Presented by Anthropic on September 1, 2026, Claude Fable 5.1 and Claude Mythos 5.1 are built on the same model, but they do not unlock the same sensitive uses. Fable is widely available with strengthened safeguards, while Mythos is reserved for vetted professionals in cybersecurity and the life sciences. The most important innovation, then, is not two levels of intelligence but a distribution of capabilities based on identity, context of use and risk.
Two models from the same foundation
Gemini 3.8 Flash succeeds Gemini 3.7 Flash three weeks after its launch. Google is positioning it for long-running software engineering, autonomous agents and complex professional workflows. The documentation states that it is built on Gemini 3.7 Flash and retains a context window of up to 1,048,576 tokens, with a maximum output of 65,536 tokens. Inputs can combine text, images, video, audio and PDFs, while the documented output remains text only.[1][2][3]
Gemini 3.8 Flash Cyber uses the same core intelligence but receives specialization and access rules tailored to cyber defense. Google presents it as capable of exploring complex repositories, hunting for vulnerabilities and producing fixes. It is not offered through consumer channels. Access goes through the Fairwind program, which targets public authorities, critical infrastructure operators and technology platforms deemed essential, among others.[1][4]
This separation should be understood as an architecture for distributing capabilities. The general-purpose model keeps safeguards against offensive cybersecurity uses. The Cyber variant applies more permissive protections for sensitive defensive tasks, in exchange for vetting of organizations, stronger authentication and access monitoring. The novelty therefore lies as much in the model’s governance as in its technical performance.[1][4]
A primarily agentic evolution
Gemini 3.8 Flash is not an entirely separate new model family. The official model card specifies that it is built on Gemini 3.7 Flash. Google attributes the announced gains to training improvements, notably in cybersecurity, and to long agentic loops used to evaluate and then refine the system. This continuity suggests a significant evolution in post-training and orchestration rather than a demonstrated architectural breakthrough.[1][2]
The most visible change is persistence. On a difficult task, the model can perform more intermediate steps, call tools multiple times and check its work before responding. Developers choose a low, medium or high reasoning level. Medium is the default. The high setting can improve some complex tasks, but it also increases token count, latency and the risk that an early error propagates through the rest of the trajectory.[3]
Unit pricing therefore does not capture the economics of an agent. Through December 31, 2026, Google is charging $0.75 per million input tokens and $3.75 per million output tokens, rising to $1.50 and $7.50 starting January 1, 2027. These prices are identical to Gemini 3.7 Flash’s during the launch period, but a job that requires more turns, outputs and tool calls can cost more overall.[1][3]
How it works: long loops and tools
A conversational model generally produces a response to a request. An agent receives a goal, chooses an action, observes the result and adapts what comes next. In a software repository, this loop can include searching files, analyzing dependencies, modifying code, running tests and correcting an initial solution. Gemini 3.8 Flash supports function calling, code execution, file search, structured outputs and URL context. Computer use is available in preview.[3]
Flash Cyber applies this logic to a security pipeline. The agent can receive vulnerable code, explore execution paths, try to reproduce the behavior, locate the root cause and propose a patch. Detecting a weakness and fixing it remain two different tasks. A fix can remove the tested symptom while leaving the cause active, break a feature or create a new vulnerability. Security testing, functional testing and human review therefore remain necessary.
Google also says Flash Cyber can be used with CodeMender, its agent specialized in fixing vulnerabilities. The model then provides the reasoning and generation capabilities, while the agentic environment orchestrates tools, tests and validation. This distinction matters: a score rarely measures the model in isolation. It also depends on the harness, permissions, the data provided and the number of attempts allowed.[4]
Technology Framework
Code and security become chains of action
For development teams, the value of Gemini 3.8 Flash lies in carrying out longer jobs. The model can take part in a migration, track down a regression or modify multiple files while taking test results into account. This continuity reduces some context switching, but it requires explicit success criteria. A task completed by the agent is only useful if the tests cover the expected behavior and the change respects the project’s architecture.
