Gemini 3.8 Flash keeps the price per token and raises the tokens per task

Google released Gemini 3.8 Flash on 2 September, three weeks after 3.7 Flash and — by Google's own count — its third Flash model in six weeks. The headline number is that nothing changed: $0.75 per million input tokens and $3.75 per million output tokens, the same introductory rate 3.7 Flash carries. The model ID is `gemini-3.8-flash` and it is generally available today in the Gemini API, AI Studio, Antigravity, Android Studio, Stitch and Gemini Enterprise, plus the Gemini app, AI Mode in Search and Gemini in Sheets for AI Pro and Ultra subscribers.

Alongside it Google shipped Gemini 3.8 Flash Cyber, a variant of the same base model tuned for finding and patching vulnerabilities, which you cannot buy — it is available only through a new gated program. For anyone budgeting or switching models, the useful details are in the pricing page and the model card rather than the announcement.

The rate is flat. The bill probably isn't.

Google is unusually direct about this. The announcement says the gains "stem from a core design choice: 3.8 Flash works harder" — extra reasoning steps, iterative tool calls, and "at times, the model might use more tokens to maximize performance, especially at higher effort levels." That last sentence also appears in the model card's Known Limitations section, which is the more telling placement.

Output tokens on the Gemini API are billed inclusive of thinking tokens. So a flat per-token rate plus a model deliberately built to emit more tokens per task does not add up to a flat cost per task. Google's own recommendation is to drop to lower effort levels, or to stay on 3.7 Flash for efficiency-first workloads — which, it notes, "remains fully supported." A vendor telling you its previous model may be the better buy is worth taking at face value.

One concrete break for existing code: 3.8 Flash documents three thinking levels — low, medium and high. `minimal` is not supported and returns an error rather than degrading.

The introductory price has an expiry date

The word "introductory" is doing real work. Google's pricing page states the rates plainly:

• Input: $0.75 per million tokens through 31 December 2026, then $1.50 from 1 January 2027
• Output (including thinking tokens): $3.75 through 31 December 2026, then $7.50
• Batch: $0.375 / $1.875, rising to $0.75 / $3.75
• Cached input: $0.075, rising to $0.15
• Cache storage: $0.50 per million tokens per hour, rising to $1.00

Everything doubles on the same date, and the same schedule applies to 3.7 Flash. Four months of runway is enough to plan around and short enough to forget.

What actually changed

Less than the version bump implies. The model card states that Gemini 3.8 Flash "is based on Gemini 3.7 Flash," and its sections for architecture, training dataset, data processing, hardware and software all defer to the 3.7 Flash card rather than describing anything new. This is an iteration on an existing post-trained model, not a new base. Context limits are unchanged at 1,048,576 input tokens and 65,536 output.

The knowledge cutoff is listed as March 2026, with a caveat worth reading: users "can expect updated information for some domains while in others they may experience the model's knowledge is limited to January 2025." A cutoff that varies by fourteen months by domain is not really a single cutoff, and it tends to surface as confident staleness rather than a refusal.

On capability, Google reports 54.9% on HLE-Verified and says 3.8 Flash outperforms most larger frontier models on DeepSWE v1.1 for long-horizon software engineering, and beats 3.7 Flash and other frontier models on Vals Finance Agent V2 and Harvey's Legal Agent Benchmark. Every one of those numbers comes from Google running the evaluations. No independent evaluation has been published.

The Cyber variant, and why you can't have it

Gemini 3.8 Flash Cyber shares the same foundational intelligence and is tuned for autonomous vulnerability discovery and automated patching. It ships with what Google calls "a more permissive set of mitigations for cybersecurity" and is therefore restricted to the new Fairwind Program: governments and national cyber authorities, critical infrastructure operators across healthcare, telecommunications, energy and finance, and core technology platforms. Google says it has more than 650 participating partners globally. Participants agree to limit access to staff on internal cybersecurity, incident response or penetration testing teams and to deploy protections including multi-factor authentication.

In the program the model runs inside the CodeMender harness, in the organisation's own cloud environment, producing patches as standard code diffs validated by an LLM-as-a-judge step. Google frames the staging as deliberate asymmetry — early access gives defenders "a vital adaptation window to harden their systems before bad actors have a chance to exploit new capabilities" — and says it prioritised fixing over offensive capabilities like exploitation from the start.

Whether such a gate holds is an open question, given that the general 3.8 Flash is public and shares the same base. But the shape of the decision is clear: Google built its most capable security model, decided general availability was the wrong default, and wrote an access-control regime around it instead. That is a more interesting precedent than the benchmark table.

The one external benchmark tells a quieter story

CWE-Bench, run by Collinear, is the only third-party benchmark in the launch materials, and it is the one where Google does not claim to win. Gemini 3.8 Flash Cyber scores 47.2% pass@1. Anthropic's Fable 5 scores 47.8%. Google's claim is not that the model is better at patching; it is that it sits on the Pareto frontier — near-equivalent quality at significantly lower cost. That is a real and useful claim, and it is a different claim from "frontier-level performance," which is how the announcement leads.

The rest of the evidence is Google's. On CyberGym it says the model surpasses 3.5 Flash Cyber and significantly larger frontier models, but publishes no figure. The success rate "exceeding 70%" across codebases in 20 programming languages sits on an internal benchmark Google has not released, so it cannot be reproduced. Chrome Security's finding of 2.6x more correct patches than the best commercial models comes from Google's own team, and Wiz's report of 7.5–9.7% higher recall at 2.3–5.2x lower cost is a partner citing its own unpublished penetration-testing benchmark. None of this is unusual for a launch, and none of it is independent.

Two lines in the safety section

First, Gemini 3.8 Flash was not itself assessed against Google's Frontier Safety Framework. The model card says Google evaluated 3.7 Flash, found it reached no Tracked or Critical Capability Levels, determined that 3.8 Flash has no meaningful new capabilities in the framework's domains, and is therefore "confident that Gemini 3.8 Flash is also unlikely to reach any T/CCLs." Given a shared base, that is a defensible shortcut — but it is an inference rather than a measurement, and a model marketed on substantially better coding and cyber reasoning is inheriting its frontier-risk sign-off from its predecessor.

Second, Google's own automated safety evaluations are not uniformly better. Text-to-text safety improved by 0.4pp and image-to-text was flat, but multilingual safety moved 5.4pp in the wrong direction on a metric where lower is better, and unjustified refusals rose 1.1pp. Google calls the non-English result a slight regression and says manual review found the losses were mostly false positives or non-egregious. If you serve non-English users, that is the number to watch. Google also claims a "significant leap" in prompt-injection robustness measured by Gray Swan, and publishes no figure for it.

What to actually do

1. If you run agents on Flash and cost matters, benchmark 3.8 at low effort against 3.7 on your own workload before switching. The rate is identical, so the only variable that moves your bill is tokens per task — and Google says that number goes up.
2. If your code sets a `minimal` thinking level, it will error on 3.8 Flash. Fix that before you route traffic.
3. If a 2027 forecast assumes $0.75 / $3.75, double it. The increase is documented, not speculative.
4. If you serve non-English users, run your own safety and refusal checks rather than trusting the version bump.
5. If you operate critical infrastructure or maintain widely used software, Fairwind is the only route to the Cyber model.

The honest summary: a competent incremental release with a well-documented cost footgun and one genuinely notable governance decision attached. Google's documentation is more informative than its announcement, which is a compliment to the documentation.