Gemini 3.8 Flash: Same Weights, Two Safety Envelopes, 47.2% on CWE-Bench

Google DeepMind shipped Gemini 3.8 Flash and Gemini 3.8 Flash Cyber on September 2, 2026 — three weeks after Gemini 3.7 Flash and the third Flash-family release in six weeks. Both variants run on the same foundational model, refined through long-running agentic loops that recursively evaluate and feed results back into training. The split is not architectural: it is the safety envelope and the access tier that sit around an identical core. For engineers routing production traffic, that distinction has immediate operational consequences.

This is a concrete example of frontier AI gated capability verification playing out in practice — where the same weights warrant radically different distribution controls depending on which mitigations are applied.

What Changed From 3.7 Flash

Specifications carried over without modification: a 1,048,576-token context window, a maximum output of 65,536 tokens, multimodal input spanning text, image, audio, and video, and text-only output. Thinking levels remain LOW, MEDIUM, and HIGH, with MEDIUM as the default. One breaking change for migration: MINIMAL is no longer supported and passing it returns an API validation error.

The behavioral shift is the substance of the release. Google states that 3.8 Flash works harder on complex tasks — executing additional reasoning steps and calling tools iteratively — and that this burns more tokens at higher effort settings. Google's own developer documentation explicitly recommends staying on 3.7 Flash when compute efficiency is the binding constraint. That is an unusually direct admission that the newer model is not the right default for every workload: accuracy scales up, but so does per-task spend.

Benchmark Results

On DeepSWE v1.1, a long-horizon software engineering benchmark, Google reports 3.8 Flash outperforming most larger frontier models at a fraction of their cost. On HLE-Verified, the model records 54.9%. Google also reports wins over 3.7 Flash on Vals Finance Agent V2 and Harvey's Legal Agent Benchmark, though those results are stated as relative improvements without published absolute scores.

Flash Cyber's figures are scoped to security tasks. CWE-Bench, run externally by Collinear, puts Flash Cyber at 47.2% pass@1 against a leading frontier model's 47.8% — near-parity at materially lower cost. Because CyberGym, the public standard, is largely C and C++, Google ran an internal benchmark spanning 20 programming languages and reports a vulnerability discovery success rate above 70%. Google's Chrome Security team found that Flash Cyber produced 2.6 times more correct patches than the best, much larger commercial models. Wiz measured 7.5 to 9.7 percentage points higher recall on its internal penetration testing benchmark at 2.3x to 5.2x lower cost. Google's Cloud Vulnerability Research team used the model to find a critical foundational vulnerability in under two hours — work Google characterises as normally requiring months. Flash Cyber's design explicitly prioritises vulnerability fixing over offensive exploitation.

Access Envelopes and Pricing

The Fairwind Program is the mechanism Google is using to operationalise the split. Flash Cyber's more permissive mitigations are what make it useful for autonomous vulnerability research; they are also precisely what requires restricting the model to vetted defenders. This reflects the structural problem described in infrastructure governance for safe agent deployment: the safety surface lives in the access layer, not in the model weights themselves.

The Pareto-frontier framing on CWE-Bench — 47.2% vs. 47.8% at substantially lower cost — reflects a competitive posture that trades leaderboard position for cost efficiency. For teams evaluating security-focused AI tooling for vulnerability research, the clearest decision point is whether accuracy-per-token or raw accuracy governs the workload. Google has now made that tradeoff explicit in its own documentation.