Gemini 3.8 Flash Plus Cyber Launch: DeepSWE 73.7 at $0.75

Google released Gemini 3.8 Flash and Gemini 3.8 Flash Cyber on September 2, 2026, three weeks after 3.7 Flash and one day after Anthropic's Claude Fable 5.1. Flash is the new workhorse for coding and agents at unchanged promo pricing of $0.75 input and $3.75 output per million tokens. Cyber is the frontier cybersecurity variant with autonomous vulnerability discovery, available to trusted defenders through the new Fairwind Program.

Launch facts in brief:

• Flash improves across software engineering, agentic tasks, and multi-step reasoning at identical speed and cost to 3.7.
• DeepSWE v1.1 hits 73.7 percent, just 0.3 points behind Opus 5 and ahead of GPT-5.6 Sol at Flash pricing.
• Cyber reaches frontier on CyberGym discovery and 47.2 percent pass at 1 on CWE-Bench patching against 47.8 for a leading frontier model.

I moved our analyst workloads to Flash within a week of launch. Finance summaries, chart reasoning, and long-video briefs all run on Flash now at roughly one-sixth the per-token cost of our previous stack. Coding refactors stayed on Claude until my shootout numbers settled, which I published separately with full version truth.

Flash benchmark impact with sources marked

All figures below are Google's runs from the September 2 announcement. Independent replication is pending, and cross-vendor decimals use different evaluators.

Design choice behind the gains: 3.8 Flash works harder, with extra reasoning steps and iterative tool calls at higher effort. That diligence lifts analyst and agent scores while raising token use per task, which is why per-task pricing matters more than per-token pricing. My cost teardown with effort math is in Gemini thinking-token cost at $0.41.

Coding truth with version labels is in my Claude Code versus Gemini coding truth. Short version: Flash is a strong analyst and capable coder on familiar tasks, not yet a frontier agentic coder on the hardest work.

Cyber variant: vulnerability discovery at Flash speed

Flash Cyber targets defenders with frontier-level autonomous discovery plus patching. On CyberGym it surpasses prior models and far larger frontier systems. On Google's internal benchmark across 20 languages, success exceeds 70 percent. On external CWE-Bench patching, 47.2 percent pass at 1 sits just under a leading frontier model at 47.8, at a fraction of the cost.

Field reports from launch partners carry weight. Chrome Security found Cyber produced 2.6 times more correct vulnerability patches than the best much larger commercial models. Wiz measured 7.5 to 9.7 percent higher recall on penetration testing benchmarks at 2.3 to 5.2 times lower cost. Cloud Vulnerability Research used the model to find a critical foundational flaw in under 2 hours, work that usually takes months.

Access runs through Fairwind for trusted defenders, not open API. That scoping is deliberate given dual-use risk. Defender teams should apply through program channels and prepare isolated evaluation repos before access lands.

Production war story 1: the finance agent switch that paid

Our portfolio briefing job ran on a frontier model at $4.20 per batch of 40 briefs. I moved it to Flash after the Vals Finance Agent numbers posted at 61.4 against 58.6 for Opus 5 and 53.8 for Sol. First week output matched quality scores from our reviewer panel, 8.4 against 8.5, while batch cost fell to $0.71. Monthly saving is roughly $280 on that job alone.

One failure in the same week keeps me honest. A legal-adjacent compliance summary scored 10.0 on Harvey's benchmark in vendor runs but missed a jurisdiction nuance our counsel caught in review. Benchmark leadership at 10 percent absolute is still 90 percent failure in plain English. High-stakes legal output keeps human sign-off regardless of vendor tables. The model earns the draft, counsel owns the filing.

Pricing structure I now quote everywhere: promo $0.75 and $3.75 through December 31, regular $1.50 and $7.50 from January 1. Batch and flex halve both. Cached reads cost $0.075. Every proposal models both halves of the year after my August forecasting miss.

Enterprise adoption path from launch week

Flash is live across the Gemini app for AI Pro and Ultra subscribers, AI Mode, Gemini for Sheets, Antigravity, AI Studio, the Gemini API, and the Enterprise Agent Platform. Context runs to 1M tokens with 64K max output, five input modalities, and configurable effort trading quality against cost and latency.

Migration steps that worked for us:

1. Move analyst workloads first: finance, charts, long video, lab science.
2. Keep hard refactors on Claude until Terminal-Bench 4.0 gaps close.
3. Set effort per step: low for extraction, medium default, high with justification.
4. Shift overnight bulk to batch at half rates on day one.
5. Apply to Fairwind early for Cyber evaluation with isolated repos ready.

Independent signals support the analyst-first order. Artificial Analysis scores Flash at 59 intelligence against 56 for 3.7, with agentic up nearly 5 points and coding flat. Output speed near 299 tokens per second ranks third of 196 models. LMArena preference sits level with last-generation flagships. Speed plus analyst strength is the adoption wedge.

For orchestrating these models in durable workflows, see Qwen3.8-Omni-Flash voice agents for media pipelines and Claude Code Projects at 200 threads for fleet patterns.

Production war story 2: the Cyber eval that found a real bug

Our Fairwind application was still pending, so I ran the closest available proxy: Flash standard on our own historical vulnerability set of 30 patched CVEs across Python and TypeScript. It flagged 19 correctly with usable patch sketches, missed 7, and hallucinated 4. Respectable for a non-Cyber variant, and enough to justify the Cyber application with an isolated eval repo prepared.

Best catch was a stored XSS our scanner had marked informational for months. Flash traced the data flow across three files, showed the unsanitized sink, and proposed a patch matching what our engineer wrote independently. That single find paid for the entire eval week. It also confirmed the workflow: model proposes, tests verify, human merges. Autonomous discovery with human-gated patching is the responsible shape until guardrails mature.

Caution from the launch materials applies here too. Real-world defensive needs span far beyond C and C++ codebases that dominate CyberGym. Google's 20-language internal benchmark addresses that breadth, but defender teams should still run their own polyglot evals before trusting any single number.

When NOT to switch this month

Hold frontier models for hard multi-file refactors where Terminal-Bench 4.0 gaps dominate, for computer-use flows where OSWorld gaps decide outcomes, and for front-end taste work where 3.8 trails 3.7 slightly on design arena scores. Flash leads analysts decisively. Coders should route by task shape, not by launch excitement.

Verification checklist for launch adopters

1. Move analyst workloads first and meter per finished brief including review time.
2. Keep Terminal-Bench 4.0, OSWorld, and DeepSWE version labels on every comparison.
3. Model January regular rates plus batch options in every forecast now.
4. Prepare isolated eval repos before Cyber access arrives via Fairwind.
5. Keep human approval on legal, security, and production patch merges.

This launch turns the fast tier into a serious default for analysis and a credible one for scoped engineering, with security capabilities that defenders should evaluate early through proper channels.

By Deepak Bagada, Founder and Editor-in-Chief at Daily AI World. I run analyst and security evals at SaaSNext on production codebases. More at deepakbagada.in.