Gemini 3.8 Flash captures your evaluation inputs

A model evaluation is a data transfer. The moment you paste a real document into Gemini 3.8 Flash or 3.8 Flash Cyber to measure output quality, that content has left your control boundary and entered infrastructure you do not own, cannot inspect, and have not validated. The test is not the risk. The input is the risk. Whatever you feed the model to evaluate it is now subject to whatever handling that endpoint applies, and at the point of evaluation, that handling is not confirmed.

Both models are new. New means unevaluated by you. Retention, logging, human review, sub-processor access, and training use for these two endpoints are not confirmed at the moment a tester decides to run a prompt. That absence is not a neutral gap. It is an operating condition. You are making a data-handling decision with no confirmed answer to the one question that determines exposure: what happens to the input after it is received.

Accountability does not move with the data. The vendor operates the model. You own the record. If a customer identifier, a source file, or a credential embedded in a config sample leaves your environment during a test, the exposure is yours regardless of what the vendor terms claim. The only control that determines the outcome is the one enforced before the request leaves your network. Everything after that point is trust you have already extended.

The failure begins with a classification error. Teams treat evaluation as an internal activity separate from production data handling. It is not separate. A test run with synthetic data is an internal activity. A test run with real customer records, live internal code, or a log file pulled from a production system is a production data exposure wearing the label test. The label changes nothing about where the data goes.

The observable behavior reinforces the error. A tester sends the prompt, the endpoint returns a response, and nothing breaks. There is no error, no block, no warning, no friction. The request succeeds cleanly. That clean success is read as safety. It is not evidence of safety. It is evidence only that the system permitted the transfer. A system that allows sensitive data to leave will see sensitive data leave, repeatedly, because the path is open and the outcome looks identical to a safe one.

What you cannot observe is the part that matters. From the client side you see the request and the response. You do not see retention, secondary use, indexing, human review, or which sub-processors touch the payload. For Gemini 3.8 Flash and 3.8 Flash Cyber, none of that downstream handling is confirmed. Not confirmed is not a synonym for safe. It is the reason the evaluation should have been contained before it ran, not audited after.

The boundary that broke is the data control boundary, and it broke at identity. Reaching a new model endpoint requires one thing: a person who holds permission to read the sensitive data and permission to reach the external endpoint, exercising both in a single action. No boundary separated data this user may read from data this user may transmit to an unvalidated external system. When those two permissions collapse into one action with nothing enforced between them, the sensitive data moves.

No control stopped the behavior because control presence is not confirmed. Egress filtering, an approved-endpoint allow-list, DLP inspection on outbound prompts. If any of these were enforced on the path to the model, that is not stated. A control that is not enforced is not a control. If a control was present and the data still left, the control is ineffective, and that must be named rather than softened. The default path from a workstation to a newly published model endpoint is open unless something explicitly closes it.

The Cyber designation raises the probability of the worst input. A model presented for security work invites security data: log excerpts, network diagrams, configuration files, vulnerability findings, internal architecture notes. That is the most sensitive category an operator handles, and the product framing pulls it toward the prompt box during evaluation. Trust in that endpoint has to be validated on its own terms. A capability label is a marketing claim, not a control, and it does not tell you what happens to the data after you submit it.

A model evaluation is not one transfer. It is a loop. Send input, read output, adjust, send again. Each pass is another transfer across the same open path, and the condition that permitted the first pass, a single identity holding read access to the sensitive data and reach to the external endpoint, holds identically on every pass after it. Nothing in the loop degrades. The path does not narrow with use. The volume of exposed data grows in direct proportion to the rigor of the test. A thorough evaluation transfers more sensitive input than a careless one, because thorough means more prompts, more variations, more real records fed to the endpoint to measure how it responds.

The mechanism scales the moment the test stops being manual. Scoring a model for output quality at any serious volume becomes a script, and a script that iterates over a dataset to grade responses transfers the dataset. If that dataset holds real customer records, production logs, or source files, the mechanism moves all of it, at machine speed, with no operator reading each payload before it leaves the network. Automation scales both control and failure. On this path no control is confirmed, so automation scales failure alone. The property that makes the evaluation efficient is the same property that makes the exposure complete.

The signal the operator receives makes this worse with every pass. Each transfer returns a normal response, no block, no warning, no delay. The tester reads accumulating clean responses as accumulating evidence of safety, when the only fact each response confirms is that the transfer was permitted. Retention, logging, human review, and sub-processor access never appear in the return payload, so the operator builds a model of the endpoint entirely from the one signal the endpoint chooses to send back. The confidence to send the next real record is manufactured by the endpoint from the least informative data it could return.

The pattern derived from that mechanism is direct. An evaluation of an unvalidated endpoint using real data is an egress channel that presents as a productivity task. At the network boundary, exfiltration and legitimate testing are the same event: same identity, same destination, same clean response. The only variable that separates a safe transfer from a damaging one is the classification of the input, and input classification is exactly the decision no enforced control is making on this path. When the distinction between leak and work lives only in the tester’s head, the boundary is not enforcing anything.

The pattern does not depend on Gemini. It depends on two conditions: a new endpoint whose data handling is not confirmed, and an identity that can both read sensitive data and reach that endpoint. Any tool that meets those two conditions reproduces the same failure through the same mechanism. A browser extension granted access to page content and a network destination. A code assistant with repository read access and an outbound connection. A new model marketed to security teams. The endpoint changes. The collapse of read permission and transmit permission into one unguarded action does not.

The pattern also fixes the default. The path from a workstation to a newly published endpoint is reachable unless a control closes it. Controls close paths. Their absence leaves paths open. Every new endpoint is an approved destination by default until something explicitly removes it, and the newest endpoints are the least likely to have been evaluated before an operator reaches them. The Cyber designation drives the pattern harder by steering the most sensitive inputs, log excerpts, network diagrams, configuration files, vulnerability findings, toward the destination least validated to receive them. Product framing sets the sensitivity of the input. The vendor controls the framing. You do not.

The evaluation is not the exposure. The unvalidated transfer is. A model can be tested without a single real record crossing the boundary, so the condition that must now be true is a separation between what gets evaluated and what gets transmitted, enforced before the request leaves the network rather than decided by the tester at the prompt box. If that separation depends on a person choosing to paste synthetic data, it is not a control. It is a preference, and preferences are not enforced.

Not confirmed is the operating state, and it governs the decision rather than deferring it. For Gemini 3.8 Flash and 3.8 Flash Cyber, retention, logging, human review, sub-processor access, and training use are not confirmed. Until they are confirmed in writing and validated against that writing, the only input permitted across the boundary is input whose full exposure has already been accepted: synthetic, sanitized, non-attributable. Real customer data, production logs, internal code, and security artifacts do not meet that bar. The Cyber label does not lower the bar. Given the inputs it attracts, it raises it.

Identity is the boundary, and on this path the boundary is currently one person’s discretion. That is not a boundary. It must become an enforced separation in which the permission to read sensitive data and the permission to transmit to an unvalidated external endpoint do not resolve in a single action with nothing between them. Egress control, an approved-endpoint allow-list, and outbound inspection are either enforced on that path or they are not. If they are not, the endpoint is already reachable and the data leaves on the next test. If a system allows it, it will happen. The evaluation of a new model begins before the first prompt. It begins with whether the path was ever closed.