This week, three of the biggest AI labs each shipped a cyber-capable model and walled it off from the general public. For two of them it was a notable move. For Google, it is becoming routine — and the routine just got a name.

Google DeepMind has released Gemini 3.8 Flash, its latest general-purpose model, alongside the variant that matters: Gemini 3.8 Flash Cyber, built to find and automatically patch software vulnerabilities. Google has shipped a security-focused Flash sibling before — its July release included one — but this one arrives with a sharper number and a formal gate.

What Flash Cyber does

Where OpenAI's disclosure this week was about a model that could find and exploit security holes on its own, Google's pitch is the defensive mirror: Flash Cyber is aimed at vulnerability detection and automated patching — finding the hole and writing the fix.

The number Google leads with is a real-world one. Its Chrome Security team reports that 3.8 Flash Cyber produced 2.6 times more correct patches to Chrome vulnerabilities than the best commercial models tested — models that are much larger. A small, fast model beating bigger ones at a narrow, high-stakes task is exactly the efficiency story the frontier keeps flirting with.

And it's gated too

Flash Cyber is not generally available. It ships only through Google's new Fairwind Program, open to government authorities, critical-infrastructure operators, and software maintainers — the people who defend systems, not the general public.

That is the pattern this site has watched crystallise all week. Anthropic kept its more powerful Mythos model behind cyber and life-sciences verification. OpenAI limited access to its Astra model over "Critical" cyber capability. Google has been running its own version of this longer than either — a security-only Flash sibling since at least July — but with Fairwind it has now put a formal program around it, and its two biggest rivals have converged on the same idea in the same week.

The nuance is worth sitting with. OpenAI's gating was easy to understand: a model that can autonomously break into hardened systems is dangerous in the wrong hands. But Google is gating a model whose job is to fix things. The logic is the same underneath: a tool that can find and patch a vulnerability at scale can also find it at scale, and a vulnerability discovered is a vulnerability that exists whether you patch it or attack it. Defensive and offensive cyber capability are, increasingly, the same capability pointed in different directions — which is why all three labs are drawing the same line.

The ordinary half

The non-cyber release is the routine part. Gemini 3.8 Flash is Google's standard general-purpose model, with the usual claimed gains in software engineering, agentic tasks and multi-step reasoning, priced at $0.75 per million input tokens and $3.75 per million output — matching its three-week-old predecessor, 3.7 Flash. Google has been shipping a new Flash model roughly every three weeks since late July, which tells you how fast the mid-tier of the market is now moving.

But the standard model is not the story. The story is that in a single week, the three labs that set the frontier all shipped a cyber model and all decided who was allowed to hold it. The gate is becoming standard equipment.