TL;DR
OpenAI published an open letter on 27 August, signed by 156 companies as of 3 September, forecasting that AI-enabled cyber attacks will become far more widespread “in the coming months” and calling on signatories to empower more defenders with cyber-capable AI and make it accessible to critical-infrastructure organisations with limited budgets. Six days later Google, a signatory, released Gemini 3.8 Flash Cyber to a selected set of trusted defenders through its Fairwind program. The consequence for a security lead without that access: the general Gemini 3.8 Flash at $0.75 per million input tokens shares the same core and is the part of this release you can use today. The uncertainty: Google’s Chrome, Wiz and Cloud Vulnerability Research figures are self-reported with no inspectable methodology, and on the externally run patching benchmark Flash Cyber scores 47.2% against a rival’s 47.8%, leading on cost rather than capability.
In plain English
Cyber-capable AI — a model good enough at reading code to find security flaws in it, and in some cases write the fix.
Vulnerability discovery and patching — finding the hole, then closing it. They are different skills, and a model can be far better at one than the other.
CyberGym — an external benchmark that tests whether a model can find real vulnerabilities on its own, rather than answering questions about security.
pass@1 — the share of problems a model solves on its first attempt, with no retries. A stricter measure than letting it try repeatedly.
Pareto frontier — the set of options where nothing beats you on every dimension at once. Being on it can mean you lead, or that you cost less for a slightly worse result.
Least privilege — giving an account, person or agent only the access it needs for the task, so a compromise reaches less.
Dual-use — a capability that helps defenders and attackers about equally, which is why releasing it widely is a genuine decision rather than an obvious one.
On 27 August, OpenAI published an open letter calling for “a global surge in cyber defense.” Google signed it. On 2 September, Google released Gemini 3.8 Flash Cyber, which it describes as its most capable cybersecurity model, available “to a set of trusted defenders.” Six days passed between Google signing the letter and Google restricting the model.
There are 156 signatories on the page as of this writing, including Anthropic, AWS, Cisco, Cloudflare, CrowdStrike, Google, Hugging Face, IBM, Microsoft, Oracle, Palo Alto Networks, Perplexity, Tailscale and Visa.
“In the coming months, AI-enabled cyber attacks will become far more widespread and sophisticated as models around the world become increasingly capable.” Hospitals, water treatment plants and internet infrastructure are named as what is at risk. Three principles follow — that status quo security will not be enough, that we should “empower more defenders with cyber-capable AI,” and that the response must be collective.
Furthermore: “AI brings specialist skills to more defenders and makes core security tasks faster, cheaper and better.” Then, in the section addressed to cybersecurity companies and technology partners, it asks them to “make AI-powered defense accessible and deployable for critical-infrastructure organizations with limited budgets.”
Google’s release came six days later with Gemini 3.8 Flash as the general model (“our third Flash release in only six weeks.”), priced at $0.75 per million input tokens and $3.75 per million output tokens, which Google notes is the same introductory price as 3.7 Flash. Gemini 3.8 Flash Cyber is the security variant, and Google is clear that both share the same foundational intelligence, with the gains on that shared core “driven by a number of innovations, including rigorous training in the highly demanding domain of cybersecurity.”
On the benchmarks, Google separates the independent results from its own. CyberGym, an external benchmark for autonomous vulnerability discovery, puts Flash Cyber at what Google calls frontier-level performance, surpassing both its own 3.5 Flash Cyber and significantly larger frontier models. An internal benchmark spanning 20 programming languages puts it above a 70% success rate. On a patching benchmark run externally by Collinear, it scores a pass@1 of 47.2%.
The Chrome Security team found Flash Cyber produced 2.6 times more correct patches to Chrome vulnerabilities than the best commercial models, which are much larger. Wiz measured 7.5 to 9.7% higher recall on an internal penetration testing benchmark at 2.3 to 5.2 times lower cost. Google’s Cloud Vulnerability Research team used it to find a critical foundational vulnerability in under two hours, against research and discovery that Google says usually takes months.
One design choice Google states is, I think, the heading in the right direction: “we have invested in vulnerability fixing from the start, and prioritized it over offensive capabilities like exploitation.” My reading of that ordering is that a model much better at finding vulnerabilities than at fixing them is the more dangerous thing to release widely, so building the fixing side first could be considered the safer sequence. Google says it made that choice deliberately.
Flash Cyber is available through a program Google calls Fairwind, to a set of trusted defenders it selects. A model performing at frontier level in autonomous vulnerability discovery, made generally available to any paying customer, would help attackers about as much as defenders, and the letter’s own forecast is the argument for caution.
But conversely, their letter called for the empowerment of more defenders, and to make AI-powered defence accessible to critical-infrastructure organisations with limited budgets (such as water treatment plants). There is not yet evidence to suggest that those organisations are eligible for Fairwind.
It is a difficult and delicate balance: the same model that helps a defender find and fix flaws also helps an attacker find them, and no way of allocating it satisfies both the letter’s urgency and its own risk logic. What I would object to is a letter that describes an emergency and tells every organisation to act “with the urgency and coordination of an incident,” while committing its signatories to nothing with a date, a figure or an access guarantee attached.