On September 2, Google launched the Fairwind Program, which provides its newest cybersecurity-focused model, Gemini 3.8 Flash Cyber, exclusively to trusted defenders such as government agencies and critical infrastructure operators[1]. Combined with CodeMender, an agent that finds and fixes vulnerabilities, Google says patches that used to take weeks can now be produced in minutes. More than 650 organizations worldwide are already participating, and Google.org's cumulative cybersecurity funding has passed 100 million USD (about 16 billion yen)[1].
※1 USD = 160 JPY (as of September 2, 2026)
The defender's dilemma: too big or too weak
Google frames the program around a choice defenders face when they try to adopt advanced AI. Top-tier frontier models are capable but expensive to run and hard to keep under control across an enterprise codebase. Smaller open-weight models, on the other hand, tend to fall short on complex vulnerability remediation and force teams to build their own tooling and infrastructure from scratch[1].
The Fairwind Program aims at the middle ground. Gemini 3.8 Flash Cyber is Google's most capable cyber model, yet it retains the speed and low cost of the Flash line[2]. Participants can pair it with the CodeMender harness, which means they can discover, verify, and fix vulnerabilities inside their own cloud environment without building a validation pipeline themselves[1].
Google puts it this way: spotting weaknesses only creates awareness and fear, while autonomously finding and fixing them delivers security. The emphasis is clearly on remediation rather than discovery alone[1].
What Gemini 3.8 Flash Cyber can do
Gemini 3.8 Flash and Gemini 3.8 Flash Cyber, both announced the same day, share the same underlying intelligence. According to Google, this is the third Flash release in six weeks, following 3.7 Flash three weeks earlier, and rigorous training in the demanding domain of cybersecurity contributed to the gains in coding and reasoning[2].
On the Cyber variant, Google says it delivers frontier-level performance on CyberGym, the standard benchmark for vulnerability discovery, surpassing both the previous 3.5 Flash Cyber and significantly larger frontier models[2]. A chart on the DeepMind program page lists a CyberGym Pass@1 of 86.2 percent for Gemini 3.8 Flash Cyber versus 77.5 percent for 3.5 Flash Cyber[3]. On an internal benchmark spanning 20 programming languages beyond C/C++, the model's success rate exceeded 70 percent[2].
On CWE-Bench, an external benchmark for patching, the model scored a Pass@1 of 47.2 percent, nearly matching a leading frontier model at 47.8 percent while costing significantly less[2]. Google says it invested in vulnerability fixing from the start and prioritized it over offensive capabilities[2].
Internal results are also cited. The Chrome Security team found that 3.8 Flash Cyber produced 2.6 times more correct patches for Chrome vulnerabilities than the best, much larger commercial models. Google's Cloud Vulnerability Research team used it to find a critical foundational vulnerability in under 2 hours, a task that typically takes months of research[2].
Who gets access, and what is allowed
The Fairwind Program is not open to anyone who applies. Google is staging access in order of importance to societal resilience, prioritizing 3 kinds of organizations[1].
First are governments and national cyber authorities, defending public-sector networks and citizen services against targeted intrusions. Second are critical infrastructure operators in healthcare, telecommunications, energy, and finance. Third are core technology platforms that underpin widely used software, where hardening one layer can lift security for millions of downstream users at once[1].
Usage conditions are spelled out in detail. Access to the model must be limited to internal cybersecurity, incident response, or penetration testing teams, and protections such as multi-factor authentication are required[1]. According to the DeepMind page, permitted work is limited to dual-use tasks such as authorized threat simulation, reverse engineering, and malware analysis for defensive or academic research purposes; malicious uses such as creating malware are not allowed. Sharing, redistributing, or selling access is prohibited, and applicants undergo background checks on their security history and record of ethical operations[3].
Because 3.8 Flash Cyber ships with a more permissive set of cyber mitigations than the general 3.8 Flash, Google says it is available only to trusted defenders who require that broader capability[2].
CodeMender for everyone else
Organizations that do not qualify still have a path. Any Google Cloud customer can run CodeMender with publicly available models hosted on the Gemini Enterprise Agent Platform, combined with Google's AI Threat Defense products, to secure their code[1]. For academia, Google welcomes applications from labs focused on defensive benchmarking, while recommending CodeMender on Google Cloud for student use[3].
Partner comments have also been published. Palo Alto Networks said early testing showed the model to be exceptionally fast and performing above its model class across several cybersecurity tasks, including vulnerability hunting. Snowflake said that in a two-day trial on its public repositories, the model held its own against much larger engines on critical and high-severity findings, cut triage noise, and was cheap enough to run continuously[3].
Summary
The Fairwind Program gives defenders such as governments, critical infrastructure operators, and core platforms early access to Gemini 3.8 Flash Cyber and CodeMender, buying them time to harden systems before attackers catch up. Its distinguishing feature is delivering 86.2 percent on CyberGym and 47.2 percent on CWE-Bench at Flash-level speed and cost, and participation already exceeds 650 organizations. Use is limited to vetted organizations for defensive purposes, while everyone else can combine CodeMender with publicly available models.
出典:https://blog.google/innovation-and-ai/technology/safety-security/fairwind-program/
