AI Brief, 3 September 2026: Google ships a cyber model you have to apply for

Google released Gemini 3.8 Flash at 15:00 UTC on 2 September, and the interesting model is the one it did not release. Alongside the generally available Flash model, Google announced Gemini 3.8 Flash Cyber, a variant tuned to find and patch software vulnerabilities, which it says "ships with a more permissive set of mitigations for cybersecurity, and as such, is only available to trusted defenders." There is no model ID for it, no entry in the API changelog, no pricing row and no model card. There is an application form, and Google says it runs background checks on the organisations that fill it in. Yesterday's issue noted that the Wall Street Journal expected 3.8 Flash as soon as Wednesday; it arrived on Wednesday, with a sibling nobody had reported.

That completes a set. Three labs have now taken three different positions on offensive cyber capability inside five days. OpenAI designated Astra as Critical under its Preparedness Framework on 1 September and has not shipped it to anyone. Z.ai put GLM-5.3's weights on Hugging Face on 27 August under a licence gate, while writing in the same card that its cyber capability "developed faster than we expected". Google has now taken the middle path: a real model, released, but only to governments, critical-infrastructure operators and large technology platforms who apply and pass a check. Withholding, publishing and vetting are all being defended this week as the responsible option.

What Google publishes about the model is thinner than the announcement suggests. Exactly one benchmark figure for 3.8 Flash Cyber exists as text on a Google page: 47.2% pass@1 on CWE-Bench, against 47.8% for what the blog calls "a leading frontier model" and the DeepMind page names as Claude Fable 5. The CyberGym result Google leads with is prose only, "frontier-level performance", with the number living inside a chart image. That matters, because a directly comparable figure would be the most newsworthy thing in the release, and it is not available.

The day's other security story runs the other way. Six curl vulnerabilities were credited on 2 September to Aisle, a security startup, under a headline saying it found them after OpenAI and Anthropic found none. The CVEs are real and confirmed by the curl project. The headline does not survive a reading of the source it rests on.

• Gemini 3.8 Flash is GA as gemini-3.8-flash: 1,048,576-token context, 65,536 output tokens, $0.75 and $3.75 per million input and output tokens until 31 December, then double.
• 3.8 Flash Cyber is application-only through a new Fairwind Program, which Google says already has more than 650 partners.
• Artificial Analysis independently scores 3.8 Flash at 58.68 on its Intelligence Index at high reasoning effort, 2.65 points above Gemini 3.7 Flash, at $0.58 per index task.
• Meta's Muse Spark 1.3 shipped the same day and scores 62.09, third overall, but that variant is a partner-only preview and there are still no weights.
• The six curl CVEs credited to Aisle are all rated low severity, and the "OpenAI and Anthropic found zero" framing quotes a maintainer's aside with a competing vendor edited out.
• A new paper widens the FP4 scale format instead of the weights, and pretrains an 8B model without the random Hadamard transform NVIDIA's recipe relies on.

A frontier cyber model, released to a form #

The Fairwind Program, announced 40 minutes after the model post by Four Flynn, Google's VP of security and privacy, is the delivery mechanism. Eligibility runs in three tiers: governments and national cyber authorities; critical infrastructure operators in healthcare, telecom, energy and finance; and core technology platforms. Accepted organisations must use phishing-resistant multi-factor authentication, confine access to their own security and incident-response teams, accept usage tracking, and agree not to resell access. Threat simulation and malware analysis are permitted; writing malware is not.

The evidence offered for the model's capability is unusually lopsided. CWE-Bench is genuinely third-party: it is run by Collinear AI on 100 held-out private tasks across 54 weakness classes, published on 1 September, and its public board confirms Google's number. But it also shows every model running a different harness, which makes the accompanying cost figures not like-for-like: Fable 5 scores 47.8% at $10.27 per rollout under Claude Code, Gemini 3.8 Flash Cyber 47.2% at $3.64 under Antigravity, GPT-5.6 Sol 44.2%, and GLM-5.3 31.1% at $1.86 under opencode.

That GLM-5.3 row is the closest thing to a bridge between this week's two open questions, and it is worth being precise about what it does not settle. On 29 August this brief covered Z.ai claiming a state-of-the-art CyberGym score of 84.5 for GLM-5.3, and asked whether anyone would reproduce it. Google's CyberGym number is not published, so the two cannot be compared at all; CWE-Bench measures patching rather than discovery, and on that different benchmark the gap is 16 points the other way. Google itself notes that CyberGym covers only C and C++, which is why it built an internal 20-language benchmark, where it reports a success rate "exceeding 70%" with no baseline and no external check.

