Post cover image
Gemini Cyber

September 5, 2026

Google Opened Fairwind. You Don’t get Gemini Cyber.

Gemini 3.8 Flash and Flash Cyber share a core. Only Fairwind is the uncaged model

By allglenn

5 min read

Two models, one core

Google's own narrative for this launch is unusually blunt about the mechanics: one foundational model, two different mitigation stacks bolted on top.

Standard Gemini 3.8 Flash ships with the full safeguard set intact, including the layer that limits CBRN-adjacent misuse and the layer that limits cyber-offense capability.

Gemini 3.8 Flash Cyber ships with that second layer loosened. Same weights underneath, different rules on what the model is allowed to help with once you're past the front door.

Google Cyber has more permissive mitigations than the public model, and that's why it isn't public. The safety story here isn't "we built a separate, weaker model." It's "we built one model and decided who gets the version with the leash off."

Where it sits

Standard 3.8 Flash is everywhere you'd expect a Flash-tier model to be: the Gemini API, AI Studio, the Gemini app, Gemini Enterprise, and as one of the model options inside Antigravity. Anyone with an API key gets it.

Flash Cyber sits behind a different door. You apply to the Fairwind Program, Google vets you, and if you clear that bar you get Cyber paired with CodeMender, Google's vulnerability-discovery-and-patching harness. That pairing is more important than the model alone:

CodeMender does the scanning, the proof-of-concept exploitation, and the patch generation, and Cyber is the reasoning engine plugged into it.

any Google Cloud customer can already run CodeMender against their own code using the publicly available models on Gemini Enterprise Agent Platform.

The uncaged path, mapped

None

The Fairwind gate

Fairwind isn't a waitlist for enthusiasts. Google names the eligible categories directly: government cyber authorities, critical infrastructure operators across healthcare, telecom, energy, and finance, maintainers of widely used core software, and vetted cybersecurity partners already in the Google Cloud ecosystem. A developer at a company outside those categories can't currently apply, full stop.

Once admitted, an organization can only extend access to internal cybersecurity, incident response, or penetration testing staff, tracked individually, with phishing-resistant multi-factor authentication required. No reselling, no redistribution. Google puts the current partner count above 650 globally at launch, which is a real number, not a placeholder cohort.

Google's own language for why the gate exists is worth using directly: this gives defenders a genuine adaptation window before the capability is available more broadly. That's a staged rollout, not a permanent wall, at least by Google's stated intent. Whether it stays staged is a separate question from whether it's staged today.

The numbers, Google's own

All of the following are Google's published claims from the launch, not independently reproduced benchmarks, and should be read that way.

Standard 3.8 Flash scores 54.9% on HLE-Verified, a cleaned-up version of Humanity's Last Exam built specifically to catch the annotation errors that were quietly rewarding models for the wrong reasons. The underlying test is a wall of expert-level questions across math, science, and the humanities, deliberately designed to resist the kind of internet-lookup shortcut that made older benchmarks stop meaning anything.

That's not a coding score. It's a general reasoning score, and Google is using it to argue that Flash's gains aren't narrowly about code, they show up in domains the model was never specifically tuned for.

Flash Cyber's numbers are measuring something else entirely, because they're not testing what the model knows, they're testing what it can do to real, exploitable code. The 70%-plus figure comes from an internal benchmark built to resemble the actual job: hand the model a codebase across 20 different programming languages and see how often it surfaces a vulnerability that's genuinely there.

That's a discovery number, and discovery is historically the easier half of this problem. Finding a bug that exists is a search problem.

Writing a fix that closes it without breaking anything else is a harder, different problem, which is exactly what CWE-Bench is built to isolate. Run by an outside evaluator, Collinear, CWE-Bench doesn't just check whether a patch looks plausible. It runs an actual proof-of-concept exploit against the patched code and only counts a pass if the exploit stops working and the existing regression tests still pass.

Cyber's 47.2% pass@1 there, half a point behind a leading frontier model's 47.8%, says it closes real vulnerabilities about as often as the best general-purpose alternative, at a fraction of what that alternative costs to run per task.

Chrome's security team measured correct patches specifically, not just plausible-looking diffs, and reported 2.6 times more of them than the larger commercial models they compared it against, a claim about output quality under real code review rather than a leaderboard number..

On price, standard 3.8 Flash holds the same introductory rate 3.7 Flash launched at: $0.75 per million input tokens, $3.75 per million output, through the end of 2026. On January 1, 2027, both double, to $1.50 and $7.50.

The Anthropic already did this

This isn't the first time a frontier lab has split a model into a public tier and a gated, more capable cyber tier.

Anthropic did the same thing with Claude Fable 5.1 and Claude Mythos 5.1: identical underlying model, with Fable carrying the additional safety layer for biology, cyber, and model-R&D misuse that Mythos doesn't carry. Mythos itself isn't a public product.

Access runs through Project Glasswing, Anthropic's vetted-partner cybersecurity initiative, launched in April 2026 with a founding roster that includes AWS, Apple, Broadcom, Cisco, CrowdStrike, JPMorganChase, the Linux Foundation, Microsoft, NVIDIA, Palo Alto Networks, and Google.

Where the full capability gets used

The refusal boundaries Cyber loosens aren't decorative.

Reasoning through exploit chaining, bypass logic, and how a vulnerability actually gets weaponized is exactly the work the public model is trained to decline, and it's also the work these specific jobs require.

Based on Fairwind's own eligibility categories and the partners Google names, that's where the gap between Flash and Cyber stops being theoretical:

  • Live incident response during an active intrusion. Containing a breach means reconstructing what the attacker actually did, step by step, not describing the vulnerability class in the abstract. That's malware analysis and exploit reconstruction, the exact reasoning the public model won't fully engage with.
  • National and sector cyber authorities running triage across many agencies or operators at once. Government CERTs and equivalents are named explicitly as Fairwind's first eligibility tier, because a single team validating exploitability across dozens of downstream organizations needs a model that can confirm a vulnerability is real, not just plausible.
  • Critical infrastructure operators auditing legacy, multi-language codebases continuously. Healthcare, energy, telecom, and financial systems tend to run on code nobody has fully mapped in years. Cyber's discovery pass across 20 languages is built for exactly that kind of unowned, accumulated risk.
  • Core open-source maintainers who can't outscale their own codebase. A small team maintaining infrastructure the rest of the internet depends on doesn't have the headcount to manually chase every reachable weakness. That's the maintainer category Fairwind names directly.
  • Managed security providers running vulnerability discovery at client scale. Partners like CrowdStrike and Palo Alto Networks are pointing swarms of agents at other organizations' environments, not their own, which means the tool has to reliably confirm real exploitability across code it's never seen before, under a client contract, not a guess.
  • Authorized penetration testing and bug bounty triage. Confirming that a submitted report is a real, exploitable path, rather than a theoretical CWE match, is the specific task Wiz has described testing Cyber against, and it's a task that requires actually reasoning through the exploit, not stopping short of it.

Outside of something in that shape, standard 3.8 Flash is very likely the model that already covers what you need, including the coding gains that came out of the same underlying cybersecurity work.

Sources