Google has introduced Gemini 3.8 Flash Cyber, a specialized AI model focused on cybersecurity. This model is designed to autonomously identify software vulnerabilities, generate code fixes, and validate patches before deployment.
Access to this model is restricted to vetted defenders through Google’s new Fairwind Program, which aims to provide advanced cyber capabilities to government agencies, critical infrastructure operators, and major software maintainers.
The launch comes just three weeks after Gemini 3.7 Flash, marking Google’s third release in the Flash family within six weeks. In addition to the cybersecurity-specific variant, Google also introduced Gemini 3.8 Flash, a general-purpose reasoning and coding model.
This model is priced at $0.75 per million input tokens and $3.75 per million output tokens during its introductory period. Google states that this standard model enhances long-term software engineering, agentic workflows, tool usage, and multi-step reasoning while maintaining the speed and cost efficiency of its predecessor.
Gemini 3.8 Flash Cyber is built on the foundational intelligence of the standard Flash model but is specifically trained and configured for vulnerability research and remediation.
Its key feature is an agentic workflow that can iteratively inspect code, test potential findings, reason about suitable repairs, produce patches, and verify whether the changes resolve the underlying vulnerabilities without disrupting intended functionality.
Google also offers the CodeMender harness to help security teams implement these steps within a secure cloud environment.
Gemini 3.8 Flash Cyber Features:
| Feature | Gemini 3.8 Flash Cyber details |
|---|---|
| Primary function | Autonomous vulnerability discovery, verification, automated patch generation, and validation |
| Access model | Restricted to approved trusted defenders through the Fairwind Program |
| Vulnerability benchmark | Google says the model surpasses Gemini 3.5 Flash Cyber and larger frontier models on CyberGym |
| Internal discovery test | More than 70% success rate across complex codebases covering 20 programming languages |
| Automated patching | 47.2% pass@1 on CWE-Bench, versus 47.8% for a leading frontier model |
| Reported Chrome result | 2.6 times more correct vulnerability patches than larger commercial models |
| Governance | User authentication, phishing-resistant MFA, access controls, monitoring, and due-diligence checks |
For vulnerability discovery, Google reports that Gemini 3.8 Flash Cyber performed at a frontier level on CyberGym, an industry benchmark for identifying software vulnerabilities.
The model was evaluated against an internal benchmark involving 20 programming languages instead of just focusing on C and C++ codebases, achieving a success rate of over 70%. However, the underlying benchmark corpus and methodology have not been independently published.
Automated remediation plays a central role in Google’s strategy. On Collinear’s CWE-Bench, Gemini 3.8 Flash Cyber achieved a 47.2% pass rate on the first patch attempt, closely matching a leading frontier model’s score of 47.8%.
At the same time, Google claims it has lower operational costs. In internal deployments, Google’s Chrome Security team reportedly generated 2.6 times as many correct patches as larger commercial models.
Wiz also reported a 7.5% to 9.7% improvement on recall on its internal penetration-testing benchmark, while incurring costs 2.3 to 5.2 times lower.
Google Cloud’s Vulnerability Research team utilized the model to uncover a critical foundational vulnerability in under two hours, a task that typically takes months.
While these results are impressive, they should be interpreted as vendor-reported outcomes rather than universal indicators of production performance.
The quality of patches highly depends on factors such as source code context, test coverage, build environments, dependency behavior, and human review.
To mitigate misuse risks, participants in the Fairwind Program may use Gemini 3.8 Flash Cyber for authorized threat simulation, reverse engineering, and defensive malware analysis, but not for malicious activities like malware creation.
Organizations must restrict access to internal cybersecurity, incident response, and penetration testing staff. Google conducts organizational vetting and prohibits redistribution of model access. Currently, the program collaborates with over 650 partners worldwide.
For defenders, this announcement signifies a shift from AI-assisted code scanning to AI-driven vulnerability remediation processes.
The practical security benefits will not only depend on the ability to find more flaws but also on whether organizations can safely integrate validated, reviewable, and deployment-ready patches into their software development and incident response processes.
Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…