Google Built a Vulnerability Hunter and Locked It Behind Fairwind

Google shipped two models on September 2. One of them you can use this afternoon. The other one you have to apply for.

Gemini 3.8 Flash is the general release — coding, reasoning, agentic work, available through AI Studio, the Gemini API, Android Studio, Antigravity, Gemini Enterprise, and the consumer AI Pro/Ultra tiers. Introductory pricing is $0.75 per million input tokens and $3.75 per million output, with rates rising January 1, 2027.

Gemini 3.8 Flash Cyber is the other one. Same base, different post-training, and a distribution model that has almost no precedent at a major lab: access runs through a new Fairwind Program, and Fairwind admits government authorities, critical infrastructure operators, and software maintainers. Not developers. Not enterprises. Not researchers who ask nicely.

The numbers are the reason for the gate

Google's claims for the Cyber variant are unusually concrete for a model announcement, which is what makes the access decision legible.

On real-world vulnerability discovery, the model exceeds a 70% success rate across 20 programming languages. On CWE-Bench patching it posts 47.2% pass@1. On CyberGym Google puts it at frontier-level detection. The two operational data points are the ones that actually land: the Chrome Security team reports 3.8 Flash Cyber produced 2.6× more correct patches to Chrome vulnerabilities than the best commercial models — models substantially larger than it. And Google's Cloud Vulnerability Research team used it to find a critical foundational vulnerability in under two hours, against a normal discovery timeline measured in months.

Read those two together. A small, cheap, fast model just compressed a multi-month specialist workflow into an afternoon, and did it more accurately than frontier systems many times its size. That is not a benchmark result. That is a capability that changes the unit economics of finding bugs.

Which is exactly the problem, because finding bugs is symmetric.

The symmetry problem, stated plainly

There is no meaningful technical difference between a model that finds a vulnerability so it can be patched and a model that finds a vulnerability so it can be exploited. The artifact is identical. The discovery process is identical. The only thing that differs is who is holding it and what they do in the next hour.

Every other capability domain gives labs somewhere to hide. Bioweapons capability can be degraded with targeted refusals because the harmful use has a recognizable shape. Cyber capability does not work that way — the harmful use is the beneficial use, run by a different person. You cannot RLHF your way out of that. You can only decide who gets the model.

Google decided. It says 3.8 Flash Cyber ships with a more permissive set of mitigations for cybersecurity work specifically — the safety training that would normally make a model refuse to write exploit code has been relaxed, because a defender who cannot write a proof-of-concept cannot prove the bug is real. Meanwhile the CBRN safeguards stay hard, and Google cites improved prompt-injection robustness against the Gray Swan benchmark.

That is the whole design: loosen the thing the intended user needs loosened, keep everything else locked, and control the door.

Two labs, one week, opposite answers

The timing here is not subtle. Within days of Fairwind, OpenAI shipped Astra as the first model it has classified Critical for cybersecurity under its own Preparedness Framework — a model that scored 100% on ExploitBench and chained two zero-days it discovered during testing. OpenAI shipped it.

So the frontier now has two live, publicly stated answers to the same question, taken within a week of each other.

Google's answer is gate the capability. If the model is genuinely dangerous in the wrong hands, do not put it in the wrong hands. Accept that this makes you the arbiter of who counts as a defender, and accept the friction that creates for independent researchers, small maintainers, and everyone in a jurisdiction Google would rather not adjudicate.

OpenAI's answer is ship with safeguards. Defenders outnumber attackers, defense benefits more from scale than offense does, and a capability withheld from the commons still reaches the adversary — because the adversary is not filling out an access form.

Both positions have serious people behind them. Neither is obviously correct. What is new is that they are now empirical rather than theoretical, running in production, at the same time, on comparable capability.

What Fairwind actually costs

The gate is not free, and the cost falls unevenly.

"Software maintainers" is the interesting category in Google's eligibility list, because it is where most of the world's unpatched vulnerabilities live. The critical infrastructure operators have security teams. The government authorities have budgets. The maintainer of a widely-depended-on library with three contributors and no funding is the person who would benefit most from a two-hour vulnerability audit — and is also the person least equipped to navigate an enterprise access program.

If Fairwind onboards that person quickly, the gate mostly works. If Fairwind onboards Fortune 500 security teams in a month and open-source maintainers in nine, then the model has made well-resourced defenders faster while leaving the actual soft underbelly exactly where it was. Attackers, meanwhile, get to keep using whatever ungated frontier model is closest — including Astra.

What to watch

Three things settle whether this is genuine safety architecture or a liability posture with good branding.

Fairwind's throughput and composition. Google should publish how many organizations are admitted, in what categories, and how long approval takes. A program that admits critical infrastructure in weeks and independent maintainers never is a different product than the one announced.

Whether the gate holds. A model this useful is a model people will try to reconstruct. If the general 3.8 Flash gets within striking distance of Cyber's numbers via prompting or fine-tuning, Fairwind becomes a formality.

Whether OpenAI's bet or Google's bet produces the first published incident. One of these approaches is going to generate a story about a capability reaching someone it should not have. The direction that story comes from will do more to set frontier cyber policy than any framework document either lab has published.

For now, Google has built the best public evidence yet that a small model can outperform much larger ones at a hard, specific, economically valuable task — and then made sure most people cannot check.