Gemini 3.8 Flash API 2026: $0.75/M Cyber Tier

What Is Gemini 3.8 Flash?

Gemini 3.8 is the successor to the stable Gemini 3.7 Flash that Google released on August 13, 2026. The "third Flash release in six weeks" compresses an unusually fast cadence - Google has been iterating its low-cost Flash line more aggressively than its premium tier, and 3.8 lands the reasoning-and-coding gains from that cadence at the identical headline price point. The two variants ship out of a shared core trained with "rigorous training in the highly demanding domain of cybersecurity," and the reasoning gains are further amplified by "long-running agentic loops designed to recursively evaluate and refine" the underlying models.

• Gemini 3.8 Flash - the general-purpose workhorse for agentic workflows, coding agents, and multi-step reasoning in specialized domains. Available in the Gemini API, Google AI Studio, Antigravity, Stitch, and Gemini Enterprise.
• Gemini 3.8 Flash Cyber - the cybersecurity variant, focusing on autonomous vulnerability discovery and automated patching, gated behind the Fairwind Program application and served only to trusted defenders.

Both variants carry the same safeguards Google has applied across its Frontier Safety Framework - CBRN and cyber-offense guardrails on the standard model, and a deliberately more permissive mitigation set on the restrictively-distributed Cyber model. The shared core also brought "a significant leap in prompt injection robustness" measured by Gray Swan, which matters for any agent built on top of the API that passes untrusted content into its context.

The Verified Pricing: Same Intro, Doubles in 2027

Google is not discounting 3.8 Flash below 3.7 Flash - the launch keeps the same introductory price and cards the same doubling schedule. Per the DeepMind announcement footnote, the $0.75/$3.75 rate expires December 31, 2026.

Compared with the wider frontier, $0.75/$3.75 puts 3.8 Flash at a small fraction of an Anthropic Opus- or OpenAI GPT-6-class flagship (GPT-6 Astra lists at $10/$50 per 1M). It is squarely a volume workhorse tier: cheap enough for high-frequency agent calls and long-horizon loops, expensive only if a single agentic session burns an unusual number of output tokens.

What Google did not publish in the September 2 announcement: a distinct per-model context-caching surcharge, a long-context multiplier, or a hard context-window ceiling specific to 3.8 Flash. I am deliberately not filling those numbers in. Treat them as "check the live Google AI Studio pricing page" items before you estimate a production workload - the exact model ID string and cache rates are best confirmed at ai.google.dev/gemini-api/docs rather than inferred from the blog.

Benchmarks: Where the Gains Land

The announcement leans on three clusters of evidence, and the direction is consistent: 3.8 Flash approaches or beats much larger frontier models on agentic and reasoning benchmarks at a fraction of their cost.

Agentic coding and long-horizon engineering

• DeepSWE v1.1 (long-horizon software engineering) - Google says 3.8 Flash "outperforms most larger frontier models in autonomously solving complex engineering problems end to end, only at a fraction of the cost." This is the benchmark that correlates most with coding-agent reliability over minutes-to-hours of autonomous work.
• Vals Finance Agent V2 and Harvey's Legal Agent Benchmark - in these quantitative and professional domains "requiring advanced analysis and reporting," 3.8 Flash outperforms both its own 3.7 Flash predecessor and other frontier models.
• HLE-Verified 54.9% - Google cites a 54.9% score on HLE-Verified, its multi-step reasoning benchmark spanning STEM, humanities, and professional fields, as evidence the model "works harder" correctly rather than just producing longer chains.

Cybersecurity - the differentiated variant

Gemini 3.8 Flash Cyber is where this release is genuinely novel for an API audience. The numbers Google published, which I verified against the announcement body:

• CyberGym (autonomous vulnerability discovery) - frontier-level, surpassing Google's own 3.5 Flash Cyber and "significantly larger frontier models."
• Internal 20-language benchmark - because CyberGym is C/C++-heavy, Google also tested across complex codebases spanning 20 programming languages and reports a success rate exceeding 70%, a "leap over previous models."
• CWE-Bench (external patching benchmark run by Collinear) - pass@1 of 47.2% vs a leading frontier model at 47.8%, placing 3.8 Flash Cyber "on the Pareto frontier" at significantly lower cost.
• Google-internal adoption (not third-party, flagged as self-reported) - Chrome Security measured 2.6x more correct patches than larger best commercial models; security vendor Wiz measured +7.5-9.7% higher recall on its internal pentest benchmark at 2.3-5.2x lower cost; Google's Cloud Vulnerability Research team found a critical foundational vulnerability in under two hours for a class of discovery that "usually takes months."

Google is explicit that 3.8 Flash Cyber was steered toward defense - "we have invested in vulnerability fixing from the start, and prioritized it over offensive capabilities like exploitation." For a security team that wants model-assisted patching rather than another exploit generator, that framing is the product.

The "Works Harder" Token Trade-off

The single most important planning fact about 3.8 Flash is that per-token price is not the whole cost story. Google explicitly says the model is tuned to be diligent: "On complex tasks, it exhibits greater diligence - executing extra reasoning steps, and calling tools iteratively. At times, the model might use more tokens to maximize performance, especially at higher effort levels."

