Google gives Gemini 3.8 Flash a choice: answer fast or keep working

The price stays. The amount of work can change

Google's latest Flash release is not just another scorecard. The company says Gemini 3.8 Flash can decide to spend more time on difficult work: taking extra reasoning steps and calling tools repeatedly before it settles on an answer. For easier or more cost-sensitive tasks, developers can set a lower effort level or keep using Gemini 3.7 Flash.

That sounds like a small control. It is actually a useful description of where the market is moving. A model is no longer only a fixed answer engine measured by speed and price. It is becoming a worker that can be allowed to take a short route or a longer one, depending on the task and the limits a developer sets.

Google says the introductory price for the general model remains $0.75 per million input tokens and $3.75 per million output tokens, the same as Gemini 3.7 Flash. It also warns that higher effort can use more tokens. The price per token may stay still while the bill for a difficult task rises. Those are different things.

A general workhorse, plus a more restricted cyber model

The release has two variants. Gemini 3.8 Flash is the general model, which Google positions for software engineering, agentic tasks and multi-step reasoning. Gemini 3.8 Flash Cyber is specialised for vulnerability discovery and patching.

The Cyber model is not being offered as a normal open developer choice. Google says it is available to trusted defenders through its Fairwind Program and ships with a more permissive set of cybersecurity mitigations than the general Flash model. That restriction matters more than a headline benchmark comparison. A model that can assist with more comprehensive cyber work needs a narrower access path and a clear account of who is operating it.

Google says both variants draw on the same underlying intelligence, while the cyber work helped improve coding and reasoning in the shared core. That is Google's explanation for the link between security training and the general model's gains. The company has not made an independent causal evaluation of that claim available in the announcement.

The scores are useful, but they are not the product

Google reports that 3.8 Flash outperforms many larger models on long-horizon software tasks and scores 54.9% on HLE-Verified. For 3.8 Flash Cyber, it reports more than 70% success on an internal vulnerability-discovery benchmark spanning 20 programming languages, and cites results from Chrome and partner Wiz.

These figures may help developers form a hypothesis about where to test the models. They do not settle the question. A benchmark has a task definition, a scoring method and a cost model. An internal benchmark also has a relationship to the company reporting it. The most useful next step for a team is still a small evaluation on its own codebase, its own tool permissions and its own budget.

Google's announcement deserves credit for saying that higher effort can add token overhead. Too many model comparisons talk as if performance and cost arrive separately. They do not. An agent that takes more steps may solve a harder problem, but it may also spend more time, tokens and tool calls getting there.

What a developer can do with this information

For routine tasks, a cheaper, quicker setting may be the better engineering choice. A code review comment, a small transformation or a constrained lookup does not always need an agent to keep trying. For a long debugging task or a change that spans several systems, it can make sense to let a model use more effort, provided there is a budget ceiling, an audit trail and a human review point before a consequential action.

The release also makes a useful separation between capability and access. The cyber variant may be relevant to security teams, but it should not quietly become a default tool for every software workflow. Trust-based access, narrow scopes and validated defensive use are not an inconvenience around the product. They are part of the product.

What is confirmed, what Google says, and what is open

Confirmed: Google published the Gemini 3.8 Flash and 3.8 Flash Cyber announcement on 2 September 2026. It lists two variants, the general model's introductory price, effort-level controls and trusted-defender access for the Cyber model.

Google's claims: 3.8 Flash is its best reasoning and coding Flash model, its extra work improves hard-task performance, and its Cyber model shows frontier-level vulnerability discovery and patching results. Partner findings quoted in the post remain their own reported results.

Open questions: the real-world token and tool-use cost at each effort level; the model's reliability on unfamiliar codebases; the independent reproducibility of the reported results; how Fairwind eligibility and oversight work in practice; and whether access restrictions will remain proportionate as the capability changes.