Google has announced Gemini 3.8 Flash and Gemini 3.8 Flash Cyber, two variants built around the same underlying intelligence but aimed at different environments. The standard Flash model is positioned as a faster, lower-cost workhorse with stronger coding and multi-step reasoning. The Cyber variant is specialised for vulnerability discovery and patching, with access restricted to trusted defenders through Google’s Fairwind Program. The interesting part of the announcement is not a single leaderboard number: it is the breadth of tasks Google is using to show how the models behave when work extends beyond one short answer.
Two Gemini 3.8 models, two operating profiles
Gemini 3.8 Flash is the general-purpose release. Google describes it as its most intelligent workhorse model, with improvements over Gemini 3.7 Flash in software engineering, agentic tasks and difficult reasoning across specialised domains. The company says it is offered at the same introductory price as 3.7 Flash: $0.75 per million input tokens and $3.75 per million output tokens.
Gemini 3.8 Flash Cyber is narrower. It is tuned for defensive cybersecurity work, including finding vulnerabilities and generating patches. Google says it is available to trusted defenders through the Fairwind Program, rather than as a generally available model for any developer or business.
The common design idea is that the model can work harder when the task justifies it. Google says Gemini 3.8 Flash may take more reasoning steps and call tools iteratively, especially at higher effort levels. That can improve difficult-task performance, but it can also increase token usage and latency. Lower effort settings, or Gemini 3.7 Flash, remain relevant when compute efficiency is the main constraint.
This trade-off is important: the new model is not simply claiming to answer faster. It is claiming to spend its budget more intelligently on work that needs planning, verification and several connected actions.
How to read the Gemini 3.8 Flash benchmarks
Google’s announcement covers coding, professional analysis and general reasoning. The benchmarks do not all measure the same thing, so their results should not be compressed into one overall ranking.
| Benchmark | What it is used to assess | What Google reports |
|---|---|---|
| DeepSWE v1.1 | Long-horizon software engineering and end-to-end problem solving | Gemini 3.8 Flash outperforms most larger frontier models at a fraction of the cost |
| Vals Finance Agent V2 | Finance-agent work involving quantitative and professional analysis | Gemini 3.8 Flash outperforms Gemini 3.7 Flash and other frontier models |
| Harvey’s Legal Agent Benchmark | Legal-agent work in a professional domain | Gemini 3.8 Flash outperforms Gemini 3.7 Flash and other frontier models |
| HLE-Verified | Multi-step reasoning across STEM, humanities and professional fields | 54.9% |
The first lesson is that Google is testing more than recall or short-form question answering. These evaluations are meant to put the model inside a task: inspect a problem, reason through several steps, use tools where needed and produce an outcome.
DeepSWE v1.1: can the model stay on a long engineering task?
DeepSWE v1.1 is the clearest signal for software engineering. Google labels it Long-Horizon Software Engineering and says Gemini 3.8 Flash can autonomously solve complex engineering problems end to end, outperforming most larger frontier models at a fraction of the cost.
“Long horizon” changes the question being asked. A short coding benchmark can test whether a model writes a plausible function. A long-horizon task is closer to an engineering loop: understand an unfamiliar codebase or issue, plan a change, edit several files, run checks, interpret failures and revise the result.
The announcement does not state a numeric DeepSWE score in its text, so the responsible takeaway is comparative rather than numerical. Google is presenting 3.8 Flash as a smaller, faster workhorse that can compete with larger models on sustained engineering tasks. That is a meaningful claim, but it still depends on the benchmark harness, tool permissions, prompts and effort settings used in the evaluation.
Vals Finance Agent V2 and Harvey’s Legal Agent Benchmark: can it work with professional constraints?
The Vals Finance Agent V2 and Harvey’s Legal Agent Benchmark extend the test beyond coding. Google places both in the context of quantitative and professional fields that require advanced analysis and reporting.
These benchmarks matter because professional work has a different failure profile from a coding exercise. The model may need to identify relevant evidence, keep track of constraints, reason across several pieces of information and present an answer that can be reviewed. A fluent paragraph is not enough if the calculation is wrong, an assumption is hidden or an important qualification is missing.
Google reports that Gemini 3.8 Flash outperforms Gemini 3.7 Flash and other frontier models on these evaluations. The announcement does not provide numeric scores, sample sizes or full test protocols. They are best treated as evidence of broader ambition and capability—not as proof that the model can replace a finance or legal professional.
HLE-Verified: a visible number for difficult reasoning
Google reports a 54.9% score on HLE-Verified, saying the result demonstrates multi-step reasoning across STEM, humanities and professional fields.
The useful way to interpret this number is not “the model understands 54.9% of knowledge”. It is a score on a particular evaluation set under a particular protocol. HLE-Verified is valuable here because it spans several types of difficult reasoning, but it remains a benchmark result rather than a guarantee of factual accuracy in a live setting.
For a team evaluating the model, HLE-Verified suggests where to look next: tasks that require combining evidence, making intermediate deductions and resisting the temptation to answer before the reasoning is complete. It does not remove the need for current sources, domain review or a way to check the final answer.
What the Cyber variant adds
Gemini 3.8 Flash Cyber is not just a marketing label attached to the general model. Google describes a distinct defensive profile, with stronger capabilities for vulnerability discovery and patching and a more permissive set of cybersecurity mitigations. Because those capabilities can also be misused, access is limited through the Fairwind Program.
