A New Open-Weight Model Finds Security Bugs for $2.38 a Run, and It's Not More Accurate Than Claude

Cantina Security released apex-flash-1 on 2 October: an open-weight, MIT-licensed model built to read code, use tools, pursue an exploit, and verify that it worked against a live target. Most coverage led with the cost figure, $2.38 to run a 60-task benchmark against $74.68 for Claude Opus 5 High.

That figure is not a capability claim. Opus solved more tasks. apex-flash-1 solved fewer for a fraction of the money, which is a useful trade and not a win on accuracy.

What the model is

Cantina built it with Yeta Labs as a reinforcement-learning (GRPO) post-train of Z.ai's GLM-5.3-Flash, at 321.3 billion total parameters. Cantina describes it as a worker model: something a larger orchestrating agent directs at a focused investigation, rather than an agent you point at a codebase and leave.

Training data came from Cantina's own security work. Fifty real vulnerability cases, each expanded into three versions with different access and direction, produced 150 training tasks.

The benchmark

Cantina tested three models on 60 held-out tasks drawn from 20 vulnerability cases outside the training set. Each task ran in an isolated environment, and a verifier checked the target's end state instead of trusting the model's report:

Opus remains the most accurate of the three. apex-flash-1 closes most of the gap to Opus over the untuned base model, at roughly 31 times lower cost than Opus and about half the cost of its own base model.

Missing three or four more tasks out of 60 in exchange for that bill is a legitimate trade. Needing the last few points of accuracy regardless of cost is also legitimate, and this result does not change which model wins there.

Hardware the name hides

apex-flash-1 needs roughly 640GB of GPU memory for BF16 inference. "Flash" describes the base model lineage, not the machine you run it on. It deploys through vLLM, SGLang, Transformers, or Docker Model Runner, and it is not a workstation experiment.

The second checkpoint

Cantina shipped apex-flash-1-abliterated alongside it, an experimental derivative with modified refusal behavior. None of the published numbers describe that variant, and it has no evaluation at all.

Standardizing on this model family means pinning the exact weights you deploy. A checkpoint with modified safeguards does not inherit the tested behavior of the one with the benchmark attached.

The wider field

Aikido Security's Altar-1 (expert pruning and quantization, reporting 60.4% recall on a 32-CVE internal set) and Cisco's Foundation-Sec-8B-Reasoning (instruction-tuned and RLHF'd on security data) both test the same bet: a model tuned for security work can approach frontier accuracy on narrow tasks for far less money.

The caveat that matters

Every number above comes from Cantina, on Cantina's 60-task internal benchmark, with no independent replication. That does not make the result wrong. It makes 66.7% a vendor figure until somebody else runs it.

If this model matters to your work, run it against your own vulnerability cases before treating the published table as generalizable.

Authorized use

A model trained to pursue an exploit and verify its effect on a running target is dual-use by design. The same capability makes defensive verification work. Cantina frames the release around authorized security research, and the MIT license plus published benchmark show a company being explicit about what it built.

Deploy it in controlled, scoped, authorized environments. Not against systems you do not own.

Before you evaluate it

• Test your own cases before trusting 66.7% on your codebase.
• Budget for 640GB of GPU memory before planning anything.
• Confirm the standard checkpoint, not the abliterated variant, if you need the behavior the benchmark describes.
• Treat it as a cost tool for narrow, authorized work, not a replacement for a frontier model where accuracy outweighs cost per task.

The full analysis, with methodology and sources: https://www.hamvero.space/blog/cantina-apex-flash-1-security-model/