Google has unveiled Gemini 3.8 Flash Cyber, a specialized artificial intelligence model designed to identify and fix software vulnerabilities at unprecedented speed and accuracy. The model, announced alongside a standard Gemini 3.8 Flash variant, represents a significant shift in how organizations can defend their code against security threats. In real-world testing on Chrome security bugs, the model produced 2.6 times more correct vulnerability patches than much larger AI models, while operating at a fraction of the cost.

The launch comes as organizations face a growing challenge: traditional cybersecurity approaches require choosing between expensive, powerful AI models that are difficult to deploy across large codebases and smaller models that struggle with complex vulnerability fixes. Google's new approach aims to solve this dilemma by combining Gemini 3.8 Flash Cyber with its CodeMender system, which autonomously discovers vulnerabilities, reasons through potential fixes, validates the code, and generates deployment-ready patches.

What Makes This Cyber Model Different From Other AI Tools?

Gemini 3.8 Flash Cyber is built specifically for cybersecurity work, not general-purpose tasks. The model underwent rigorous training in the cybersecurity domain and represents what Google calls a "significant leap in prompt injection robustness," meaning it's harder for attackers to trick it into revealing sensitive information or bypassing its safety guardrails.

The performance metrics are striking. On the CyberGym cybersecurity benchmark, the model achieved 86.2% accuracy. On CWE-Bench, which specifically evaluates AI's ability to patch vulnerabilities, it scored 47.2%. In internal Google testing, the model achieved over 70% success rate discovering vulnerabilities across 20 different programming languages. To put this in practical terms, Google's Cloud Vulnerability Research team discovered a critical foundational vulnerability in less than 2 hours using the model, a task that typically takes months of human expert work.

"In evaluations on real Chrome security bugs, 3.8 Flash Cyber produced 2.6x more correct patches for vulnerabilities than larger models," said Sundar Pichai, Google CEO.

Sundar Pichai, CEO at Google

The speed improvement is equally impressive. The combination of Gemini 3.8 Flash Cyber and CodeMender can reduce the time required to address vulnerabilities from weeks of manual work to minutes, all while operating within an organization's secure cloud environment.

How to Access Google's New Cybersecurity AI Model

• Fairwind Program Participants: Government agencies, national cyber authorities, critical infrastructure operators, and core technology platforms in healthcare, telecommunications, energy, and financial networks can apply for access to Gemini 3.8 Flash Cyber through Google's limited-access Fairwind Program.
• Operational Requirements: Access is subject to strict safeguards including limiting use to internal cybersecurity, incident response, and penetration-testing teams, along with multi-factor authentication and other security controls.
• Google Cloud Customers: Other Google Cloud customers can use CodeMender with publicly available models through the Gemini Enterprise Agent Platform, though they won't have access to the specialized Cyber variant initially.

Google said more than 650 partners globally are already participating in the Fairwind Program, and the company plans to expand access and evolve the program with its partners over time.

Why This Matters in the Age of AI-Powered Attacks

The timing of this release reflects a growing crisis in cybersecurity. Chrome engineering director Doug Turner described what he called a "vulnerability apocalypse" in recent months due to generative AI. "Simply overnight, we saw a hockey stick increase in the number of software vulnerabilities reported through our vulnerability research program," he explained. One particularly striking example: Gemini 3.8 Flash Cyber discovered a subtle bug that had been hiding in Chromium and Chrome for 13 years, despite being reviewed by dozens or hundreds of engineers.

Doug Turner

The core problem is asymmetrical: attackers only need to find one significant flaw among millions of lines of code to breach a system, while defenders must eliminate every single vulnerability. As AI tools become more accessible to threat actors, defenders need equally powerful tools. Wiz, a cybersecurity company that Google acquired earlier this year for $32 billion, tested the model and found it had 7.5% to 9.7% higher detection rates for real-world vulnerabilities compared to leading frontier models, while costing 2.3 to 5.2 times less to operate.

The standard Gemini 3.8 Flash model, released alongside the Cyber variant, also represents a significant upgrade. It's designed for agentic tasks (where AI systems work autonomously toward goals), software development, and multi-step reasoning. The model outperformed many large frontier models on the DeepSWE coding benchmark, a widely used test for evaluating AI coding abilities, while maintaining lower operational costs. It's available now in Gemini Enterprise at introductory pricing of $0.75 per million input tokens and $3.75 per million output tokens.

Google CEO Sundar Pichai emphasized that the new models represent "significant leaps" from the previous 3.7 Flash version across software engineering, agentic tasks, and multi-step reasoning capabilities. The company is releasing Flash variants rapidly, with 3.8 being the third Flash release in six weeks, signaling Google's aggressive push to compete in the fast-moving AI market.