Google releases Gemini 3.8 Flash and a cybersecurity variant limited to governments

Google has released Gemini 3.8 Flash . It is the company’s third Flash model in six weeks, Ars Technica reported .

There are two variants. A general model Google calls a workhorse, and Flash Cyber, tuned for finding and fixing software vulnerabilities. Flash Cyber replaces the 3.5 version.

The Pro line has not moved since early 2026. TNW reported that the cheap model is now two versions ahead of the flagship.

Pricing is introductory until the end of the year. $0.75 per million input tokens and $3.75 output, against $1.50 and $7.50 afterwards. Rivals have been cutting token prices to keep wary businesses engaged.

Google signed up to this willingly. It joined the general purpose AI Code of Practice on 30 July 2025, a week after Meta refused to.

The systemic risk tier carries a clock. A model trained above 10 to the 25th floating point operations must be notified to the Commission within two weeks under Article 52 .

That window is shorter than the gap between these releases. Gemini 3.7 Flash arrived three weeks before this one.

Whether any of them crosses the threshold is not public. Google has not said, and the presumption turns on training compute rather than on benchmark results. Flash models are by design smaller than the Pro line.

The cyber variant raises a different question. Flash Cyber goes only to trusted testers and governments, and Google does not say which governments.

The rest is the familiar weak spot. Google’s own figures put Flash behind Claude Opus on agentic computer use, a year after TNW covered the computer use tool added at 3.5.

The security claims are all internal. A 2.6x improvement in patch accuracy for the Chrome team, and a critical vulnerability found in two hours, both measured by Google.

Which is what the cadence obscures. Every release carries its own European obligations, for a product line that at launch was not available in Europe .