Google DeepMind on Wednesday released Gemini 3.8 Flash Cyber, a specialized version of its Flash model built to hunt down software vulnerabilities and generate the patches that close them. The company says the model produces 2.6 times more correct fixes for Chrome bugs than the best commercial rivals its browser team tested.

 

The launch pairs a general Gemini 3.8 Flash aimed at coding and agent workloads with a Cyber variant reserved for verified defenders through Google's Fairwind Program. Both models were introduced in a September 2 post from Google DeepMind alongside benchmarks and statements from enterprise security partners.

 

Related Coverage

 

How Gemini 3.8 Flash Cyber Works

 

Google trained the Cyber variant to reason across large codebases in more than 20 programming languages, spotting flaws such as memory-safety bugs and logic errors that pass human review. The system then drafts a fix, tests its own patch in an agentic loop, and refines the code before handing a proposed change to a human reviewer.

 

The model supports a 1 million token input window and up to 64,000 output tokens, giving it room to load an entire library and its dependencies before proposing a repair. Google says the same underlying architecture powers the general Flash model, but the Cyber variant carries security-focused fine-tuning and looser mitigations restricted to trusted operators.

 

Chrome Patches at Frontier Level

 

The clearest test came inside Google's own Chrome team. The Cyber variant produced 2.6 times more correct patches for real Chrome vulnerabilities than the best commercial models the browser team benchmarked against, according to the launch post. The system also flagged a Chromium bug that had lived undetected in the code for 13 years.

 

Chrome engineering director Doug Turner told reporters that the industry is facing what he described as a "vulnerability apocalypse" as generative AI accelerates the discovery of exploitable flaws in production code. Google Cloud's vulnerability research team separately said the model identified a critical issue in under two hours, work its analysts said typically stretches into months.

 

"We are delivering frontier-level performance when it comes to discovering vulnerabilities and patching them at scale."

 

The line came from Google chief executive Sundar Pichai, whose company has staked much of its enterprise pitch on defensive AI that can absorb the load on overwhelmed security teams.

 

Benchmarks and the Cost Argument

 

Gemini 3.8 Flash Cyber scored 86.2 percent on CyberGym, a vulnerability discovery benchmark, and 47.2 percent on CWE-Bench, a widely used patching evaluation. Google said the Cyber variant matched leading frontier models on CWE-Bench at between 2.3 and 5.2 times lower cost per run.

 

Independent testing at cloud-security firm Wiz found the model returned 7.5 to 9.7 percent higher recall of real-world vulnerabilities than rival frontier systems. In internal Google runs across the 20 supported languages, the model logged a 71 percent success rate at identifying planted flaws.

 

The company priced the standard Gemini 3.8 Flash at $0.75 per million input tokens and $3.75 per million output tokens through the end of 2026, keeping the Flash tier well below its Pro-class models. Cyber pricing was not disclosed publicly.

 

Inside the Fairwind Program

 

Access to Gemini 3.8 Flash Cyber runs through Google's Fairwind Program, an invitation-only track that limits distribution to vetted defenders such as government agencies, critical-infrastructure operators and named security vendors. Palo Alto Networks, Snowflake, Wiz and startup Armadin were listed among the launch partners.

 

Google said the Cyber model ships with the same restrictions on chemical, biological, radiological and nuclear content that gate its wider Gemini range, but with looser cybersecurity mitigations so approved defenders can generate the exploit-adjacent code needed to build a patch. The model scored a 6 percent attack success rate on the Gray Swan prompt-injection test, an area rivals have struggled to close.

 

The Fairwind track carries three access tiers:

 

  • Government and critical-infrastructure defenders vetted by Google's security review
  • Named commercial security partners already integrating Gemini into their products
  • Academic and non-profit vulnerability researchers running defensive work

 

Google said applications for the program remain open, with additional partners expected to be announced over the coming quarter.

 

Pressure on Rival Frontier Labs

 

The launch lands in a market where OpenAI, Anthropic and DeepSeek are all pushing security-focused variants of their frontier models. Google's benchmark package cited superior performance against Claude Opus 5 and DeepSeek-V4-Pro on the specific cybersecurity workloads it tested.

 

Whether the Cyber twin can hold that lead outside curated benchmarks is now the question inside enterprise security operations centers. Fairwind partners will provide the first real-world signal, and if the Chrome-team numbers generalize, defensive AI could shift from a novelty pilot to a standard line item in security budgets.