Gemini 3.8 Flash Cyber Reality Check: 86.2% CyberGym, 47.2% CWE-Bench and Fairwind-Only Access

Google introduced Gemini 3.8 Flash Cyber on September 2, 2026 as a security-specialized sibling of Gemini 3.8 Flash. The important distinction is access: the standard 3.8 Flash is broadly available, while the Cyber variant is restricted to vetted defenders through Google DeepMind's Fairwind Program. The launch package contains unusually concrete cybersecurity numbers, but they come from different evaluation regimes and should not be collapsed into one leaderboard claim.

The 86.2% CyberGym score needs the benchmark definition beside it

Google DeepMind reports 86.2% Pass@1 on CyberGym for Gemini 3.8 Flash Cyber, ahead of GPT-5.5-Cyber at 85.6%, Mythos 5 at 83.8%, GPT-5.6 Sol at 83.6%, and Gemini 3.5 Flash Cyber at 77.5% on Google's published comparison.

CyberGym's own public observatory describes the core benchmark more narrowly than the phrase "autonomous vulnerability discovery" can suggest. The standard CyberGym track contains 1,507 real-world instances across 188 software projects. The agent is given a vulnerability description and an unpatched codebase and must generate a proof-of-concept test that reproduces the vulnerability. That is a valuable vulnerability-reproduction capability, but it is not the same task as being dropped into an unknown repository and independently discovering an undisclosed flaw from scratch.

That distinction matters when interpreting an 86.2% headline. CyberGym, ExploitGym and CyberGym-E2E measure different stages of the vulnerability lifecycle and should remain separate. CyberGym-E2E, for example, is a different 920-instance end-to-end benchmark covering discovery, proof-of-concept generation and patching. No CyberGym-E2E score is being inferred here for Gemini 3.8 Flash Cyber.

The margin over GPT-5.5-Cyber in Google's CyberGym chart is also only 0.6 percentage points. CyberGym notes that evaluations can be stochastic and that small score differences may not always be meaningful. Google’s public model page does not expose enough matched harness, retry-budget and agent-configuration detail to treat the model-only ranking as a fully reproducible controlled comparison.

CWE-Bench is the stronger independent patching signal

The most useful outside measurement in the launch package is CWE-bench v0, run by Collinear AI with results independently evaluated and published by Artificial Analysis. It uses 100 private held-out audit-and-patch tasks across 54 distinct CWEs and six language groups: C/C++, Go, Java, JavaScript/TypeScript, Python and Rust.

The task format is intentionally closer to a defensive code audit. An agent receives a real open-source repository and one instruction: audit the code and fix what it finds. The task does not reveal the vulnerability or even how many vulnerabilities are present. A rollout passes the deterministic leaderboard gate only if the exploit no longer works and all pre-existing tests still pass.

On this benchmark, the published high-reasoning leaderboard reports:

• Claude Fable 5 with Claude Code: 47.8%, average billed cost $10.27 per rollout.
• Gemini 3.8 Flash Cyber with Antigravity: 47.2%, $3.64 per rollout.
• GPT-5.6 Sol with Codex: 44.2%, $2.29 per rollout.
• Gemini 3.7 Flash with Antigravity: 44.0%, $1.43 per rollout.

CWE-bench also reports that 18 of its 100 tasks were unsolved by every model on the current leaderboard summary. More importantly, the 47.8-versus-47.2 difference is only 0.6 percentage points, so it is not evidence that one system is decisively more capable. The systems also use different agent harnesses—Claude Code, Antigravity and Codex—meaning the result measures a model-plus-harness configuration rather than a perfectly isolated model comparison.

The $3.64 figure is likewise not a Gemini 3.8 Flash Cyber API list price. CWE-bench defines it as the mean billed API spend for one rollout on one task under its evaluation setup. It is useful for that benchmark's cost-performance frontier, but it should not be generalized to production vulnerability research workloads.

Google's private 20-language set is promising but not independently inspectable

Google's model page reports 71.0% Pass@1 on an internal "real-world vulnerability discovery" benchmark spanning 20 programming languages. The same chart shows Gemini 3.7 Flash at 58.9% and Gemini 3.5 Flash Cyber at 46.6%.

This is a large reported gain, but the dataset is private. Google has not published enough information on the model page to independently inspect the task count, vulnerability distribution, project selection, contamination controls, harness, retry budget or per-language sample sizes. The 71.0% result therefore remains a vendor-run internal evaluation, not an independently reproduced score.

