Google has unveiled Gemini 3.8 Flash, a new fast, lower-cost model aimed at the increasingly important job of powering AI agents that can carry out longer, more complicated tasks. Alongside it comes Gemini 3.8 Flash Cyber, a more tightly controlled version designed to help trusted security teams find and fix software vulnerabilities.

The timing is notable. Google says Gemini 3.8 Flash arrives only three weeks after Gemini 3.7 Flash, making it the company’s third Flash release in six weeks. That pace says a lot about where the AI race is heading: not simply toward chatbots that provide a good answer, but systems that can reason through a task, use tools, check their work, and keep going until the job is done.

For developers, the standard Gemini 3.8 Flash model is the broader release. Google calls it its most intelligent “workhorse” model yet, with improvements in software engineering, multi-step reasoning, and agentic workflows. In plain English, it is meant for the kind of AI tools that do more than draft an email or summarize a document. Think coding assistants that work through a bug across multiple files, research agents that repeatedly search and organize material, or workplace automations that need to make decisions across several steps rather than respond once and stop.

Google’s key pitch is that those gains do not come with a higher entry price. Gemini 3.8 Flash is launching at $0.75 per million input tokens and $3.75 per million output tokens, the same introductory pricing as Gemini 3.7 Flash. Google says the model is available through the Gemini API, Google AI Studio, Android Studio, Gemini Enterprise, and its Antigravity agent-focused environment.

That combination of speed, price, and stronger reasoning is becoming one of the most competitive parts of the AI market. The largest frontier models can be extremely capable, but their costs can rise quickly when an AI application needs to run many tool calls, process long documents, or repeatedly refine code. Google is effectively arguing that Flash is no longer just the cheaper option for lightweight tasks – it wants it to be a practical default for high-volume AI agents too.

The trade-off is that Gemini 3.8 Flash may spend more computing power on difficult prompts. Google says the model can take extra reasoning steps and iteratively call tools when a task demands it, which may increase token use at higher effort settings. Developers who prioritize the lowest possible compute usage can lower the effort level or continue using Gemini 3.7 Flash, which Google says will remain supported for efficiency-first workloads.

Google is backing up its claims with benchmark results in long-horizon software engineering and specialized professional tasks. It says Gemini 3.8 Flash performs strongly on DeepSWE v1.1, a benchmark for autonomously completing complex engineering work, and that it improves on the previous Flash model in finance, legal, and broad multi-step reasoning evaluations. As always, benchmark scores should be treated as one signal rather than a guarantee of real-world performance, but they matter because this is the type of work companies increasingly want AI systems to handle with less human intervention.

The more unusual part of the announcement is Gemini 3.8 Flash Cyber. Google is not treating this as a normal public model release. Instead, the company is making it available to a limited set of “trusted defenders” through its new Fairwind Program, which targets government authorities, critical-infrastructure operators, software maintainers, and selected cybersecurity partners.

That restriction reflects the uncomfortable reality of cybersecurity AI. A system that can spot flawed code, understand how vulnerabilities work, and produce repairs could be enormously helpful for defenders. But sophisticated cyber capability can also be misused, which is why Google says Flash Cyber has more permissive cyber mitigations than the general-purpose model but is being kept behind an approval process.

Google says Flash Cyber is tuned for two related jobs: identifying vulnerabilities and patching them. On CyberGym, an industry benchmark for automated vulnerability discovery, Google says the model outperformed its prior 3.5 Flash Cyber system as well as larger frontier models. On an internal evaluation covering codebases in 20 programming languages, the company says Flash Cyber achieved a vulnerability-discovery success rate above 70 percent.

Patching is arguably the more important test. Finding a weakness is useful, but security teams still need a safe fix that does not break the rest of an application. Google reports a 47.2 percent pass@1 result on CWE-Bench, close to a cited leading frontier model’s 47.8 percent, while positioning its own offering as substantially cheaper. The company also says its Chrome Security team found Flash Cyber generated 2.6 times more correct patches for Chrome vulnerabilities than the best larger commercial models it tested. These are Google’s own reported results, so outside validation will be important as the program expands.

Google has paired the cyber model with CodeMender, an agentic system intended to help teams find, verify, and repair vulnerabilities at scale. The Fairwind Program is designed to bring that combination to a vetted group of users rather than release it broadly, with the stated aim of protecting critical infrastructure, public services, and national security.

For everyday Gemini users, the relevant model is 3.8 Flash, not Flash Cyber. Google says 3.8 Flash is rolling out to Google AI Pro and Ultra subscribers in the Gemini app, AI Mode in Google Search, and Gemini in Google Sheets. That means the same underlying push toward more persistent, tool-using AI behavior is beginning to show up in consumer-facing Google products as well as developer tools.

The bigger takeaway is that Google is framing the next phase of Gemini around action, not just answers. Gemini 3.8 Flash is built to take on longer-running coding and reasoning work at a price that could make high-volume deployments more realistic. Flash Cyber takes that idea into a more sensitive field, where speed and automation could help defenders reduce the gap between discovering a vulnerability and getting a reliable patch into production.