Google DeepMind Releases Gemini 3.8 Flash and a Cybersecurity Edition

Google DeepMind has announced the Gemini 3.8 family of models — the third Flash release in just six weeks. According to the company, it is its best model to date for reasoning and writing code, while preserving the speed and low cost of its predecessor, Gemini 3.7 Flash. Two variants have been introduced, both built on a shared foundation.

Gemini 3.8 Flash

The core model is geared toward long-running coding tasks and autonomous agents. DeepMind claims that on the DeepSWE v1.1 benchmark it outperforms most larger and more expensive models when solving complex engineering tasks end to end, and that it also delivers the best results in specialized areas — financial and legal analysis (Vals Finance Agent V2, Harvey's Legal Agent Benchmark). On the HLE-Verified test, the model scored 54.9%.

Its key feature is presented with no false modesty: the model “works harder.” On difficult tasks it performs additional reasoning steps and iteratively calls tools, which sometimes means higher token consumption. For scenarios where saving costs matters more, developers are advised to lower the “effort level” or stay on 3.7 Flash.

The introductory pricing is $0.75 per million input tokens and $3.75 per million output tokens; on January 1, 2027, the rates will double. As demonstrations, the company points to projects created from a single prompt: a 3D game about a wizard in a castle, a working version of Google Maps in a DOS aesthetic, and an interactive 3D visualizer of a device teardown.

Gemini 3.8 Flash Cyber

The second variant is intended for cybersecurity and is available only to vetted defenders through the new Fairwind program — government bodies, critical infrastructure operators, and software maintainers. The emphasis is squarely on defense: DeepMind stresses that from the outset priority was given to fixing vulnerabilities rather than to offensive capabilities such as exploitation.

On the CyberGym benchmark, the model outperforms far larger frontier systems, according to the company, and on an internal test across 20 programming languages it achieves over 70% success in detecting vulnerabilities. On automated patching tasks (CWE-Bench), its pass@1 result was 47.2% versus 47.8% for the leader — at a markedly lower cost.

Google is already using the model internally: the Chrome security team reports that it produces 2.6 times more correct patches than large commercial counterparts, and specialists at Cloud Vulnerability Research used it to find a critical vulnerability in under two hours instead of the usual months.

Both models come with safeguards against misuse in the CBRN and offensive cyber domains and, according to DeepMind, are noticeably more resistant to prompt-injection attacks.

Source: Google DeepMind