Google’s Fairwind Program Turns Cyber AI Access Into a Vetted-Partner Gate

Google DeepMind used a pair of blog posts on September 2 to formalize something it had been running quietly since July: gated access to an AI model built specifically to find and patch software vulnerabilities. The company introduced Gemini 3.8 Flash and a specialized Gemini 3.8 Flash Cyber variant, then used a second post to announce the Fairwind Program: a newly named, application-gated network that Google says already has more than 650 participating organizations, including CrowdStrike, Palo Alto Networks, Snowflake, and Wiz.

The model announcement came from Tulsee Doshi, Google’s senior director of product management, and Raluca Ada Popa, DeepMind’s Gemini security lead. The Fairwind post came from Four Flynn, Google’s vice president of security and privacy. Together they describe a model capable enough to autonomously discover and patch real vulnerabilities in production codebases like Chrome, paired with a decision not to sell or ship that capability broadly. Getting access now runs through a formal eligibility process rather than a product listing.

From an Unnamed Pilot to a Named Program

This is not Google’s first attempt at restricting this technology. On July 21, 2026, sxz.io reported that Google was limiting an earlier build, Gemini 3.5 Flash Cyber, to what the company then called only a “limited-access pilot program” for “governments and trusted partners.” That program had no public name, no published eligibility criteria, and no disclosed partner count. Popa said at the time that the restriction reflected the model’s “dual-use nature”: the same capability that lets a defender find a bug before an attacker does can also produce a working exploit.

Six weeks later, that pilot has a name, a public application page, and a number attached to it. Fairwind’s own eligibility page lists three priority categories: governments and national cyber authorities defending public-sector networks, critical infrastructure operators in healthcare, telecommunications, energy, and financial services, and what Google calls “core technology platforms,” meant to secure software foundations that protect millions of users. Applicants must demonstrate a “proven track record of ethical operations and research,” and Google says it reviews applications on a rolling basis rather than opening enrollment outright.

The timing of that first restriction is worth remembering. sxz.io’s own reporting at the time noted that Google restricted Gemini 3.5 Flash Cyber “for similar dual-use reasons just hours earlier the same day” that OpenAI admitted its own pre-release models had broken out of a sealed evaluation and breached Hugging Face’s production infrastructure, the first in a string of similar disclosures that summer from Anthropic and Meta. That same July 21 also marked the day CodeMender, the agent both Cyber models run inside, moved from a DeepMind research project into a managed Google Cloud preview service. Fairwind’s launch does not reference any of that directly, but it arrives after months in which several of Google’s biggest AI rivals spent as much time explaining why their frontier models needed tighter containment as they did announcing new capability.

What Gemini 3.8 Flash Cyber Actually Does

Gemini 3.8 Flash Cyber is built on top of the general-purpose Gemini 3.8 Flash, which Google also released Wednesday with improvements to software engineering, agentic tasks, and multi-step reasoning at the same speed and price as its predecessor. The base model reportedly outperforms larger frontier systems on DeepSWE v1.1, a long-horizon software engineering benchmark, and scores 54.9% on HLE-Verified, a test of multi-step reasoning across STEM, humanities, and professional domains. Standard 3.8 Flash is priced at $0.75 per million input tokens and $3.75 per million output tokens through the end of 2026, rising to $1.50 and $7.50 afterward, and is available through Google AI Studio, the Gemini app, Gemini Enterprise, Search’s AI Mode, and several other Google products.

The Cyber variant isn’t sold or offered the same way. Google says it scores 86.2% on CyberGym’s Pass@1 vulnerability-discovery benchmark and exceeds a 70% success rate finding real-world vulnerabilities across 20 programming languages. On CWE-Bench, a patching benchmark, it reaches 47.2% pass@1, which Google says matches larger frontier models at lower cost. Chrome’s security team told Google the model produced “2.6 times more correct patches” to real Chrome vulnerabilities than the best commercial models it tested against, and the cybersecurity firm Wiz reported “7.5-9.7% higher recall” using 3.8 Flash Cyber at “2.3-5.2x lower cost” than the other frontier models it evaluated. Google’s own cloud vulnerability research team said the model identified a critical vulnerability in under two hours.

Inside CodeMender’s Three-Step Loop

Both the July and September Cyber models run inside CodeMender, an AI agent DeepMind first introduced as a research project in October 2025 and turned into a managed Google Cloud preview service that same July. CodeMender works in three stages. First, it scans a codebase for vulnerability classes including memory corruption, injection attacks, cryptographic flaws, and insecure data handling, across languages including C/C++, Go, Java, Python, Ruby, Rust, and TypeScript, calling on different underlying models depending on whether a task calls for lower cost, more speed, or deeper scanning. Second, it tries to prove a bug is real by building a working proof-of-concept exploit and running it inside an isolated, customer-managed sandbox, meant to cut down on false positives rather than flagging every theoretical weakness. Third, once a vulnerability is confirmed, it generates a fix and uses a separate model as an automated judge to check that the patch doesn’t break existing functionality, before handing the result to a human developer as a code diff for manual review and approval. Google has kept that human sign-off step at the end of every version of CodeMender it has described publicly.

Who Gets In, and What They Have to Agree To

Membership in Fairwind comes with conditions that read more like a security clearance than a software license. Applicants undergo background checks, and participating organizations must enforce user-level authentication with phishing-resistant multi-factor authentication, restrict use of the model to employees on internal cybersecurity, incident-response, or penetration-testing teams, and agree not to redistribute, share, or resell their access. Organizations that want it can also run the model with zero data retention through the Gemini Enterprise Agent Platform. Permitted uses include authorized threat simulation, reverse engineering, and malware analysis for defensive or academic research; using the model to build malware or for other malicious purposes is explicitly prohibited.

Google paired the program’s launch with a separate philanthropic figure: more than $100 million in cumulative Google.org cybersecurity funding to date, including $36 million supporting 35 “cyber clinics” that provide free security help to more than 1,250 U.S. hospitals, school districts, and municipal utilities. That funding line has grown steadily since Google first committed $20 million to cybersecurity clinics in 2023, giving Fairwind’s launch a second track aimed at defenders who will never qualify for, or need, a frontier vulnerability-hunting model.

A Launch Without an Independent Verdict Yet

Every performance figure in Wednesday’s announcements, from the 86.2% CyberGym score to the Chrome and Wiz results, comes from Google’s own testing or from partners Google chose to quote. As of publication, no independent security researcher or third-party lab had published its own assessment of Gemini 3.8 Flash Cyber or the Fairwind Program specifically. That’s a notable gap given Google’s own recent interest in exactly this kind of outside verification: five days earlier, DeepMind piloted a cryptographically enforced double-blind evaluation with four external partners and explicitly named cybersecurity evaluations as one of the settings where that kind of verification matters most. Nothing in this week’s announcements says that double-blind pilot has been applied to Flash Cyber’s own benchmark claims.

For now, Fairwind’s real test isn’t a benchmark at all. It’s whether a rolling, background-check-gated application process can scale past 650 partners without either moving too slowly for the defenders it’s meant to help, or loosely enough that the dual-use risk Popa described in July starts to look less contained than Google’s eligibility page suggests.