Google released Gemini 3.8 Flash and Gemini 3.8 Flash Cyber on September 2. The standard model is available to anyone with an API key. The Cyber variant allows more security-related requests, but access requires approval through Google's new Fairwind Program.
The restriction is meant to keep a capable vulnerability-finding tool in defenders' hands. Yet widely available models already perform much of the same work. For organizations running exposed servers, faster exploit development may have a more immediate effect than access to a better bug finder.
What Flash Cyber can do
Google's announcement reports an 86.2% score on CyberGym, a public benchmark for finding vulnerabilities in code. The previous model, 3.5 Flash Cyber, scored 77.5%, compared with 85.6% for OpenAI's GPT-5.5-Cyber.
On Google's internal discovery test, which covers 20 programming languages and uses vulnerabilities from shipped software, Flash Cyber finds the bug 71% of the time. It can also produce patches. On CWE-Bench, it delivers a passing fix in 47.2% of attempts at about $3.60 per attempt. That result is within one percentage point of the best model in Google's comparison.
Google's Chrome security team says Flash Cyber produced 2.6 times as many correct patches as the best commercial model it tested. The company's cloud vulnerability research group says it found a critical vulnerability in under two hours in a codebase where that work normally takes months. These are separate reports, not a claim that every successful discovery takes two hours.
Wiz reports recall improvements of 7.5 to 9.7 points over frontier models at a fraction of the cost. Recall measures how many of the relevant vulnerabilities a system finds. That comparison needs the context that Google announced a deal to buy Wiz in 2025.
Flash is Google's small, inexpensive model tier. The listed price is $0.75 per million input tokens and $3.75 per million output tokens through the end of 2026, with both rates doubling on January 1, 2027. Those rates suggest that scanning an internal application could cost dollars rather than thousands, though the total depends on how much work the scan requires.
Who gets access
Google describes the Cyber variant as having more permissive mitigations than the standard model. In practice, it can answer some offensive security requests that regular Flash refuses. That makes access control part of the product.
Fairwind initially gives access to government agencies, Google Cloud customers and selected security vendors. Critical infrastructure operators and maintainers of widely used software receive priority. Security Boulevard reports that more than 650 organizations are participating at launch.
Members must limit access to staff in security roles, including incident response and penetration testing, and require multifactor authentication on accounts using the model. Flash Cyber also comes bundled with CodeMender, Google's agent for writing and validating patches.
The reasoning is understandable. A tool that finds vulnerabilities can help repair software or help attack it. Google has a clear incentive to limit the chance that its model becomes part of an attack on a hospital or another critical service.
The size of the capability gap makes that restriction less reassuring. Flash Cyber scores 71% on Google's internal discovery test. The unrestricted 3.7 Flash scores 58.9% on the same test and has been available since August 13 at the same $0.75 per million input tokens. The measured gap is roughly 12 percentage points, alongside the difference in refusal behavior. An attacker using 3.7 Flash already has much of the tested discovery capability available to vetted defenders.
Open-weight models released this summer add to the concern. Z.ai's GLM-5.3 reportedly matched frontier exploit discovery in August without vetting its users. Access restrictions may buy time, but they don't establish a durable safety boundary. A reasonable estimate is that the gap between the restricted model and something a motivated attacker can run at home could fall below six months.
Known vulnerabilities still need patches
The same week Google released its bug finder, Help Net Security reported about 22,000 internet-facing Microsoft Exchange servers still missing the August 11 patch for CVE-2026-62911. About 6,200 were in the United States.
The vulnerability is an authentication bypass on the MRSProxy endpoint. Orange Tsai of DEVCORE chained it into unauthenticated remote code execution at Pwn2Own Berlin, earning a $200,000 prize. Microsoft rated it “Exploitation Less Likely.” A proof of concept has been on GitHub since late August, and the Dutch national cyber security centre says a working exploit is circulating. Germany's BSI estimates that roughly 85% of Exchange servers in the country remain unpatched.
That leaves thousands of exposed servers without a fix roughly three weeks after the patch became available, despite public exploit code.
SonicWall also disclosed two vulnerabilities in its SMA1000 line on September 1. One is a server-side request forgery vulnerability rated CVSS 10 that requires no login. The other is a command injection vulnerability. Chained together, they give an attacker a shell on the appliance. SonicWall confirmed exploitation before publishing the advisory, and CISA added both flaws to its Known Exploited Vulnerabilities catalog within two days.
Neither case depended on a new AI model to expose the problem. Orange Tsai found the Exchange vulnerability by hand. Faster discovery doesn't install a patch, resolve a maintenance delay or restore support for an old product.
Exchange 2016 and 2019 went out of support in October 2025 and receive fixes only through paid extended support. That creates an additional obstacle for organizations still running them. Others have simply not applied the available patch. The reported server count doesn't establish how many fall into each category.
The concern is what faster vulnerability analysis does after a patch appears. Comparing a security update with the previous version can reveal the flaw it fixes. Turning that difference into an exploit is a bounded task of the kind a Flash-tier model is suited to attempt. The likely consequence for server operators is a shorter interval between patch release and usable attack code, while the work of deploying the fix remains.
The standard model's cost needs a closer look
For uses outside security research, the standard Gemini 3.8 Flash is mainly a capability and cost story. It is Google's third Flash release in six weeks, reportedly a faster pace than competing small-model releases. It supports a one million token input window and a 64,000 token output limit.
The model scores 54.9% on HLE-Verified. Artificial Analysis gives it 59 on its intelligence index, tied with GPT-5.6 Sol and Grok 4.6. Claude Fable 5.1 scores 66, seven points higher. The Register reports a price per task of $0.58 on that index for Flash, compared with $3.76 for Fable 5.1.
That is roughly a six-to-one cost difference for a model in the same broad capability bracket as last year's frontier systems. For production agents doing routine work, a gap that size can materially affect operating margins, provided the cheaper model performs the required task reliably.
There is a less favorable comparison with Google's own previous release. Artificial Analysis measured 3.8 Flash at about 40% more cost per task than 3.7 Flash because it produces more reasoning tokens. A low token price doesn't necessarily mean a low task cost. The useful measure is the cost of completing the work.
Untrusted input remains a risk
On the Gray Swan indirect prompt injection benchmark, attacks against 3.8 Flash Cyber succeed 6% of the time, roughly one in sixteen attempts. Indirect prompt injection occurs when instructions planted in material a model reads try to redirect its behavior. That matters for an agent expected to inspect untrusted code and then take action.
The benchmark result isn't a universal failure rate for every deployment, but it gives a concrete reason to examine what access and authority such an agent receives. Better vulnerability detection doesn't remove the risk of the tool being manipulated through its inputs.
Within a year, Fairwind could resemble the restrictions on strong cryptography exports in the 1990s: well intended, but largely a burden on those following the rules. In the meantime, defenders can already use inexpensive unrestricted models to inspect their own code. For the exposed Exchange servers, the more immediate requirement is still the patch released in August.
