Google says Gemini 3.8 Flash Cyber beats Anthropic and OpenAI in autonomous vulnerability discovery

Google announced Gemini 3.8 Flash Cyber on 2 September 2026, describing it as the company’s most capable cybersecurity model and saying it delivers frontier‑level autonomous vulnerability discovery that outperforms Anthropic’s Mythos 5 and OpenAI’s GPT‑5.6 Sol.

Google’s claim of superior autonomous discovery

The Hacker News reported that the new model “demonstrates frontier‑level performance in autonomous vulnerability discovery, even surpassing larger frontier models from rivals Anthropic (Mythos 5) and OpenAI (GPT‑5.6 Sol and GPT‑5.5‑Cyber).” The article frames the claim as the first publicly‑claimed AI cybersecurity model to beat its major rivals on this specific metric.

Google’s own statement, quoted in the same report, calls Gemini 3.8 Flash Cyber “its most capable cybersecurity model.” No independent benchmark results are provided in the packet; the claim rests on Google’s description.

Fairwind Program – a partner‑first rollout

Alongside the model launch, Google introduced the Fairwind Program, a channel that gives “high‑priority defenders (like governments, healthcare providers, and telecommunications services) early access to advanced models.” The program lists more than 650 trusted partners, including CrowdStrike, Datadog, Menlo Security, Palo Alto Networks and Snowflake. The partner count is given as “650” as of the announcement date.

By targeting a broad set of defenders, Google signals a shift from a pure product launch to an ecosystem‑wide deployment, aiming to give early adopters an “early advantage” against emerging threats.

Competitive landscape

Anthropic’s competing offering is identified as Mythos 5, while OpenAI’s counterpart is GPT‑5.6 Sol (with a related GPT‑5.5‑Cyber model). Both firms have announced parallel security‑focused initiatives – Anthropic’s Enterprise Frontier Safeguards (EFS) and OpenAI’s Daybreak Blue program – but the packet does not contain performance figures for those models.

Google’s claim therefore adds a new data point to the emerging market for AI‑driven cyber‑defense tools, suggesting a possible performance edge for Gemini 3.8 Flash Cyber. Whether the claim holds up in third‑party testing remains to be seen.

What changes for defenders?

• Defenders in the Fairwind Program receive early access to Gemini 3.8 Flash Cyber, potentially giving them a head start on identifying zero‑day vulnerabilities.
• The program’s partner list spans both traditional security vendors (CrowdStrike, Palo Alto Networks) and cloud‑infrastructure players (Snowflake, Datadog), indicating a cross‑industry push.
• Google’s framing suggests that the model can automate parts of the vulnerability‑discovery workflow that previously required manual code review.

What is not disclosed in the packet is the pricing model for Fairwind participants, the exact technical specifications of the model, or any quantitative benchmark scores that would allow a side‑by‑side comparison.

Open questions

The announcement does not reveal how Google measures “frontier‑level performance,” nor does it provide a timeline for broader availability beyond the initial 650 partners. Neither Anthropic nor OpenAI have commented on Google’s claim, and independent testing results have not been published.

Investors and security professionals should watch for third‑party benchmark releases and any updates to the Fairwind partner roster, which could indicate how quickly the model scales beyond the initial cohort.

Model and program overview

Google’s claim adds a new competitive dimension to the AI‑security market, but the lack of independent validation means the performance advantage remains a corporate assertion.