For security teams, Flash Cyber promises to shorten the time between identifying a weakness and proposing a fix. Google says it already uses it on its own code. The company reports that the Chrome team obtained 2.6 times more valid fixes than with the best larger commercial models in its comparison. It also says its Cloud Vulnerability Research team found a vulnerability rated critical in under two hours, in research that would typically have taken several months. These results are interesting, but they come from Google and describe neither the full sample nor the false-positive rate.[1]
The organizational gain will depend above all on the ability to integrate the agent into an existing security process. A cautious deployment gives it access to the code it needs, runs it in an isolated environment, logs tool calls and requires approval before any merge or production release. Direct access to secrets, customer data or production systems increases risk without being essential to most audits.
What the published results support
The published evaluations support a limited conclusion. Gemini 3.8 Flash improves on Gemini 3.7 Flash across several software engineering and specialized work tests. Flash Cyber outperforms Google’s earlier versions on reproducing or discovering vulnerabilities. They do not show that a single model dominates every use case, nor that an agent can reliably fix a production system without validation.
DeepSWE provides a useful public check. As of September 22, 2026, its leaderboard places Gemini 3.8 Flash at about 74%, with an average cost of $2.36, 143,000 cumulative output tokens and 166 steps per task. Gemini 3.7 Flash reaches about 65%, for $2.03, 94,000 tokens and 117 steps. The progress therefore comes with a longer trajectory and a higher average cost on this test, despite identical per-token pricing.[5]
CyberGym deserves a careful reading. The benchmark brings together 1,507 historical vulnerabilities from 188 projects. At its main level, the agent receives a description and an unpatched repository, then must produce a proof of concept that reproduces the vulnerability. This is a realistic reproduction task, but different from fully open-ended discovery. The authors also stress that results are submitted by the teams, that runs are stochastic, and that small gaps may not represent a significant difference.[6]
Patching results call for additional caution. Recent work on PatchBench shows that evaluations based on a proof-of-concept test can overestimate the quality of fixes. Some agents produce a patch that closely resembles a memorized historical fix, or remove the symptom without addressing the cause. In this study, validation limited to the initial test inflates the success rate by an average factor of 1.83. The CWE-Bench result should therefore be read as an experimental signal, not as a guarantee of a correct fix in production.[7]
Controlled access becomes part of the product
Cyber capabilities are dual-use. A system capable of explaining why a vulnerability works possesses part of the knowledge needed to reproduce it. Google addresses this tension with Fairwind. Partners can conduct authorized threat simulations, reverse engineering and malware analysis for defensive or academic purposes. They must enforce individual authentication, phishing-resistant multi-factor authentication, access controls and usage monitoring.[4]
The program prohibits sharing, reselling or redistributing access. Google also vets applicant organizations and restricts internal use to cybersecurity, incident response or penetration testing teams. These rules reduce some opportunities for abuse, but they do not prove that an approved account will always remain legitimate. An organization can be compromised, an authorized user can exceed their mandate, and a defensive request can produce material that is reusable elsewhere.
Governance must therefore continue after admission. The duration of rights, accessible repositories, usable tools, approval thresholds and revocation procedure all need to be defined. Logs must make it possible to reconstruct the data accessed, the commands executed, the changes proposed and the human approvals. Differentiated access is a security measure, not proof that all outputs become safe.
Organizations must secure the agent before the code
An agent connected to tools encounters untrusted data. A malicious instruction can be hidden in a web page, a file, a ticket or a code comment in order to hijack its trajectory. Google reports an attack success rate of 6% for Flash Cyber on the Gray Swan IPI benchmark, where a lower value is better. This result indicates greater resistance under the published protocol, without demonstrating immunity. Gray Swan notes, moreover, that no model tested in its indirect injection competition was fully protected.[8]
Defense therefore relies on several layers. External content must be treated as data, secrets must stay out of the context when they are not needed, and tools must enforce least privilege. Irreversible actions, or those likely to affect production, require approval. Execution environments must limit the network, files and identities that can be accessed. Finally, teams must test the complete system, because model safety does not automatically extend to the application’s connectors, scripts and policies.
Human oversight does not mean mechanically clicking an approval button. The reviewer must understand the change, know which tests are missing and be able to reject or correct the patch. Cybersecurity roles are thus shifting toward evaluating agentic trajectories, designing access policies, checking evidence and analyzing incidents caused by the agents themselves.