Everything else is a deployment anecdote from Google or a partner: Chrome's security team reporting 2.6 times more correct patches than the best commercial tools, Wiz reporting 7.5 to 9.7 percentage points more recall at 2.3 to 5.2 times lower cost. No external red team and no government body is named anywhere. The 3.8 Flash model card states that its safety results are "for automated evaluations and not human evaluation or red teaming", and records one regression worth knowing: safety performance in non-English languages moved 5.4 percentage points the wrong way against 3.7 Flash.

Two launches, and the distance between the scorecard and the measurement #

Gemini 3.8 Flash itself is a same-price capability bump. The pricing page carries identical rows for 3.8 and 3.7 Flash, and the introductory rate expires on 31 December 2026, after which input and output go to $1.50 and $7.50 per million. Reasoning depth is set per request, and the accepted values are narrower than for earlier Flash models:

interaction = client.interactions.create(
    model="gemini-3.8-flash",
    input="Refactor this module, then run the test suite and fix what breaks.",
    # low | medium | high. "minimal" is rejected here, though 3.6 Flash accepts it.
    generation_config={"thinking_level": "high"},
)

Those three settings are what the independent numbers below are measured at, and the spread between them is large. Artificial Analysis puts 3.8 Flash at 58.68 on its Intelligence Index at high effort, 56.64 at medium and 51.75 at low, against 56.03 for 3.7 Flash at high. Cost per index task runs $0.58, $0.41 and $0.24. At high effort the model emits about 48,300 output tokens per task, of which roughly 28,800 are reasoning tokens — so about 60% of what you pay for on output is the model thinking, and that share is the thing the thinking_level flag is actually buying.

Meta's Muse Spark 1.3 arrived the same day, 28 days after 1.2, and lands higher on the same index. It is also the better illustration of why provenance labels matter.

Meta's own scorecard is published as a raster image with no machine-readable values, and every column in it is Muse Spark 1.3 at maximum effort — the variant that is a limited preview for partners, not the one on the API. Read across the eleven benchmarks Meta chose itself, and Muse Spark 1.3 wins outright on five; Claude Opus 5 leads four. Meta's methodology note concedes that its runs of rival models "are best-effort" and "may not reflect their best provider-optimized performance". Where the two sets of numbers touch, they disagree: Meta reports 88.8 on Terminal-Bench 2.1 for the max variant, and Artificial Analysis measures 85.8.

One caveat on the independent numbers themselves. Neither article carries the pre-release disclosure line Artificial Analysis attached to its Fable 5.1 write-up on 1 September, yet it has benchmarked a Meta variant that is not publicly available, which implies access on some terms even with no relationship stated.

Six curl CVEs, and a headline that does not survive its source #

curl 8.22.0 shipped on 2 September with six advisories credited to Stanislav Fort of Aisle Research: two OpenSSL certificate-pinning and use-after-free issues, a connection-reuse flaw in the native CA store, two cookie-scope bypasses, and a wolfSSL CA-cache problem. Five were patched by Daniel Stenberg and one by Stefan Eissing. All six are rated low severity in curl's own table, and they were reported between 24 and 27 August. That much is solid, and it is a genuine result.

The framing is where it comes apart. Aisle's post is titled around the claim that OpenAI and Anthropic found zero, and quotes Stenberg saying "Mythos says it can't find any more" and "Codex security shows an empty list". Stenberg's original note is a parenthetical in a Mastodon post from 24 August, and the full text reads "Mythos says it can't find any more. Zeropath finds no vulnerabilities. Codex security shows an empty list." The ellipsis in Aisle's quotation removes a commercial competitor from a list of three, leaving only the two frontier labs.

Two further things follow from reading the maintainer rather than the vendor. Neither OpenAI nor Anthropic published a null result on curl at all; the zero is a maintainer's offhand observation, and Stenberg has separately written that Anthropic never actually gave him access after a contract was signed, so an unnamed third party ran that scan. And Aisle is not an outsider beating the incumbents: Stenberg's own account names AISLE first among the tools that have been used on curl over the past eight to ten months, across 200 to 300 bug fixes. The accurate version is that a scanner curl already uses found six more low-severity bugs in code it has been going over for months, which is a decent week's work and a different sentence entirely. Aisle sells the product, and the post's author is the credited reporter.

A wider exponent where nobody was looking #

arXiv:2609.02846, submitted at 17:32 UTC on 2 September by Robert Hu, Carlo Luschi and Paul Balanca, makes a narrow argument with a clean mechanism behind it. In four-bit training the weights are not the only thing quantised. Values are stored in blocks, each carrying a shared scale factor, and NVFP4 stores that scale in E4M3: one sign bit, four exponent, three mantissa. The paper's point is that a scale is a magnitude, so the sign bit is wasted, and it proposes UE5M3 instead: five exponent bits, three mantissa, no sign, bias 15. The payload stays E2M1, exactly as before.

Where the two overlap they are equally fine-grained, since both keep three mantissa bits. What changes is the window. E4M3 runs from $2^{-9}$ to 448; UE5M3 runs from $2^{-17}$ to $1.875\times 2^{15}=\mathrm{61,440}$ , so the ceiling is 137 times higher and the floor 256 times lower for the same eight bits.

