Introducing Google Gemini 3.8 Flash & 3.8 Flash Cyber: Next-Gen Intelligence for Coding and Autonomous Cybersecurity

1. Shared Foundational Intelligence: The 'Works Harder' Philosophy

While tailored for distinct deployment environments, both releases are powered by the same foundational intelligence and accelerated by long-running agentic loops designed to recursively evaluate and refine underlying outputs. The coding and reasoning leaps across this core were catalyzed by rigorous training in cybersecurity. These gains stem from a deliberate architectural choice: 3.8 Flash works harder. On intricate tasks, the model exhibits diligent persistence — executing additional internal thought branches and iteratively calling external tools. While it may consume more tokens at higher effort levels to maximize precision, developers can dial down effort levels or continue relying on Gemini 3.7 Flash for compute-constrained workloads.

• Unified Core Intelligence: Sharpened by demanding cyber defense environments to elevate overall code reasoning.
• Recursive Agentic Loops: Autonomous self-evaluation loops that inspect, debug, and refine generated software solutions.
• Granular Effort Controls: Developer flexibility to optimize between raw speed and multi-step reasoning depth.

2. Long-Horizon Coding (DeepSWE v1.1) and Google Antigravity Showcases

On DeepSWE v1.1 (Long-Horizon Software Engineering), Gemini 3.8 Flash outperforms larger, significantly higher-cost frontier models in autonomously resolving complex multi-file engineering issues end-to-end. The model's synergy with Google Antigravity produced jaw-dropping developer showcases: • Procedural 3D Wizard Castle Game: Built with a simple looping prompt in Google Antigravity, featuring custom environmental storytelling, environmental puzzles, and real-time textures generated with Nano Banana. • Playable DOS Google Maps: Generated in a single prompt in Google Antigravity, fully operational with locations, navigation directions, and retro Street View. • Scientific Topographic Map Engine: Leveraged live datasets from the U.S. Geological Survey (USGS) to compute real-time cross-sections, 2D projections, and geological explanations. • Hardware Anatomy Interactive 3D Teardown: Built in Google AI Studio using Three.js, rendering physically-proportioned hardware decompositions with an interactive exploded-view slider.

• Full repository comprehension and multi-file dependency refactoring.
• Autonomous unit test generation, compilation error debugging, and CI/CD alignment.
• Instant generation of interactive UI components and 3D web experiences from raw specifications.

3. Enterprise Benchmarks: Vals Finance Agent v2 and Harvey Legal

In quantitative analysis and domain-specific enterprise autonomy, Gemini 3.8 Flash establishes a commanding lead. On the Vals Finance Agent v2 benchmark, 3.8 Flash scores 61.4%, outperforming Claude Opus 5 (58.6%), GPT-5.6 Terra (54.4%), Claude Sonnet 5 (53.9%), and GPT-5.6 Sol (53.8%). Furthermore, the model surpasses 3.7 Flash and frontier peers on Harvey's Legal Agent Benchmark for statutory interpretation and contract audit, while logging 54.9% on HLE-Verified across STEM, humanities, and professional fields.

• Multi-period cash flow verification and balance sheet anomaly detection.
• Regulatory compliance auditing and contractual dispute analysis.
• Hallucination-resistant analytical reporting for enterprise decision makers.

Gemini 3.8 Flash - Vals Finance Agent v2 Financial Analyst Benchmark

4. Gemini 3.8 Flash Cyber: Autonomous Vulnerability Discovery on CyberGym

In modern software ecosystems, security defenders face an asymmetrical deficit of speed and coverage. Gemini 3.8 Flash Cyber bridges this gap with Flash-tier latency and economical pricing, accessible to verified organizations via the Fairwind Program. On the standard industry benchmark for vulnerability detection, CyberGym Pass@1 (C/C++), the model logged an unprecedented 86.2%. This decisively overtakes 3.5 Flash Cyber (77.5%), GPT-5.6 Sol (83.6%), Mythos 5 (83.8%), and GPT-5.5-Cyber (85.6%).

