Google is accelerating its pace in the competitive race for artificial intelligence dominance, unveiling two significant new iterations of its "Flash" model series this Wednesday. The release of Gemini 3.8 Flash and the specialized Flash Cyber model marks the company’s third major release in just six weeks, highlighting a strategic push to provide developers and security professionals with more efficient, capable, and cost-effective tools for complex, agentic workloads.
The primary release, Gemini 3.8 Flash, is positioned as a "workhorse" model designed to handle sophisticated software development, multi-step reasoning, and agentic tasks—actions where an AI independently executes a sequence of operations to achieve a goal. Alongside it, Google introduced Flash Cyber, a version of the model specifically fine-tuned for the rigorous demands of vulnerability detection and automated code remediation.
Google CEO Sundar Pichai announced the launch on X, noting that the 3.8 iteration represents "significant leaps" over the preceding 3.7 Flash model. According to internal data, the new model has demonstrated superior performance compared to many large, high-end frontier models on the DeepSWE coding benchmark, all while operating at a drastically reduced cost.
3.8 Working "Harder" with "Greater Diligence"
The Gemini 3.8 Flash model is available immediately within the Gemini Enterprise platform. For developers, the model can be accessed via the Gemini API through Google AI Studio, Google Antigravity, Android Studio, and the Stitch UI generation platform. Pricing remains consistent with the introductory rates of its predecessor, set at $0.75 per million input tokens and $3.75 per million output tokens. This structure allows users to adjust model effort levels based on specific project requirements regarding quality, cost, and latency.
Senior product director Tulsee Doshi and Gemini security lead Raluca Ada Popa explained in a joint blog post that 3.8 Flash is designed to work "harder" and with "greater diligence." While the model may occasionally utilize more tokens to achieve optimal performance during complex reasoning tasks, it offers a robust 1-million-token input window and a 64,000-token output limit. Crucially, the model retains its multimodal versatility, capable of ingesting and processing text, images, audio, video, and PDF files.
For organizations where compute efficiency is the primary concern, Google confirmed that Gemini 3.7 Flash remains fully supported. However, for those requiring deeper analysis, 3.8 Flash has shown marked improvements across a broad spectrum of evaluations, including scientific reasoning, multimodal capabilities, and long-context knowledge work.
In comparative testing, 3.8 Flash outperformed both its predecessor and various frontier-level models on specialized benchmarks such as the Vals Finance Agent V2 for financial analysis and Harvey’s Legal Agent Benchmark for the legal sector. Furthermore, the model achieved a score of 54.9% on the "Humanity’s Last Exam (HLE)-Verified" benchmark, a challenging assessment of multi-step reasoning across disciplines like mathematics, science, and the humanities.
The practical applications of this increased capability are diverse. Google demonstrated the model’s potential by having it build a functional 3D game based on a simple text prompt. Using looping techniques within the Antigravity platform, the model integrated puzzle elements and dynamic, environment-based storytelling, utilizing textures from Nano Banana to render a 3D wizard navigating a castle. Other impressive demonstrations included the creation of a fully functional DOS version of Google Maps—complete with interactive street views and directions—as well as a 3D visualizer that allows users to decompose complex devices into layers for inspection using a slider.
The model’s performance shift is also reflected in external rankings. According to Arena.ai, Gemini 3.8 Flash climbed to the 14th spot in the "Agent Arena" rankings, significantly outpacing the 3.7 Flash model, which sits at number 32. In the "Text Arena," the new model debuted at number 7, placing it ahead of competitors like Claude Opus 5. Improvements were noted across multiple domains, including long-query handling, instruction following, literature, and business management.
Flash Cyber is Already Securing Google’s Code
While the standard 3.8 Flash is aimed at general enterprise productivity and coding, Flash Cyber is a specialized tool developed to address a growing crisis in cybersecurity. Recognizing the threat posed by the "vulnerability apocalypse"—a term used by Chrome engineering director Doug Turner to describe the surge in software flaws—Google is initially rolling out Flash Cyber to "trusted defenders" via its Fairwind Program. This program prioritizes access for government authorities, critical-infrastructure operators, and partners who require advanced defensive capabilities.
The model has undergone rigorous training in the cybersecurity domain and is engineered to exhibit increased robustness against "prompt injection," a common attack vector where bad actors attempt to manipulate AI models into ignoring their safety protocols. According to Google, Flash Cyber is exceptionally proficient at both autonomous vulnerability discovery and automated patching.
Google is already leveraging this model to protect its own infrastructure. In internal tests, the company reported that Flash Cyber produced 2.6 times more correct patches for Chrome vulnerabilities than much larger commercial models. Similarly, Wiz—the cybersecurity firm acquired by Google earlier this year—found that the model achieved a 7.5% to 9.7% higher recall of real-world vulnerabilities during internal penetration testing, all while costing between 2.3 and 5.2 times less than leading industry alternatives.
The speed of this discovery process is perhaps the most striking metric. Google’s Cloud Vulnerability Research team successfully identified a critical foundational vulnerability in less than two hours using the new model—a task that would typically require months of manual research.
The necessity of such a tool is underscored by the changing landscape of digital security. As Popa noted, AI agents have become incredibly skilled at finding and exploiting vulnerabilities. In a high-stakes environment where attackers only need to discover one flaw in millions of lines of code to succeed, defenders must identify and remediate every single potential point of failure. The sheer volume of code makes this an overwhelming task for human teams.
Turner provided a concrete example of the model’s impact, noting that Flash Cyber identified a "very subtle bug" within Chromium that had remained undetected for 13 years. Despite having been reviewed by hundreds of engineers over more than a decade, the vulnerability remained until the AI flagged it. "Gemini 3.8 Flash Cyber is going to allow us to create better suggested fixes so that developers’ lives can get a lot easier," Turner stated.
To ensure responsible development, Google has implemented a more permissive set of cybersecurity safeguards for this version, while simultaneously restricting its use to prevent it from being employed for offensive cyber attacks or the development of chemical, biological, radiological, or nuclear (CBRN) threats. By prioritizing vulnerability mitigation over exploitation, the company aims to provide a definitive advantage to those tasked with defending the global digital infrastructure. Organizations interested in accessing these capabilities may apply through the official channels as Google continues to expand the reach of its specialized defense-focused AI.