For agentic workloads the meaningful unit of cost is tokens-per-completed-task at your chosen effort setting, not the per-million rate. Two implications:

• Lower the effort level for compute-bound jobs. Google says developers "can utilize lower effort levels to minimize token overhead" - so a scrape-and-classify pipeline that does not need deep reasoning should run at low effort to avoid paying for diligence it does not use.
• Keep 3.7 Flash in the toolbox. Google states Gemini 3.7 Flash "remains fully supported for efficiency-first workloads." If your traffic is latency- and token-sensitive and does not need 3.8's reasoning gains, 3.7 is the cheaper default; route only the hard subset to 3.8.

Code Examples: Two Real Calls

Gemini 3.8 Flash is served through Googles standard Gemini API surface. The request shape is identical to 3.7 Flash; you change the model string and set the generation configuration for effort. These examples use the environment-variable key pattern - never commit a raw API key.

Example 1 - curl: a coding-agent-style call

curl "https://generativelanguage.googleapis.com/v1beta/models/gemini-3.8-flash:generateContent" \
  -H "x-goog-api-key: $GEMINI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "contents": [
      {
        "role": "user",
        "parts": [
          {
            "text": "Review this TypeScript function for a race condition and rewrite it with proper locking:\n\n" +
            "let cache = {};\nfunction get(key) { if (cache[key]) return cache[key]; ... }"
          }
        ]
      }
    ],
    "generationConfig": {
      "temperature": 0.2,
      "maxOutputTokens": 1024
    }
  }'

Note: confirm the exact stable model ID (gemini-3.8-flash vs a suffixed preview name) on the live AI Studio model list before shipping - Google has historically preview-tagged new Flash models for a few days before the stable ID lands.

Example 2 - Python: lower the effort floor for a high-volume batch

import google.generativeai as genai
  import os

  genai.configure(api_key=os.environ["GEMINI_API_KEY"])

  # Pick a lower "effort" config so a high-volume labeling batch does not
  # burn extra reasoning tokens it does not need. Check exact parameter names
  # against the live SDK for the 3.8 model before running at scale.
  model = genai.GenerativeModel(
      "gemini-3.8-flash",
      generation_config={"temperature": 0.0},
  )

  texts = ["Classify: refund request", "Classify: feature request"]
  for t in texts:
      resp = model.generate_content(t)
      print(resp.text)

Because Gemini 3.8 is closed-weight and API-only through Google, there is no self-hosted path - and Gemini 3.8 Flash Cyber is not a general API SKU at all; it is Fairwind-Program access only.

Who Should Use Gemini 3.8 Flash

Good fits (standard 3.8 Flash):

• Autonomous / long-horizon coding agents - IDE plugins, CI code-review bots, multi-file refactor agents that run for minutes. DeepSWE v1.1 improvements + iteration-heavy tool use are the target.
• Professional multi-step reasoning at volume - finance-document analysis, legal research drafting, regulatory summarization, where HLE-Verified 54.9% and agentic benchmark gains translate to fewer re-runs.
• Reasoning-heavy workload on a budget - a team that wants near-frontier reasoning at a sub-$1 input tier rather than an Opus/GPT-6-class $10 input tier.

Wait, or use 3.7 Flash instead:

• Efficiency-first, latency-sensitive pipelines that do not need extended reasoning - stay on 3.7 Flash, "fully supported for efficiency-first workloads" per Google.
• Deployments gated on a hard context/price estimate - Google had not published the caching and long-context tables for 3.8 at announcement time; wait for the stable pricing page to land.
• Any general-purpose chat where GPT-5.6-class or free-tier alternatives already suffice.

Gemini 3.8 Flash Cyber is not a self-serve API product - it is an application-gated capability for government authorities, critical-infrastructure operators, and software maintainers. If that describes you, the Fairwind application on the DeepMind page is the only legitimate route; treat any "unrestricted 3.8 Cyber API" listing elsewhere as unverified.

Verdict

Gemini 3.8 Flash is the right incremental upgrade for teams already running Gemini 3.7 Flash on coding-agent or professional-reasoning workloads: same headline price through the end of the year, a measurable reasoning-and-agentic step up, and an honest trade-off (extra tokens on hard tasks, controllable by effort level). It is not a reason to migrate off an Opus/GPT-6-class flagship if you need that tier's raw ceiling - 3.8 Flash is a workhorse that approaches, not exceeds, the largest frontier models, and Google priced it like one. The genuinely distinct element of this release is 3.8 Flash Cyber: the first mainstream launch to put a frontier-parity automated-patching model (CWE-Bench pass@1 47.2%, ~47.8% for the largest rival) behind a restricted defender-gate, with patching deliberately prioritized over exploitation. For security teams with the clearance to use it, that is a new capability class rather than another price cut. For everyone else, book the $0.75/$3.75 rate before December 31 if you intend to run 3.8 Flash through 2027 - the on-demand list price doubles on January 1.