Cantina Security, in collaboration with Yeta Labs, has released apex-flash-1, an open-weights artificial intelligence model specifically designed and trained for security vulnerability research. Built as a reinforcement learning fine-tune of Z.ai’s GLM-5.3-Flash, the model features 321.3 billion total parameters and is available on Hugging Face under an MIT license. It was trained using Group Relative Policy Optimization on 150 tasks derived from 50 real-world vulnerability cases, with a focus on authorization flaws, accounting errors, and logic bugs.
In benchmark evaluations covering 60 tasks from 20 held-out vulnerability cases, apex-flash-1 successfully solved 40 tasks, achieving a 66.7 percent pass@1 rate at an estimated cost of $2.38 per run. By comparison, the base GLM-5.3-Flash model solved 36 tasks for $4.56, while Claude Opus 5 High solved 43 tasks at a significantly higher cost of $74.68. Cantina positions apex-flash-1 as a cost-effective worker model designed to handle code reading, exploit development, and verification under the orchestration of larger systems. Why it matters: This release gives defenders an affordable, locally controllable open-weights model capable of competing with costly proprietary alternatives in vulnerability research.