How Does Gemini 3.8 Flash Cyber Find Bugs?

TL;DR

Gemini 3.8 Flash Cyber can identify software vulnerabilities and generate patches across large codebases, with Google reporting strong results across 20 programming languages. Its low operating cost makes continuous scanning more practical, but its reduced cybersecurity restrictions mean access is limited to approved governments, critical infrastructure operators, and advanced defensive partners.

Transcript

A bug sat inside Chrome for 13 years. Hundreds of engineers looked straight at it. Nobody saw it. This week, a small, absurdly cheap Google model found it in one pass. That model is Gemini 3.8 Flash Cyber, and it comes in two flavors. One of them is locked behind an application form for governments and critical infrastructure operators because Goog... Read More

Key Insights

• Gemini 3.8 Flash Cyber is a specialized model that combines vulnerability discovery with automated patch generation. Google describes it as capable of frontier-level cybersecurity performance, while emphasizing defensive applications such as finding broken code and writing fixes that can operate at scale.
• Google reports that Flash Cyber scored 86.2% on CyberJim for vulnerability discovery and 47.2% on CWE for patching. An additional internal evaluation recorded a success rate above 70% across 20 programming languages, although that result comes from Google's own testing and scoring.
• Flash Cyber produced 2.6 times more correct Chrome patches than much larger commercial models, according to Google. The emphasis on correct patches matters because the claimed output consists of fixes that held up, rather than speculative warnings or unverified suggestions about possible defects.
• A Chrome vulnerability remained undetected for 13 years despite review by dozens or possibly hundreds of engineers. Google says Flash Cyber found the subtle flaw, illustrating how generative AI can uncover weaknesses that persist even in heavily reviewed open-source software.
• Low-cost inference is essential for defensive cybersecurity because attackers need to find only one useful weakness, while defenders must locate and remove every significant flaw. An inexpensive model can repeatedly scan enormous codebases where constant use of costly frontier models would be financially impractical.
• The standard Gemini 3.8 Flash costs $0.75 per million input tokens and $3.75 per million output tokens. It supports a 1 million-token input window, a 64K output limit, and multimodal inputs including text, images, audio, video, and PDFs.
• Gemini 3.8 Flash reaches roughly 305 tokens per second and costs about $0.58 for a high-effort task, according to Artificial Analysis. Its Deep SWE score of 73.7% was close to Claude Opus 5 at 74.0%, despite the reported price difference.
• Flash Cyber is distributed through Google's fair win program to selected governments, critical infrastructure operators, and advanced cyber defenders. Google loosened cybersecurity mitigations so approved defenders can perform more capable security work while retaining safeguards related to chemical, biological, radiological, and nuclear misuse.
• More videos from this channel:
  • Does Claude Have an Internal Reasoning Workspace?
  • How Do Realistic AI Robots Change Global Power?
  • How Does DSpark Make AI Inference Faster?
• More from this channel: AI Revolution

Questions & Answers

Q: What is Gemini 3.8 Flash Cyber designed to do?

Gemini 3.8 Flash Cyber is designed to find security vulnerabilities and generate patches for the flaws it discovers. Google says it can operate across large codebases and 20 programming languages. Its purpose is primarily defensive, with vulnerability fixing prioritized over offensive capabilities such as exploitation, and access is controlled because its cybersecurity safeguards are deliberately more permissive.

Q: How well does Gemini 3.8 Flash Cyber find vulnerabilities?

Google reports that Gemini 3.8 Flash Cyber scored 86.2% on CyberJim, a benchmark focused on finding real security flaws. The company also says the model achieved a success rate above 70% when discovering vulnerabilities across 20 programming languages. The latter figure comes from an internal Google benchmark using Google's own scoring, so the transcript advises treating it cautiously.

Q: Can Gemini 3.8 Flash Cyber automatically patch software bugs?

Gemini 3.8 Flash Cyber can generate patches in addition to identifying vulnerable code. Google reports a 47.2% score on CWE, which evaluates whether the model can patch discovered problems. Against Chrome vulnerabilities, the model reportedly produced 2.6 times more correct patches than much larger commercial models, meaning the fixes held up rather than merely identifying possible issues.

Q: What Chrome vulnerability did Google's cybersecurity AI discover?

Google says its cybersecurity model found a subtle Chrome bug that had remained in the code for 13 years. Chrome engineering director Doug Turner said dozens, and possibly hundreds, of engineers had examined the relevant code without flagging it. The example suggests AI-based analysis can reveal vulnerabilities that survive extensive human review in a heavily examined open-source project.

Q: Why is low cost important for AI vulnerability scanning?

Low cost makes it practical to scan enormous codebases repeatedly. Attackers need to find only one meaningful weakness among millions of lines of code, while defenders must identify and remove every important flaw. Because expensive frontier models would make continuous analysis financially impractical, a fast and inexpensive model can give defenders broader and more frequent coverage.

Q: How much does the public Gemini 3.8 Flash model cost?

The standard Gemini 3.8 Flash model is priced at $0.75 per million input tokens and $3.75 per million output tokens, matching the introductory pricing of 3.7 Flash. Artificial Analysis estimated that one high-effort task costs about $0.58. Users can also adjust the effort level depending on whether they prioritize quality, cost, or response latency.

Q: How does Gemini 3.8 Flash compare with Claude Opus 5?

On Deep SWE, a benchmark involving end-to-end solutions to real engineering problems, Gemini 3.8 Flash scored 73.7%, while Claude Opus 5 scored 74.0%. However, independent testing produced mixed conclusions. One comparison found that Opus followed a New York street-scene prompt more completely, while another tester paid $12 with Flash compared with $186 using Opus 5.

Q: Why is access to Gemini 3.8 Flash Cyber restricted?

Google restricts Flash Cyber because the model uses more permissive cybersecurity mitigations than the public version. Looser restrictions allow approved defenders to perform advanced security work that ordinary safeguards might block. Access is provided through the fair win program, which prioritizes government authorities, critical infrastructure operators, and other advanced defensive partners, while organizations can apply to participate.

Summary & Key Takeaways

• Gemini 3.8 Flash Cyber is a specialized cybersecurity model designed to find vulnerabilities and produce working patches. Google reports an 86.2% CyberJim score, a 47.2% CWE patching score, and success above 70% across 20 programming languages on an internal benchmark that should be interpreted cautiously.

• Google says Flash Cyber produced 2.6 times more correct Chrome patches than much larger commercial models and found a subtle bug that had remained unnoticed for 13 years. Its cloud vulnerability research team also reports that the model discovered a critical foundational vulnerability in less than two hours.

• Access to Flash Cyber is controlled through Google's fair win program because its cybersecurity safeguards are more permissive than those of the public model. Meanwhile, the standard Gemini 3.8 Flash offers inexpensive, fast agentic reasoning through public developer tools, although independent tests reveal inconsistent performance across different tasks.