A New Open-Weight Model Finds Security Bugs for $2.38 a Run. It's Not More Accurate Than Claude — Just Much Cheaper.

Cantina Security released apex-flash-1 on October 2 — an open-weight, MIT-licensed model built specifically to read code, use tools, pursue an exploit, and verify it actually worked against a live target. The headline most coverage led with was the cost figure: $2.38 to run a 60-task benchmark versus $74.68 for Claude Opus 5 High. Worth being precise about what that number actually means before treating it as a capability claim, because it isn’t one: Opus solved more tasks. apex-flash-1 solved fewer, for a fraction of the cost. That’s a genuinely useful trade-off, not a win on accuracy.

What apex-flash-1 actually is

Built by Cantina Security with Yeta Labs, apex-flash-1 is a reinforcement-learning (GRPO) post-train of Z.ai’s GLM-5.3-Flash, weighing in at 321.3 billion total parameters. Cantina positions it explicitly as a worker model — something a larger orchestrating agent directs toward a focused investigation, not a standalone security agent you’d point at a codebase and walk away from.

The training data comes from Cantina’s own security work: 50 real vulnerability cases, each expanded into three versions with different levels of access and direction, producing 150 training tasks total.

The benchmark numbers, precisely

Cantina evaluated three models on 60 held-out tasks drawn from 20 vulnerability cases that weren’t part of training — each task run in an isolated environment, with a verifier checking the actual end state of the target rather than trusting the model’s own report of success:

Model	Tasks solved	Pass@1	Estimated cost (60 tasks)
Claude Opus 5 High	43/60	71.7%	$74.68
apex-flash-1	40/60	66.7%	$2.38
GLM-5.3-Flash (base model)	36/60	60.0%	$4.56

Read this table the way it’s actually structured, not the way a headline compresses it: Opus remains the most accurate of the three. apex-flash-1 closes most of the gap to Opus over the untuned base model, at roughly 31 times lower cost than Opus and nearly half the cost of the base model it was fine-tuned from. If your use case tolerates missing 3-4 more tasks out of 60 in exchange for a dramatically lower bill, that’s a legitimate trade. If you need the highest accuracy available regardless of cost, this result doesn’t change that Opus is still ahead.

The hardware requirement the “Flash” name doesn’t suggest

Despite the lightweight-sounding name, apex-flash-1 needs roughly 640GB of GPU memory for BF16 inference. This is not a model you run on a single workstation — it’s deployable via vLLM, SGLang, Transformers, or Docker Model Runner, but budget for genuinely substantial infrastructure before evaluating it, not a casual local test.

The variant worth knowing about, and why it’s not part of this evaluation

Cantina separately released apex-flash-1-abliterated, described as an experimental derivative with modified refusal behavior. Cantina’s own benchmark numbers apply only to the standard checkpoint — the abliterated variant has no published evaluation at all. If you’re assessing this model family for any production or team use, that distinction matters for exactly the reasons this site has emphasized all month about agent governance: know precisely which checkpoint you’re actually running, and don’t assume a modified-safeguards variant carries the same tested behavior as the one with the benchmark numbers attached to it.

Part of a broader pattern, not an isolated release

apex-flash-1 joins a small but growing field of security-specialized open models this year: Aikido Security’s Altar-1 (built via expert pruning and quantization, reporting 60.4% recall on a 32-CVE internal set) and Cisco’s Foundation-Sec-8B-Reasoning (instruction-tuned and RLHF’d on security data) both take different technical approaches to the same underlying bet — that a model fine-tuned specifically on security tasks can match or approach general-purpose frontier models at a fraction of the cost for that narrow domain.

The epistemic caveat worth stating plainly

Every number above is Cantina’s own, on Cantina’s own 60-task internal benchmark — not an independently verified evaluation. That’s not a reason to dismiss the result, but it is a reason to treat “66.7% pass@1” as a company’s self-reported figure on its own test, the same way this site has treated every vendor-published benchmark claim this month. If this model matters to your work, the next useful step is running it against your own representative vulnerability cases, not taking the published table as a settled, generalizable score.

The dual-use point worth being direct about

A model explicitly trained to “pursue an exploit, and verify its effect in a running target” is, by its own stated design, a dual-use capability — genuinely useful for authorized security research and defensive vulnerability discovery, and structurally the same capability an attacker would want if used outside that context. Cantina’s own framing centers legitimate security research, and the MIT license plus published benchmark reflect a company trying to be transparent about what it built. That doesn’t erase the dual-use nature of the underlying capability. The same governance principle this site has applied to every agent story this month applies here too: evaluate and deploy this kind of tool inside controlled, authorized, properly-scoped environments, not as something to run against systems you don’t have explicit permission to test.

What to actually do if you’re evaluating this

• Run it against your own representative vulnerability cases before trusting the published 66.7% figure as generalizable to your actual codebase or stack.
• Budget for the real hardware requirement (640GB GPU memory for BF16) before planning a deployment — this is an infrastructure commitment, not a laptop experiment.
• Confirm you’re using the standard checkpoint, not the abliterated variant, if you need the behavior the published benchmark actually describes.
• Treat it as a cost-optimization tool for narrow, authorized security work, not a replacement for a frontier general-purpose model where maximum accuracy matters more than cost per task.

Official reference: Cantina Security’s model card for apex-flash-1 on Hugging Face, cross-checked against MarkTechPost’s and RuntimeWire’s reporting, all dated October 2-5, 2026. All benchmark figures are company-reported on an internal evaluation set — confirm current results and any updated public benchmarks directly via Cantina’s Hugging Face page before relying on specifics here.