neomanex
Gemini 3.8 Flash Cyber logo

Gemini 3.8 Flash Cyber

Google · Sorti sept. 2026

Voir les tarifsComparer les modèles
Conditionnel

Gemini 3.8 Flash Cyber is Google's most capable cybersecurity model, a defensive specialist already in production at Chrome Security, Cloud Vulnerability Research and partner Wiz, with frontier vulnerability-discovery and patching results at a fraction of the leaders' rollout cost. The deciding caveat is access: it is gated to vetted defenders through the Fairwind Program, with no public API or published rate card. We rate it conditional rather than caution like the sibling Gemini 3.5 Flash Cyber because 3.8 ships published benchmark figures and named production deployments where 3.5 had neither, even though both remain gated. Right for organizations that can qualify as trusted defenders; everyone else cannot buy it today.

Est-ce fait pour vous ?

Recommandé pour

  • Autonomous vulnerability discovery — CyberGym Pass@1 86.2%, ahead of GPT-5.5-Cyber (85.6%), Mythos 5 (83.8%) and the prior 3.5 Flash Cyber (77.5%)
  • Defensive patching at scale — CWE-Bench pass@1 47.2% versus the 47.8% leader, at $3.64 mean cost per rollout against $10.27 for that leader
  • Real-world multilingual codebases — over 70% recall on Google's internal 20-language vulnerability set, against 46.6% for 3.5 Flash Cyber
  • In-production defenders — Chrome Security measured 2.6x more correct patches than leading commercial alternatives; Wiz saw +7.5-9.7% recall at 2.3-5.2x lower cost
  • Prompt-injection-hardened security agents — 6.0% ASR@15 on Gray Swan indirect prompt injection, close to the general 3.8 Flash at 5.5%

Déconseillé pour

  • Anyone without Fairwind approval — vetting is limited to government authorities, critical-infrastructure operators and software maintainers; there is no public API or self-service access
  • Offensive exploitation work — Google states it prioritized patching over exploitation, with cyber-offense mitigations applied under the Frontier Safety Framework
  • Independent verification — no separate public model card or rate card; CyberGym is Google-run in an internal Antigravity harness and the 20-language set is private

Performances par tâche

Vulnerability discovery (CyberGym)

Excellent

86.2% Pass@1, top of Google's five-model comparison — 0.6pp over GPT-5.5-Cyber, though harnesses differ across owners

Audit and patching (CWE-Bench v0)

Very Good

47.2% Pass@1 at $3.64 mean cost per rollout — 0.6pp behind the leader at roughly 65% lower cost

Real-world vulnerability discovery (20-language internal set)

Very Good

Over 70% recall versus 46.6% for 3.5 Flash Cyber; private set, not externally reproducible

Prompt-injection robustness (Gray Swan)

Very Good

6.0% ASR@15 — lower is better; near Claude Opus 5's 4.8%

Offensive exploitation

Fair

Deliberately deprioritized — Google prioritized patching over exploitation

Tarifs

Entrée

N/A (no public rate card)

Sortie

N/A (no public rate card)

Contexte

Fairwind-gated; no public API

Voir tous les tarifs

Tests de performance

TestScoreSource
CyberGym Pass@186.2% Source
CWE-Bench v0 Pass@147.2% Source
CWE-Bench v0 mean cost per rollout$3.64 Source
Google internal 20-language vulnerability set (recall)>70% Source
Gray Swan indirect prompt injection (ASR@15)6.0% Source
Chrome Security correct-patch rate vs leading commercial alternatives2.6x Source

Aucun changement de verdict pour l’instant

L’horloge tourne dès le premier jour : les changements apparaîtront ici à mesure que notre verdict évolue.

Sources

Journal de vérification

Aucune vérification pour le moment

Nous n’avons pas encore enregistré de vérification pour cette entrée. Dès qu’une vérification s’exécute, son historique apparaît ici.

Comment nous évaluons