Gemini 3.8 Flash Shifts Toward High-Intensity Agentic Reasoning, While Cyber Version Offers Vulnerability Patching Through a Vetted-Access Program

Google launched Gemini 3.8 Flash and the restricted 3.8 Flash Cyber on September 2. The standard model, identified as `gemini-3.8-flash`, is now generally available. It supports a one-million-token context window, outputs of up to 64K tokens, and three reasoning levels: low, medium, and high. Google has made it the default model for Antigravity managed agents, clearly repositioning it from low-latency chat toward long-running software engineering tasks, iterative tool use, and enterprise data workflows.

The tradeoff is that the model deliberately takes more small reasoning steps, calls tools repeatedly, and verifies results, meaning difficult tasks may consume more tokens. Through the end of the year, provisional API pricing is $0.75 per million input tokens and $3.75 per million output tokens, with prices set to double in 2027. Engineering teams therefore cannot estimate agent costs based solely on per-token pricing for a single invocation. Migration also involves more than changing the model name: Google requires developers to remove `temperature`, `top_p`, `top_k`, and `candidate_count`; replace `thinking_budget` with the string-based `thinking_level`; use the server-side `previous_interaction_id` for multi-turn state; and recheck the fields used in function responses.

Flash Cyber uses the same underlying intelligence but is optimized for vulnerability discovery and patching. Google reports a pass@1 score of 47.2% on CWE-Bench, close to the listed leading model’s 47.8%. Its success rate exceeded 70% in internal testing across 20 programming languages, while the Chrome team obtained 2.6 times as many correct patches as it did with a large commercial model. Because its safety restrictions are less stringent, the Cyber version is available only through the Fairwind program to government agencies, critical infrastructure operators, and software maintainers.

Most of these results were produced by Google or its partners, and the internal datasets have not been released. The model card also acknowledges potential timeouts, hallucinations, and higher token consumption, while multilingual automated safety evaluations showed a slight regression compared with 3.7 Flash. Chinese-language teams should prioritize retesting prompt injection resilience, function-calling formats, and total task costs rather than relying solely on official benchmark rankings.