Cantina Security announced Apex Flash-1 on 1 October 2026, an open-weight model for finding software vulnerabilities, released under the MIT licence. On 60 test tasks Cantina held back from training, it solved 40, three fewer than Claude Opus 5. Cantina puts the cost of that run at $2.38, against $74.68 for Claude.
The cost gap is large, the test set is small
Apex Flash-1 lands between its own base model and Anthropic’s flagship, at a small fraction of the flagship’s price.
| What is measured | Apex Flash-1 | Alternatives |
|---|---|---|
| Vulnerability tasks solved (60 held-out tasks) | 40 of 60 (66.7%) | Claude Opus 5 High: 43 (71.7%); GLM-5.3-Flash: 36 (60.0%) |
| Estimated cost for all 60 tasks | $2.38 | Claude Opus 5 High: $74.68; GLM-5.3-Flash: $4.56 |
| Size | 321 billion parameters | Base model: GLM-5.3-Flash |
| Licence | MIT, plus an abliterated variant | Claude: API access only |
Cantina built this test itself and ran it itself. It trained on 150 tasks drawn from 50 real vulnerability cases and scored on 60 tasks it kept apart. Costs are estimates based on provider prices. Cantina does not say whether Claude ran in the same agent setup, so treat the five-point gap as a rough guide.
The model is a fine-tune of Z.ai’s GLM-5.3-Flash, trained with reinforcement learning (learning by trial and reward), and built with Yeta Labs. Cantina designed it as a worker: a larger model plans the investigation and hands Apex focused jobs, such as reading code, trying an exploit and checking whether it worked.
Cantina lists no hardware needs. At 16-bit precision, 321 billion parameters take roughly 640 GB of memory, which means a multi-GPU server. Community 4-bit and FP8 versions are already on Hugging Face. Cantina also published an abliterated variant, meaning its refusal behaviour has been removed. That helps red teams and helps attackers just as much, which Cantina argues is unavoidable once capable open models exist.
For security teams that already run agents for code review or penetration testing, Apex Flash-1 is a cheap worker to put under a planner model, and it keeps your source code on your own machines. Test it on vulnerabilities your team has already fixed, so you know the right answers in advance. Teams without GPU servers should wait for a hosted version. At this size, running it yourself costs more than the roughly $72 it saved on Cantina’s 60-task run.
For more information, visit the official announcement of Apex Flash-1 on the Cantina blog.