CyberGym: autonomous vulnerability discovery
Google calls CyberGym the standard industry benchmark for finding vulnerabilities. On this test, the company says Gemini 3.8 Flash Cyber reaches frontier-level performance, surpassing Gemini 3.5 Flash Cyber and significantly larger frontier models.
The relevant capability is discovery: can the model inspect code, reason about how it behaves, identify a weakness and demonstrate enough understanding for the finding to be useful to a defender? This is different from producing a generic security checklist. It tests whether an agent can search a complex technical space and locate defects that are easy to miss manually.
Google does not state a numeric CyberGym score in the announcement body. The comparison should therefore be read as a Google-reported capability claim, not as an independently verified ranking.
Internal vulnerability discovery across 20 languages
Google also reports an internal benchmark covering complex codebases and a wide range of vulnerabilities across 20 programming languages. Gemini 3.8 Flash Cyber achieved a success rate above 70%.
The result is interesting because real codebases are not limited to the C and C++ focus of some public security evaluations. At the same time, this is an internal benchmark: Google does not publish its name, dataset, scoring protocol or exact result in the announcement. It should not be described as a standardised public benchmark or assumed to reproduce across every organisation’s code.
CWE-Bench: does the model produce a correct patch on the first attempt?
CWE-Bench, run by Collinear, evaluates patching capabilities. Here the reported metric is pass@1, which means the proportion of tasks solved by the first sampled attempt under the benchmark’s conditions.
Google reports 47.2% pass@1 for Gemini 3.8 Flash Cyber, compared with 47.8% for a leading frontier model, while saying Gemini is available at significantly lower cost.
This is a useful result precisely because it is close. It does not show that Gemini wins on raw patching quality. It shows a model operating near the leading result on this evaluation while making a cost-efficiency argument. It also shows why a benchmark metric needs context: pass@1 is not the same as “47.2% of all production vulnerabilities can be safely fixed”. Human review, regression tests, patch quality and the consequences of a missed or incorrect fix still matter.
Google’s real-world examples are signals, not benchmark replacements
The announcement adds several examples from Google and partners:
- Google’s Chrome Security team reports that Gemini 3.8 Flash Cyber produced 2.6 times more correct patches to Chrome vulnerabilities than the best commercial models that were much larger.
- Wiz reports 7.5–9.7 percentage points higher recall on its internal penetration-testing benchmark, at 2.3–5.2 times lower cost than other leading frontier models.
- Google’s Cloud Vulnerability Research team says it used the model to find a critical foundational vulnerability in less than two hours, compared with research and discovery that usually takes months.
These examples make the results more concrete, but they are not interchangeable with a public, reproducible benchmark. The announcement does not specify the comparison models, sample sizes, full methodology or cost calculation for the Chrome and Wiz claims. The two-hour discovery example is a case report, not an average speed measurement.
The distinction is not a criticism of the model. It is simply the difference between a result under a named evaluation, an internal test, and an example from a real team. Each can be useful, but each answers a different question.
The most important result may be the model’s behaviour under effort
The broader pattern in Google’s announcement is a shift from “how good is the answer?” to “how much useful work can the model complete before a person needs to intervene?”
Gemini 3.8 Flash is designed to use more reasoning and tool calls on difficult tasks. That may help with long-running code changes, professional analysis and agentic workflows. But it creates a second metric to watch: the relationship between quality and effort.
A model that scores well while consuming twice as many tokens may not be the right choice for every task. A model that produces a stronger first pass but takes longer may still be valuable where rework is expensive. The practical comparison is therefore not just benchmark score or token price. It is:
completed work = quality of the result + reliability of the process + time and compute required to reach it
This is why the same model can be a strong choice for one workflow and an unnecessary choice for another.
Coming soon to Botchi
Gemini 3.8 Flash will be available soon on Botchi. The model is a natural fit for teams that want to compare evolving models inside a stable working environment rather than rebuild their tools and context each time a new release appears.
Botchi’s role is not to turn a benchmark into a promise. It provides a governed place to connect model choice with company knowledge, tools, specialist agents, permissions, approvals and usage attribution. That makes it easier to test the model on real work while keeping the workflow reviewable and replaceable.
The Cyber variant is a separate case: Google describes access through the Fairwind Program for trusted defenders, so its availability should not be assumed to be the same as standard Gemini 3.8 Flash.
Frequently asked questions
Is Gemini 3.8 Flash better than every other model?
The Google announcement reports strong comparative results on selected coding, professional-agent and reasoning evaluations. It does not establish universal superiority. Performance depends on the task, prompts, tools, effort level, evaluation protocol and cost constraint.
What does 47.2% pass@1 on CWE-Bench mean?
It means Google reports that 47.2% of the benchmark’s patching tasks were passed on the first sampled attempt under the benchmark conditions. It is not a general production patch-success rate and does not remove the need for tests and human review.
Is Gemini 3.8 Flash Cyber generally available?
No general availability should be assumed. Google says it is available to trusted defenders through the Fairwind Program. It is a specialised defensive cybersecurity model, not simply the standard Flash model with a different name.
Will Gemini 3.8 Flash be available on Botchi?
Yes, it is coming soon to Botchi. The exact availability date and route are not specified here. Standard Gemini 3.8 Flash and the restricted Cyber variant should be treated as separate availability questions.