Securing codebases requires Fairwind approval first

The shortest route begins with an application to the Fairwind Program and proceeds through the CodeMender harness inside a Google Cloud environment.

Confirm eligibility against the three groups named in the September 2 announcement: national cyber authorities, operators of healthcare or energy networks, and maintainers of widely used software platforms. Organizations outside these categories receive no access route at present. Submit the application form linked from the announcement page and supply details on internal cybersecurity teams plus multi-factor authentication controls already in place. Approval grants entry to Gemini 3.8 Flash Cyber paired with the CodeMender harness.

Once inside the harness, point the model at target repositories. The model accepts codebases written in any of the twenty supported languages and generates validated, high-quality code fixes automatically after discovering vulnerabilities. On complex tasks the model exhibits greater diligence by executing extra reasoning steps and calling tools iteratively. At times the model uses more tokens to maximize performance, especially at higher effort levels. Developers who need lower token counts can select reduced effort settings or fall back to the unrestricted Gemini 3.8 Flash variant that remains fully supported.

Google states that the model reaches a success rate exceeding 70 percent on an internal benchmark spanning those twenty languages. The same announcement records a pass@1 of 47.2 percent on CWE-Bench run by Collinear, placing the model on the Pareto frontier against a leading frontier model at 47.8 percent yet at significantly lower cost. Real-world runs on internal benchmarks show success rates above seventy percent for vulnerability discovery. The Chrome Security team found that the model produced 2.6 times more correct patches to vulnerabilities in Chrome than the best commercial models that are much larger. Wiz reported +7.5-9.7 percent higher recall on its internal penetration testing benchmark at 2.3-5.2 times lower cost. Google’s Cloud Vulnerability Research team located a critical foundational vulnerability in less than 2 hours.

Access remains closed until an organization meets the strict operational standards listed in the program description.

The Fairwind Program requires participating organizations to limit access to employees within internal cybersecurity, incident response, or penetration testing teams and to deploy protections such as multi-factor authentication. Prompt injection robustness improved according to Gray Swan measurements. The Frontier Safety Framework keeps CBRN and offensive cyber safeguards active on the base model while relaxing certain restrictions for approved defenders. No public implementation details exist yet for real-time camera streams or live network feeds inside the cyber workflow.

The September 2 blog post notes that the model ships with safeguards against misuse in the domains of Chemical, Biological, Radiological, and Nuclear and cyber offense while enabling beneficial use cases. The cyber variant carries a more permissive set of mitigations and therefore stays restricted to trusted defenders. The pricing page lists no figure for the enterprise tier of the cyber model. The September 2 announcement states that both variants are powered by the same foundational intelligence and further accelerated by long-running agentic loops designed to recursively evaluate and refine the underlying models.

Teams that already hold Google Cloud contracts can combine CodeMender with publicly available models hosted on the Gemini Enterprise Agent Platform instead of waiting for Fairwind approval. Any Google Cloud customer can therefore begin proactive scans immediately through that route while the limited-access program processes applications.

Teams outside government or critical infrastructure roles should continue with publicly available models instead.

The standard Gemini 3.8 Flash variant carries an introductory rate of 0.75 dollars per million input tokens and 3.75 dollars per million output tokens through the end of the year, after which list pricing rises to 1.50 and 7.50. Build with 3.8 Flash and explore agent-first workflows in Google Antigravity or start building today in the Gemini API via Google AI Studio and Android Studio. Organizations that only need general coding or reasoning gains lose nothing by staying on the unrestricted tier.

Developers already subscribed to Google AI Pro or Ultra can use the standard model inside the Gemini app today. Enterprises reach it through Gemini Enterprise. The cyber variant carries no public pricing.

The September 2 announcement states that both variants are powered by the same foundational intelligence and further accelerated by long-running agentic loops. Skip the Fairwind route entirely when the workload stays within general coding or agentic tasks already covered by the unrestricted Flash tier.