Google Gemini 3.8 Flash Targets AI Agents as Flash Cyber Hunts Flaws
Google launches Gemini 3.8 Flash for agents and coding, plus Flash Cyber, scoring 86.2% on CyberGym and finding a critical flaw in less than two hours.
Summary
On September 3, 2026, Google unveiled Gemini 3.8 Flash, its third Flash release in six weeks, and Flash Cyber. CEO Sundar Pichai said 3.8 improved software engineering, agents and multistep reasoning over 3.7; it beat larger frontier models on DeepSWE at lower cost, scored 54.9% on Humanity’s Last Exam Verified, led Vals Finance Agent V2 and Harvey’s Legal Agent Benchmark, ranked No. 14 in Arena.ai Agent Arena versus 3.7’s No. 32 and above DeepSeek V4 Pro, then debuted No. 7 in Text Arena ahead of Claude Opus 5.
Gemini Enterprise and Gemini API access via Google AI Studio, Antigravity, Android Studio and Stitch is available now at $0.75 per million input and $3.75 per million output tokens, matching 3.7’s introductory prices. Tulsee Doshi and Raluca Ada Popa said adjustable effort trades quality, cost and latency; diligent reasoning may use more tokens, while supported 3.7 serves efficiency focused work. The model accepts text, images, audio, video and PDFs, with 1 million input and 64,000 output token limits; demos used Nano Banana in a 3D game, DOS Google Maps, a layered device visualizer and U.S. Geological Survey topography.
Google’s most capable cyber model scored 86.2% on CyberGym, 47.2% on CWE Bench and above 70% across 20 languages internally. Fairwind initially limits it to government, critical infrastructure and trusted defenders because permissive cyber mitigations accompany prompt injection, cyber offense and CBRN safeguards; patching is prioritized over exploitation. It generated 2.6 times more correct Chrome patches and found a 13 year old Chromium and Chrome bug. Wiz, acquired this year for $32 billion, measured 7.5% to 9.7% better recall at 2.3 to 5.2 times lower cost; Google Cloud Vulnerability Research found a critical flaw in under 2 hours rather than months. Chrome engineering director Doug Turner said generative AI caused an overnight surge in vulnerability reports.
Positives
- Gemini 3.8 Flash costs $0.75 per million input tokens and $3.75 per million output tokens, matching 3.7’s introductory pricing.
- Flash Cyber scored 86.2% on CyberGym, 47.2% on CWE Bench and above 70% across 20 programming languages internally.
- Google obtained 2.6 times more correct Chrome vulnerability patches than from much larger commercial models.
- Wiz measured 7.5% to 9.7% better vulnerability recall at 2.3 to 5.2 times lower cost than leading frontier models.
- Google Cloud Vulnerability Research found a critical flaw in under 2 hours, compared with the months such work typically requires.
- Gemini 3.8 Flash rose to No. 14 in Agent Arena from 3.7’s No. 32 and debuted No. 7 in Text Arena.
Risks & concerns
- Gemini 3.8 Flash may consume more tokens when applying extra reasoning steps to complex tasks.
- Flash Cyber’s more permissive cybersecurity mitigations restrict initial Fairwind access to selected government, infrastructure and trusted defense partners.
- The above 70% vulnerability discovery rate and autonomous discovery claims rely on internal Gemini benchmarks.
- Doug Turner said generative AI caused an overnight surge in vulnerabilities submitted through Chrome’s research program.
- Attackers need to find only one serious flaw, while defenders must remove every exploitable weakness across millions of lines of code.