Google’s Gemini 3.8 Flash is constructed for brokers, whereas its Cyber twin hunts vulnerabilities
Google retains cranking out Flash fashions: the corporate on Wednesday introduced two versions of a new 3.8 Flash.
The variants embrace a regular Flash, a “workhorse” mannequin for agentic duties, software program improvement, and multi-step reasoning, and Flash Cyber optimized for vulnerability detection and mitigation.
Google CEO Sundar Pichai mentioned in an X put up that 3.8 Flash delivers “significant leaps” from 3.7 Flash throughout software program engineering, agentic duties, and multi-step reasoning. For occasion, it outperformed many massive frontier fashions on the DeepSWE coding benchmark, at far decrease value.
Meanwhile, Flash Cyber is the corporate’s “most succesful” cybersecurity mannequin, Pichai mentioned; it additionally matches frontier-level efficiency in the case of discovering vulnerabilities and patching them at scale. The mannequin achieved 86.2% on the CyberHealth club cybersecurity benchmark and 47.2% on CWE-Bench, which evaluates AI patching talents. In an inside Google benchmark, the mannequin achieved a greater than 70% success fee discovering vulnerabilities throughout 20 programming languages, Pichai mentioned.
3.8 is Google’s third Flash launch in six weeks and comes rapidly on the heels of model 3.7.
3.8 working "more durable" with "higher diligence"
3.8 Flash is obtainable now in Gemini Enterprise; devs can strive it out within the Gemini API through Google AI Studio, Google Antigravity, Android Studio, or generate UIs in Stitch. It is priced at $0.75 per million enter tokens and $3.75 per million output tokens — the identical introductory pricing as Gemini 3.7 Flash — and customers can customise and regulate mannequin effort ranges based mostly on their wants round high quality, value, and latency.
For occasion, when compute effectivity is a precedence, they’ll regulate to decrease token overhead, or just proceed working with 3.7 Flash, which is “totally supported for efficiency-first workloads,” Google senior product director Tulsee Doshi and Gemini safety lead Raluca Ada Popa wrote in a blog post.
“3.8 Flash works more durable,” exhibiting “higher diligence” with advanced duties like executing further reasoning steps, though at occasions it could use extra tokens to maximise efficiency, Doshi and Popa word. The mannequin has a 1M-token enter window and a 64K-token output restrict, and may ingest textual content in addition to pictures, audio, video, and PDF information.
3.8 Flash was evaluated throughout quite a few benchmarks testing coding, multimodal capabilities, laptop use, long-context and information work, and scientific reasoning. Google says it additionally does nicely in specialised information domains requiring extra in-depth evaluation and reporting. For occasion, the mannequin outperformed its predecessor and different frontier fashions on benchmarks like Vals Finance Agent V2 for finance, and Harvey's Legal Agent Benchmark for regulation; it additionally scored 54.9% on Humanity’s Last Exam (HLE)-Verified, reflecting its means to tackle multi-step reasoning duties throughout topics like math, science, and humanities.
In one instance shared by Google, Gemini 3.8 Flash constructed a recreation with a easy immediate utilizing looping strategies in Google’s Antigravity platform. The recreation makes use of puzzles, storytelling that adjustments based mostly on the surroundings, and pictures and textures from Nano Banana to create a 3D expertise (on this case a wizard navigating a fortress).
In different cases, the mannequin created a fully-functional DOS model of Google Maps that includes interactive places, instructions, and avenue views; a 3D visualizer that mechanically decomposed gadgets into layers for inspection with a slider functionality; and a topographic map of well-known geographical websites based mostly on actual datasets from the U.S. Geological Survey, full with real-time cross-sections, 2D projections, and scientific explanations.
According to Arena.ai, 3.8 Flash landed at No. 14 in Agent Arena, rating above DeepSeek-V4-Pro, and confirmed a big bounce over Gemini 3.7 Flash (which sits all the way in which down at No. 32). It debuted at No. 7 in Text Arena, forward of Claude Opus 5 and Gemini 3.7 Flash. It improved over 3.7 Flash in a number of areas: multi-turn requests, writing, literature, and language, longer queries, exhausting prompts, coding, instruction following, software program and IT providers, and trade, administration and monetary ops.
Flash Cyber is already securing Google's code
Flash Cyber is initially being rolled out to “trusted defenders” via Google’s Fairwind Program, which prioritizes authorities authorities, critical-infrastructure operators, and different companions in search of superior cyber protection capabilities. Organizations can apply for entry.
Google says the mannequin model has undergone “rigorous coaching” within the cybersecurity area and represents a “vital leap in immediate injection robustness.” It is especially adept at autonomous vulnerability discovery — no less than, based mostly on inside Gemini benchmarks — and automatic patching. It can be superb at coding, Popa mentioned in a video.
The purpose was to equip defenders with expert-level capabilities to present them a leg up over risk actors (whether or not malicious, fellow AI brokers, or human hackers). “We have invested in vulnerability fixing from the beginning, and prioritized it over offensive capabilities like exploitation,” Doshi and Popa clarify.
The mannequin ships a extra permissive set of mitigations for cybersecurity safeguards — which is why, for now, it’s only being shared with restricted companions — and safeguards in opposition to misuse in cyber offense and areas like chemical, organic, radiological, and nuclear (CBRN).
Google is already utilizing 3.8 Flash Cyber to safe its personal code; it produced 2.6 occasions extra appropriate patches in Chrome vulnerabilities versus a lot bigger industrial fashions.
Wiz — which Google acquired earlier this 12 months at a historic $32 billion — reported that 3.8 Flash Cyber had 7.5% to 9.7% increased recall of real-world vulnerabilities on an inside penetration testing benchmark at 2.3 to five.2 occasions decrease value than main frontier fashions. Similarly, Google’s Cloud Vulnerability Research discovered a crucial foundational vulnerability in lower than 2 hours with 3.8 Flash Cyber. Typically, that analysis and discovery would take months, Google claims.
AI brokers are “extremely expert” at discovering and exploiting vulnerabilities, Popa mentioned. Scanning massive codebases with large AI fashions is pricey, and defenders are overwhelmed. “In cybersecurity, attackers want solely discover one vital flaw over hundreds of thousands of strains of code. Defenders need to take away each a kind of flaws to have the ability to defend in opposition to attackers.”
Doug Turner, engineering director for Chrome, described a “vulnerability apocalypse” in latest months on account of generative AI. “Simply in a single day, we noticed a hockey stick enhance within the variety of software program vulnerabilities reported via our vulnerability analysis program,” he mentioned in a video.
One fascinating vulnerability 3.8 Flash Cyber found had been in Chromium and Chrome for 13 years, he defined. It was a “very refined bug” that dozens, if not tons of, of engineers checked out however by no means flagged. “Gemini 3.8 Flash Cyber goes to permit us to create higher instructed fixes in order that builders’ lives can get lots simpler.”
