Google released Gemini 3.8 Flash and Flash Cyber on September 2, its third Flash model in six weeks, with improved coding benchmarks, the same context window as 3.7 Flash, and pricing that doubles in January 2027.

Google on September 2 released Gemini 3.8 Flash, its third Flash-tier model in six weeks, alongside a security-focused sibling called Gemini 3.8 Flash Cyber. The standard model is positioned as a workhorse for agentic tasks, software development, and multi-step reasoning, while Flash Cyber is tuned for vulnerability discovery and automated patching.

The release follows 3.6 Flash and 3.7 Flash in rapid succession, a cadence that signals Google is using the Flash family as its main vehicle to close ground on Anthropic and OpenAI in agentic coding and long-horizon reasoning, areas where it has historically trailed since the Gemini 1.x generation.

What changed from 3.7 Flash

Gemini 3.8 Flash is not built on a new base model. Google is explicit that it uses the same underlying architecture as 3.7 Flash, reconfigured to spend more reasoning tokens per query. The model works harder by committing additional inference compute per call, producing higher-quality outputs at the cost of higher reasoning latency and greater output-token consumption. Google recommends developers prioritizing cost efficiency and speed over maximum output quality remain on 3.7 Flash, noting the two models are not interchangeable in cost or latency terms.

In an X post, CEO Sundar Pichai said 3.8 Flash delivers “significant leaps” over 3.7 Flash across software engineering, agentic tasks, and multi-step reasoning.

On DeepSWE, a benchmark that evaluates end-to-end completion of software engineering tasks including codebase navigation, code implementation, and test passage, Gemini 3.8 Flash scores 73.7%, against 74.0% for Anthropic's Claude Opus 5 — a difference of 0.3 percentage points and the closest Google has come to Anthropic on a coding evaluation across the Gemini 3.x family. Third-party aggregators still rank coding as the model's weakest capability relative to reasoning and instruction following.

The model also scores 54.9% on HLE-Verified, Humanity's Last Exam verified subset, reflecting its capacity for multi-step reasoning across math, science, and humanities. Google reports it outperformed its predecessor and other frontier models on the Vals Finance Agent V2 finance benchmark and Harvey's Legal Agent Benchmark for law. On Terminal-Bench 2.1, the model crossed 90.8%, a 9.2 percentage-point jump over 3.7 Flash.

Context window and pricing

Gemini 3.8 Flash accepts up to 1,048,576 input tokens and generates up to 65,536 output tokens — the same dimensions as 3.7 Flash. It handles text, images, audio, video, and PDF input natively.

Pricing is $0.75 per million input tokens and $3.75 per million output tokens through December 31, 2026, matching 3.7 Flash's introductory rates. On January 1, 2027, both prices double: input moves to $1.50 per million tokens and output to $7.50 per million. Teams building production applications face a four-month window at the promotional rate before costs increase, a consideration that matters particularly for agent workloads that generate large output-token volumes through multi-step reasoning traces.

Because 3.8 Flash spends more thinking tokens per call than 3.7 Flash at the same prompt, complex tasks can consume more tokens and therefore cost more than equivalent requests on the older model.

Flash Cyber: security variant

Alongside the standard model, Google launched 3.8 Flash Cyber, a variant of the same base model carrying additional output restrictions calibrated for professional cybersecurity use — security research, enterprise security operations, and threat analysis. The dual-configuration approach mirrors Anthropic's September 1 release strategy, in which Fable 5.1 and Mythos 5.1 shipped as configurations of one base model with different safeguard levels.

Google reports Flash Cyber scored 86.2% on the CyberGym cybersecurity benchmark and 47.2% on CWE-Bench, which evaluates AI patching ability, close to the 47.8% reported for a leading frontier model. In an internal benchmark, Google says the model achieved more than 70% success discovering vulnerabilities across codebases in 20 programming languages.

Google's own security teams are already using it. The Chrome Security team reported it generated 2.6 times more correct vulnerability patches than the best commercial models it compared against, and Google's Cloud Vulnerability Research team says it identified a critical foundational vulnerability in under two hours with the model — work that typically takes months. Doug Turner, engineering director for Chrome, described a “vulnerability apocalypse” in recent months driven by generative AI, noting a sharp increase in reported software vulnerabilities. One vulnerability Flash Cyber discovered had been present in Chromium and Chrome for 13 years.

These findings come from Google's own testing and teams and should be treated as company-reported rather than independently verified.

Wiz, which Google acquired earlier this year at a reported $32 billion, found Flash Cyber delivered 7.5% to 9.7% higher recall of real-world vulnerabilities on an internal penetration-testing benchmark at 2.3 to 5.2 times lower cost than leading frontier models.

Flash Cyber is initially being rolled out to “trusted defenders” through Google's Fairwind Program, which prioritizes government authorities, critical-infrastructure operators, and other partners. Organizations can apply for access. The model ships more permissive cybersecurity mitigations — the reason it is limited to vetted partners — while retaining safeguards against misuse in cyber offense and in areas like chemical, biological, radiological, and nuclear (CBRN) domains.

Google says it prioritized vulnerability fixing from the start and emphasized it over offensive capabilities such as exploitation.

Availability and model effort controls

Gemini 3.8 Flash is available now in Gemini Enterprise. Developers can try it in the Gemini API via Google AI Studio, Google Antigravity, Android Studio, or by generating UIs in Stitch. Users can adjust model effort levels to balance quality, cost, and latency. Google's senior product director Tulsee Doshi and Gemini security lead Raluca Ada Popa described the model as one that “works harder” and exhibits “greater diligence” on complex tasks, sometimes using more tokens to maximize performance.

Benchmark context

Independent leaderboards place the model competitively. Arena.ai ranked 3.8 Flash No. 14 in Agent Arena, above DeepSeek-V4-Pro and a significant jump from 3.7 Flash at No. 32, and No. 7 in Text Arena, ahead of Claude Opus 5 and Gemini 3.7 Flash. Google's own launch evaluations show the model scoring above 3.7 Flash on every benchmark included, and above Claude Opus 5 on three of them.

Availability of verified third-party results remains limited so soon after release. Early assessments of coding relative performance should be read alongside Google's caveat that 3.8 Flash trades higher compute and latency for quality, and that 3.7 Flash remains the recommended choice for efficiency-first workloads.