That window is what buys stability. Let $g$ be the cached maximum magnitude of a tensor and $T$ the format's target constant, NVIDIA's default 448. A block whose own maximum is $a_B$ gets the scale code $u_B=a_{B}T/g$ . Take $g=100$ . Any block with $a_B$ above $448\times 100/448=100$ saturates the E4M3 scale — that is, the tensor may not grow at all before the cached maximum is refreshed. Under UE5M3 the same tensor saturates at $\mathrm{61,440}\times 100/448=\mathrm{13,714}$ . At the other end, E4M3's smallest non-zero code $2^{-9}$ means any block whose maximum falls below $4.36\times {10}^{-4}$ gets a scale that rounds to zero, flushing all sixteen of its values; UE5M3 pushes that cliff down to $1.70\times {10}^{-6}$ .

The headroom is what lets the authors hold a scale for 50 optimizer steps instead of recomputing it every step, and once you can do that, they argue, the rest of NVIDIA's recipe becomes optional: no random Hadamard transform on the gradient operands, no BF16 exemption for the final layers. Pretraining an 8B Nemotron-H on 188.7 billion tokens, they report a final training loss of 2.3090 against 2.3474 for the Transformer Engine NVFP4 baseline and 2.2651 for BF16, and after step 2,500 no loss spike above 3 and no pre-clip gradient norm above 1, where an ablation that removed the Hadamard transform from native NVFP4 logged 205 and 89.

Two hard caveats, both from the paper. Every UE5M3 run is software-emulated, because no hardware implements UE5M3 block scales, while the NVFP4 baseline runs natively, so the 21.2% throughput gain quoted in the paper belongs to an NVFP4 ablation rather than to this recipe. And these are single-seed trajectories from the authors. On 27 August this brief asked whether anyone would reproduce the claim that the standard 4-bit rotation helps one FP4 format and hurts the other. This is not that experiment: there is no MXFP4 arm at all, and the ablation dropping the Hadamard transform drops the BF16 exemption with it, so the rotation is not isolated. The code is Apache 2.0; no checkpoints ship.

Also notable #

• Microsoft released streaming ASR weights under MIT. VibeVoice-ASR-Streaming-7B and its smaller sibling uploaded at 15:49 and 15:51 UTC on 2 September, covering ten languages with speaker-attributed streaming transcription. The names understate them: the safetensors index gives 8.67 billion parameters for the "7B" and 2.81 billion for the "1.5B". No accuracy figure is quotable, because the card's entire evaluation section is a single image.
• A third of Perplexity's numeric citations do not contain the number. Haus Research put 310 questions about 210 technology companies to sonar and sonar-pro at temperature 0 and checked the cited pages: of 1,826 citations attached to a numeric claim, 34.7% failed. Dead links account for only 1.3%, so this is mostly live pages that do not say what they are cited for, and the premium model is no better (65.9% against 64.7%, overlapping intervals). The dataset is not published, so the audit is described rather than reproducible.
• Unsloth turned on multi-token prediction by default. v0.1.806-beta, published at 12:49 UTC and not flagged as a prerelease despite the tag, claims up to 2x faster Qwen3.8-Flash-Next and MTP support for GLM-5.3-Flash. Self-reported, with no benchmark table.
• Broadcom's AI segment grew 221%. Reported after the close: $16.7 billion of AI semiconductor revenue in the quarter ended 2 August, within total revenue of $29.59 billion, up 86% year over year. Q4 AI revenue is guided to $21.7 billion, which would be up 236%.
• GitHub let enterprises pick any default Copilot model. A changelog entry at 18:51 UTC removes the restricted set.

What to watch #

• Whether any CyberGym number for 3.8 Flash Cyber is published in text. It is the benchmark Google leads with, and the only one that would let the GLM-5.3 claim from 29 August be checked against anything. The value currently exists as a picture.
• Who gets into Fairwind, and who is turned down. Google says it vets applicants and names none beyond five partner testimonials. The first credible account of the criteria in practice is what turns this from a press release into a policy.
• Whether Meta ships the Muse Spark weights. Meta's post commits to "the Muse Spark open weights release" with no date, and the widely quoted "soon" traces to a Zuckerberg post rather than to Meta's page. The variant scoring 62.09 is a partner preview, so the published number and the available product are not the same thing.
• Independent numbers for Hy4 preview, GLM-5.3 and DeepSeek-V4-Flash-Vision-Exp are still missing, three issues after the first request. Artificial Analysis has added none of them, so every figure for all three remains the vendor's own.
• No motion to dismiss has been filed for Amodei and Mann. The docket in the Sony Music Publishing action carries nothing new, so the founder-liability question flagged on 30 August is still open.