Buyers should benchmark total task completion cost rather than assuming the cheapest token price wins.

Flash Cyber adds a second strategic signal: the frontier market is beginning to segment models by access policy and risk profile. That may matter as much as model size or benchmark rank for the next generation of enterprise AI deployments.