Autonomous vulnerability discovery across complex codebases

Gemini 3.8 Flash Cyber demonstrates frontier-level performance on the CyberGym benchmark for autonomous vulnerability discovery, surpassing both 3.5 Flash Cyber and significantly larger frontier models. Independent reporting shows an 86.2% score on CyberGym for spotting vulnerabilities in C and C++ code, exceeding Claude Mythos 5 and GPT-5.6 Sol.

Business outcome: Security teams can identify vulnerabilities faster and across more code than manual review alone.

Vulnerability detection across 20 programming languages

Beyond the C/C++ focus of CyberGym, Google evaluated the model against an internal benchmark spanning 20 programming languages. The model achieves a success rate exceeding 70% on this broader, more realistic defensive test — a significant leap over previous models.

Business outcome: Organisations with polyglot codebases get one tool that covers their full attack surface, not just memory-unsafe languages.

Patching prioritised over offensive exploitation

Google invested in vulnerability fixing from the start, prioritising it over offensive capabilities like exploitation. On CWE-Bench, the external patching benchmark run by Collinear, Gemini 3.8 Flash Cyber sits on the Pareto frontier with a pass@1 of 47.2% compared to a leading frontier model at 47.8% — at significantly lower cost.

Business outcome: Defenders get near-frontier patch quality without paying frontier-model prices.

Proven Chrome vulnerability patch production

Google's Chrome Security team found that Gemini 3.8 Flash Cyber produced 2.6 times more correct patches to vulnerabilities in Chrome than the best commercial models that are much larger. This is real-world validation on one of the most security-critical codebases in existence.

Business outcome: Teams securing high-stakes, widely-deployed software can trust the model's patch output.

Higher recall at lower cost for internal pen-test benchmarks

Wiz found that Gemini 3.8 Flash Cyber achieves +7.5-9.7% higher recall on their internal penetration testing benchmark compared to other leading frontier models, at 2.3-5.2x lower cost. Independent validation from a major cloud security vendor strengthens the defensive-use case.

Business outcome: Penetration testing teams can cover more attack paths per dollar spent.

Flash speed with long-running agentic loops

The model is powered by the same foundational intelligence as Gemini 3.8 Flash, accelerated by long-running agentic loops that recursively evaluate and refine outputs. This enables quick iteration cycles — critical for security teams that need to test many hypotheses rapidly.

Business outcome: Faster iteration means more vulnerabilities found and patched per unit of analyst time.

• Defensive patching focusDeliberately prioritises vulnerability fixing over exploitation, aligning with defender needs.
• Proven real-world impactChrome Security team reports 2.6x more correct patches than larger commercial models.
• Cost-effective frontier performanceNear-frontier CWE-Bench results at significantly lower cost than leading frontier models.
• Multi-language coverageExceeds 70% success rate on internal benchmark spanning 20 programming languages.

• Access is gatedOnly available through Google Fairwind to governments and trusted partners — not public signup.
• Offensive capabilities deprioritisedTeams needing exploitation capabilities will need to look elsewhere; patching is the focus.
• Not a general-purpose modelThis is a cybersecurity-optimised variant, not an upgrade over Gemini 3.8 Flash for general tasks.
• Professional RealityMost security teams in 2026 cannot access this model regardless of budget — the qualification process is the real barrier to adoption.

Government CERT operations

National computer emergency response teams can use the model to automate vulnerability discovery across critical infrastructure codebases, compressing months of research into days.

Enterprise product security

Vetted software vendors can integrate the model into their SDLC to automate patch generation for vulnerabilities found in their own products, reducing time-to-fix.

Cloud security research

Cloud providers and security researchers can leverage the model's speed to hunt for foundational vulnerabilities in shared infrastructure, as Google's own team demonstrated.

Chrome-scale browser security

Teams maintaining large, security-critical codebases can benefit from the model's proven 2.6x correct-patch rate on Chrome vulnerabilities.

Determine if your organisation qualifies for the Google Fairwind Program — this requires government or trusted-partner status, not a standard enterprise account.

Contact Google's security partnerships team to initiate the vetting and qualification process.

Once approved, integrate the model into your existing vulnerability discovery and patching workflows.

Validate outputs against your own benchmarks, as Wiz and Chrome Security did, to measure real-world impact.