Gemini 3.8 Flash Cyber - CyberGym Pass@1 Vulnerability Discovery Benchmark

5. Multi-Language Vulnerability Detection Across 20 Codebases

Evaluating models across modern tech stacks — including Python, Go, Rust, Java, TypeScript, C#, and PHP — Gemini 3.8 Flash Cyber is the first efficient model to break through the 70% detection threshold. It systematically maps complex architectural flaws before attackers can exploit them.

• Uncovering SQL injection, SSRF, IDOR, and Remote Code Execution vectors.
• Detecting authentication flaws across distributed microservice architectures.
• Proactively auditing open-source package dependencies for zero-day risks.

Gemini 3.8 Flash Cyber - Vulnerability Discovery Across 20 Programming Languages (71.0%)

6. Automated Patching and the CWE-Bench Pareto Frontier

Google DeepMind made a conscious ethical commitment: prioritizing defensive patch generation over offensive exploitation. On Collinear's external CWE-Bench Pass@1 vs. Cost per Rollout leaderboard, Gemini 3.8 Flash Cyber defines the Pareto frontier: Achieving 47.2% Pass@1 at an average cost of roughly $3.60 per rollout, it rivals Fable 5 (47.8%) which demands more than $10 per rollout (nearly 3x more expensive). It firmly outperforms GPT 5.6 Sol (44.3%), Opus 4.8 (41.5%), Grok 4.6, and DeepSeek V4 Flash in both accuracy and economic viability.

Gemini 3.8 Flash Cyber - CWE-Bench Pass@1 vs. Cost per Rollout Pareto Curve

7. Real-World Production Impact: Google, Chrome, and Wiz

Gemini 3.8 Flash Cyber is already securing production software at massive scale: • Chrome Security Team: Found that 3.8 Flash Cyber generated 2.6x more valid security patches for vulnerabilities in Chromium than significantly larger commercial models. • Wiz (Cloud Security Leader): Recorded +7.5% to +9.7% higher recall on internal penetration testing benchmarks at a 2.3x to 5.2x lower cost compared to other frontier models. • Google Cloud Vulnerability Research: Identified a critical foundational infrastructure vulnerability in under 2 hours, a task that previously required months of dedicated human research.

• Automated patch verification across large-scale browser engines and OS kernels.
• Auto-remediation of cloud misconfigurations and privilege escalation vectors.
• Compressing incident response investigations from weeks into hours.

8. Gray Swan IPI Benchmark and Prompt Injection Immunity

Indirect Prompt Injection (IPI) poses an existential risk to autonomous agents that ingest untrusted web pages, emails, or user documents. On the rigorous Gray Swan IPI benchmark (measuring Attack Success Rate within k attempts — where lower is better): • Gemini 3.8 Flash: Achieved a stellar 5.5% ASR, ranking as the safest general model in the industry. • Gemini 3.8 Flash Cyber: Achieved an ultra-resilient 6.0% ASR. In contrast, competing models suffered alarming breach rates: DeepSeek V4 Pro (60.1%), Kimi K3 (52.7%), Grok 4.6 (51.8%), and GPT 5.6 Luna (50.0%). Built in strict adherence to the Frontier Safety Framework, 3.8 Flash enforces comprehensive defenses against CBRN and offensive misuse.

• Full immunity against adversarial hidden text, CSS exploits, and delimiter spoofing.
• Cryptographic safeguard filters preventing unauthorized external API executions.
• Enterprise data leak prevention for multi-tenant AI deployments.

Gemini 3.8 Flash and Cyber - Gray Swan Indirect Prompt Injection Benchmark

9. Developer and Enterprise Ecosystem Availability

Google is rolling out Gemini 3.8 across its product suite immediately: • Developers: Build agentic loops in Google Antigravity, query the Gemini API via Google AI Studio and Android Studio, or craft dynamic UIs with Stitch. • Enterprises: Deploy secure multi-agent workflows inside Gemini Enterprise. • Consumers: Available to Google AI Pro and Ultra subscribers in the Gemini app, Google Search AI Mode, and Google Sheets. • Cyber Defenders: Critical infrastructure operators and open-source stewards can apply for prioritized access via the Fairwind Program.