Production examples are useful evidence, but they are still vendor or partner measurements

Google says its Chrome Security team obtained 2.6 times more correct patches from Gemini 3.8 Flash Cyber than from the best commercial models in its comparison. Wiz reports 7.5 to 9.7 percentage points higher recall on an internal penetration-testing benchmark at 2.3 to 5.2 times lower cost than other leading frontier models. Google Cloud Vulnerability Research also says it used the model to find a critical foundational vulnerability in under two hours.

These examples indicate real deployment interest, but none is a public standardized benchmark with a released task set and matched rerun configuration. They should therefore be treated as Google and partner evidence, not as independent proof that every defender will see the same gains.

Prompt-injection result: useful, but not a cyber-offense score

Google DeepMind's model page attributes a 6.0% attack success rate to Gemini 3.8 Flash Cyber on the Gray Swan IPI prompt-injection benchmark, where lower is better. This measures resistance to prompt-injection attacks against AI systems; it does not measure vulnerability discovery, exploitation or software patching. A directly attributable Gray Swan result page with a complete public rerun configuration was not located during this verification pass, so the 6.0% number is reported specifically as a Google-published, Gray-Swan-attributed result.

Access is deliberately restricted, and a public Cyber list price is not published

The Fairwind Program says it currently works with more than 650 partners globally. Access is prioritized for governments and national cyber authorities, critical-infrastructure operators and core technology platforms. Participating organizations must use user-level authentication, phishing-resistant MFA and access controls, and may grant Cyber-model access only to internal cybersecurity, incident-response or penetration-testing teams. Redistribution or resale of access is prohibited.

Google permits selected dual-use work such as authorized threat simulation, reverse engineering and malware analysis for defensive and academic research, while prohibiting malicious uses. Academic labs focused on defensive benchmarking can apply. When the model is accessed as a managed model through the Gemini Enterprise Agent Platform, Google says Fairwind supports zero data retention.

The public launch price of $0.75 per million input tokens and $3.75 per million output tokens through December 31, 2026 applies to the standard Gemini 3.8 Flash release. Google does not publish a generally available standalone API price for the restricted Cyber variant on the Fairwind pages reviewed here. The CWE-bench $3.64-per-rollout number should therefore not be presented as Cyber API pricing.

SWE-bench Verified and SWE-bench Pro remain separate

No exact, primary, reproducible Gemini 3.8 Flash Cyber score was found for either SWE-bench Verified or SWE-bench Pro in Google's Cyber model page, the launch post, Fairwind documentation, CWE-bench or CyberGym materials reviewed for this article. The standard Gemini 3.8 Flash model has separate software-engineering evaluations, but those results are not silently transferred to the Cyber variant.

Likewise, CyberGym and CWE-bench are not substitutes for SWE-bench. CyberGym tests vulnerability reproduction under a security-specific setup, while CWE-bench tests defensive auditing and patching. SWE-bench evaluates repository-level software issue resolution under its own task sets and harnesses.

Public feedback is still too thin for a reliable consensus

Because Fairwind access is restricted, broad hands-on public testing is limited. This verification pass did not find a reliably attributable X post or public controlled reproduction that adds measurement quality beyond the benchmark sources above. That absence should not be converted into a positive or negative community consensus. Early discussion about access or headline benchmark scores is anecdotal unless it provides reproducible configuration and results.

Practical takeaway

Gemini 3.8 Flash Cyber has two especially meaningful signals. First, Google's 86.2% CyberGym result shows very strong performance on a large vulnerability-reproduction benchmark, but CyberGym's task definition is narrower than open-ended zero-day discovery and the published model comparison lacks a fully matched public harness description. Second, CWE-bench's 47.2% at $3.64 per rollout is a stronger independent signal for audit-and-patch work because the 100-task evaluation is held out and uses a deterministic verifier; even there, model and harness are bundled and the 0.6-point gap to Fable 5 is too small to support an absolute ranking.

The most defensible conclusion is therefore not that Gemini 3.8 Flash Cyber is universally "the best cyber model." It is that Google has shipped a restricted defensive model with strong vendor-reported vulnerability-reproduction performance and a competitive independent held-out patching result, while important questions remain around matched-harness reproducibility, the private 20-language evaluation, public latency, standalone pricing and broader hands-on access.