Costs and impacts must be measured per job
The price of Gemini 3.8 Flash may make experimentation easier, but an organization must track the cost per completed task. This measure includes tokens, tool calls, compute for isolated environments, failures, retries and review time. An agent that is cheaper per token can become more expensive if it multiplies steps or produces very long outputs. DeepSWE’s public data illustrate precisely this gap between unit price and operational cost.[5]
The same reasoning applies to environmental impact. Google acknowledges that the model may use more tokens on complex tasks, but the model card consulted does not publish energy consumption per job or a carbon footprint specific to Gemini 3.8 Flash. It would therefore be premature to quantify any gain or deterioration. Organizations can nonetheless reduce unnecessary computation by choosing the right effort level, limiting loops, reusing the cache and stopping trajectories that are no longer making progress.[3]
The legal framework depends on use and sector
In the European Union, the AI Act does not automatically classify a cybersecurity agent as a high-risk system. Classification depends on the role of the actor, the intended purpose, and the deployment context. A system used as a safety component of critical digital infrastructure may be subject to stricter requirements. Since August 2, 2026, the AI Office and national authorities have been implementing and enforcing the applicable provisions of the regulation, with a separate timeline for certain high-risk categories.[9]
The GDPR still applies when the agent processes personal data found in logs, incident tickets, repositories, or client environments. Organizations must limit the data shared, establish a legal basis and a retention period, control transfers, and document who can access the traces. Technical secrets, keys, and credentials require specific protection, even when they are not personal data.
The EU Cyber Resilience Act adds another dimension for products with digital elements. Its reporting obligations for actively exploited vulnerabilities and serious incidents have applied since September 11, 2026, while most of the regulation will apply from December 11, 2027. A patch generated by an agent does not replace vulnerability analysis, documentation, or the manufacturer’s obligations.[10]
What to watch now
The first question concerns independent reproduction. The internal results across twenty languages, the fixes produced for Chrome, and the vulnerability discovered in under two hours should be documented with sufficient protocols, samples, and false positive rates. Without these elements, they remain results announced by Google and its partners.
The second question concerns patch quality. It will be necessary to measure whether the root cause is fixed, whether functional tests pass, the absence of regressions, robustness against attack variants, and code maintainability. A success rate on a proof of concept does not answer all of these questions.
The third question is access. Fairwind has more than 650 partners according to Google, but the effectiveness of the governance model will depend on incidents, revocations, audits, and transparency about admission criteria. The advantage given to defenders can only be assessed by observing how capabilities spread and how attackers adapt.[4]
Gemini 3.8 Flash and Flash Cyber thus show agentic AI progressing toward longer and more sensitive tasks. Their real impact will be measured by the reliability of complete trajectories, the cost per mission, the quality of fixes, and organizations’ ability to limit permissions. In cybersecurity, model performance and the security of its environment become inseparable.
Further reading
To place Gemini 3.8 Flash and Flash Cyber in the evolution of coding agents, specialized models, and cyber defense careers, continue with these analyses from the aivancity blog.
Sources
[1] Google, September 2, 2026. Introducing Gemini 3.8 Flash and 3.8 Flash Cyber. View source
[2] Google DeepMind, September 2026. Gemini 3.8 Flash Model Card. View source
[3] Google AI for Developers, accessed September 30, 2026. Gemini 3.8 Flash Latest Model Documentation. View source
[4] Google DeepMind, accessed September 30, 2026. Gemini 3.8 Flash Cyber and Fairwind Program. View source
[5] Datacurve, leaderboard updated September 22, 2026. DeepSWE v1.1 Leaderboard. View source
[6] Wang, Z. et al., ICLR 2026. CyberGym: Evaluating AI Agents’ Real-World Cybersecurity Capabilities at Scale. View source
[7] Shen, C. et al., September 3, 2026. PatchBench: Evaluating AI Agents for Vulnerability Patching. View source
[8] Gray Swan AI, accessed September 30, 2026. Indirect Prompt Injection Arena and Benchmark Resources. View source
[9] European Commission, accessed September 30, 2026. The Enforcement Framework of the AI Act. View source
[10] EUR-Lex, Regulation (EU) 2024/2847. Cyber Resilience Act and Application Calendar. View source