On September 2nd, Google released Gemini version 3.8, as well as a 3.8 version tailored for network defense. Just three weeks after the release of 3.7, this marks the third update in the Flash series within six weeks. Google positions 3.8 as the current strongest reasoning and coding Flash model. The standard version has been made available for Gemini API, Google AI Studio, Android Studio, Gemini Enterprise, and some consumer products; meanwhile, the Cyber version is only accessible on a priority basis to trusted government agencies, critical infrastructure operators, and software maintainers through the new Fairwind Program. Both versions share the same basic intelligence, but they differ in deployment permissions and security protections.
The introductory price for the regular 3.8 Flash is still $0.75 per million inputs and $3.75 per output, which is the same as 3.7. However, this price only applies until December 31, 2026; starting from January 1, 2027, the officially listed price will increase to $1.50 per input and $7.50 per output. What is more easily overlooked is that the model will perform more reasoning steps on complex tasks and repeatedly call tools. Google explicitly reminds that higher levels of effort may consume more Token. Although the unit price has not increased, it does not mean that the total cost for a task will remain the same.
Flash begins the competition for long-term tasks; beyond speed, completion rate is also a key factor to consider.
The evidence presented in Google covers long-cycle coding, expert analysis, and multi-step reasoning. 3.8 Flash outperformed most larger, cutting-edge models in long-cycle software engineering benchmarks of DeepSWE and v1.1; achieving 54.9% on HLE-Verified. The company also cited financial and legal agency benchmarks to illustrate its attempt to move Flash from a low-latency question-answering model to a working model capable of continuous planning, tool invocation, and delivery of complete results. Demonstrations such as hardware disassembly visualization, single-prompt map generation DOS, and 3D games emphasize that the model not only outputs code snippets but can continuously check and modify the final product in a loop.
However, the benchmark score cannot be directly converted into corporate productivity. The success rate of long tasks is often influenced by factors such as the size of the code repository, the dependency environment, the quality of testing, tool permissions, and the retry budget. While a "more diligent" strategy of 3.8 can increase the completion rate, it also increases the execution time and the usage of Token. Development teams need to keep track of the cost per call, the total Token for a task, the number of tool calls, the number of retries before success, and the time required for manual rework in order to determine whether the upgrade is truly more cost-effective. For workloads with latency or budget constraints, it is still recommended to reduce the level of effort to 3.7 or continue using version 3.7; the older versions are not immediately discontinued due to the release of new products.
The regular version is now available to developers and enterprises. Users with Google AI Pro and Ultra accounts can also use it within the Gemini application, as well as in searches for AI Mode, Gemini, in, and Sheets. The features, quotas, and regional availability may vary depending on the entry point, so it should not be assumed that "the model has been released" means all users or all products have access to exactly the same capabilities. This is especially true for workflows that involve autonomous tools; their successful implementation also depends on whether the application provides the corresponding tools, permissions, and a recoverable execution environment for the models.
The Cyber version is stronger but also narrower; 47.2% is not an automatic repair commitment.
Gemini Focusing on vulnerability discovery and patch generation. Google claims that it has a success rate of over 70% in internal vulnerability discovery evaluations for 20 programming languages; in external CWE-Bench patch evaluations, pass @1 has a rate of 47.2%, close to the 47.8% of a leading model, but at a lower cost. Chrome Internal usage by security teams shows that 3.8 Flash Cyber generates 2.6 times as many correct vulnerability patches as the best large commercial models. Wiz also reports an increase in the recall rate of its internal penetration testing benchmarks by 7.5 to 9.7 percentage points, with costs reduced by 2.3 to 5.2 times.
These numbers have reference value, but they also have their limitations. The internal benchmarks, hints, and manual judgment methods are not fully detailed in the announcement; 47.2% of pass @1 also means that a single generation cannot guarantee that more than half of the issues will be correctly fixed. Google prioritizes "fixing" over "utilizing," and adds protection against chemical, biological, radiological, nuclear, and cyber abuses to the standard 3.8. The Cyber version adopts looser cybersecurity restrictions to meet professional defense needs, therefore it is not publicly available and is only provided to trusted defenders within the Fairwind program.
What truly changes with this release is the approach to the Flash series: it no longer relies solely on low prices and speed to attract bulk requests, but instead pursues a higher completion rate for complex tasks through longer reasoning cycles. If companies simply replace version 3.7 with 3.8, the most common mistake is to compare only the pricing of the million Token units. A more cautious approach would be to conduct tiered testing on actual tasks: limit the effort level for simple requests, allow more cycles for longer tasks, and maintain manual approval and isolated environments for secure tasks. Version 3.8 of Flash is already available, and Cyber has also entered a limited-release phase; as for whether it can complete more production tasks at a lower total cost, that will have to be answered by each team's own end-to-end data analysis.
