A security startup just released an open AI model that can read code, find a real bug and prove it with a working exploit. For anyone following AI penetration testing, that is a big step. Until now, the best results came from expensive closed models that you rent by the token.

I'm Nitin Kumar, Lead Project Coordinator at Debugged Pro. We build and maintain software for clients in India and the USA, so security testing sits on every project plan I write. Here is what Cantina's new model actually does, what the numbers say, and how agencies can use tools like this without getting into trouble.

Apex-Flash-1 graphic showing 66.7% pass rate, 31x lower cost than Claude Opus 5 High and a $2.38 full test run — Cantina Security and Yeta Labs released apex-flash-1, a 321B open-weights model for vulnerability research. Figures are company-reported. Image credit: MarkTechPost, based on cantina.security/apex-flash

What Is Apex-Flash-1?

Apex-flash-1 is an open-weights model from Cantina Security, built in partnership with Yeta Labs. Cantina says it is the company's first model trained specifically for security research. The weights went up on Hugging Face in the past week under the MIT license, which allows commercial use.

You can read the full Cantina apex-flash-1 release post for the company's own explanation. Here are the basics:

Base model: a reinforcement learning post-train of GLM-5.3-Flash, made by Z.ai.
Size: 321.3 billion total parameters, according to its Hugging Face metadata. The base is a mixture-of-experts model with 18 billion active parameters.
Job: focused investigations. That means reading code, using tools, pursuing an exploit and checking that it worked on a live target.
Role: a worker model. Cantina expects a larger model to hand it a narrow task and coordinate the overall job.

Cantina also released an experimental "abliterated" version with modified refusal behavior. The company says its evaluation applies only to the standard checkpoint.

How Cantina Trained an AI Penetration Testing Model

The training method is worth a look, because it explains both the strengths and the limits.

Real bugs inside realistic test systems

Cantina took vulnerabilities its team found in real security work. It then rebuilt working open-source apps and protocols, added those flaws back in, and filled them with realistic fake data such as users, orders and permissions.

Each target runs as its own Docker Compose stack on an isolated network, with fresh state for every attempt. A separate checker outside the agent's sandbox decides if the attack actually succeeded through the intended bug.

Three levels of difficulty

Cantina built 150 training tasks from 50 vulnerability cases. Each case comes in three versions:

Guided whitebox: full source code plus detailed hints about the bug and exploit path.
Focused whitebox: full source code, but only a pointer to a general area of the system.
Focused blackbox: no source code, just limited access to the running app.

Cantina found that small details in the prompt matter a lot. Naming a single function or subsystem can change solve rates dramatically.

What kinds of bugs it learned

The mix of training cases tells you where this model should be strongest.

Vulnerability class	Share of training cases
Authorization, identity and scope binding	72%
Accounting and numerical precision	18%
Time validation and signature replay	4%
Business rules and payment validation	4%
Server-side request forgery (SSRF)	2%

That focus on access control is smart. Broken access control is ranked first in the OWASP Top 10 for 2025, the most widely used list of web app security risks. It is also the kind of bug that simple scanners miss, because spotting it means understanding who should be allowed to do what.

The technical recipe

For readers who like the details: Cantina used GRPO reinforcement learning with a rank-256 LoRA across all experts and routers. It also fully updated 16 experts chosen by how often they activated. The company says updating every parameter made the model collapse, likely because the training set was small.

Training ran inside the Codex agent harness, and Cantina recommends that harness for using the model.

The Results: Close to a Frontier Model at a Fraction of the Cost

Cantina tested the model on 60 tasks from 20 vulnerability cases it held back from training. Each model got one attempt per task.

Model	Tasks solved	Pass@1	Estimated cost for 60 tasks
Claude Opus 5 High	43 of 60	71.7%	$74.68
apex-flash-1	40 of 60	66.7%	$2.38
GLM-5.3-Flash (base)	36 of 60	60.0%	$4.56

As MarkTechPost's analysis of the apex-flash-1 benchmark points out, Opus solved three more tasks but cost about 31 times more per run. That works out to roughly six cents per solved task for apex-flash-1, against about $1.74 for Opus.

Scatter chart comparing pass rate and cost for Claude Opus 5 High, apex-flash-1 and GLM-5.3-Flash on 60 security tasks — Pass rate against estimated cost for the full 60-task run. apex-flash-1 reached 66.7% for $2.38. Image credit: Cantina Security

Read these numbers with care

These are good results, but keep three things in mind:

It is Cantina's own test. The benchmark is internal and company-reported. No independent group has repeated it yet.
The set is small. Sixty tasks from 20 cases is a narrow sample, weighted toward access control bugs.
Only text was tested. The model keeps its base model's image support, but Cantina has not evaluated image or video tasks.

The Hardware Catch

Open weights do not mean cheap to run. MarkTechPost reports that the full BF16 model needs roughly 640 GB of GPU memory. That is a multi-GPU server, not a laptop or a single cloud GPU.

It can be served on vLLM, SGLang or Hugging Face Transformers. Community 4-bit versions already exist, which cut memory needs a lot. Just remember that compressed versions were not part of Cantina's evaluation, so test them on known bugs before trusting them.

For most small and mid-sized agencies, the realistic path is renting GPU time from a cloud provider for short test runs, or using a hosted security product built on models like this one.

Why Open Models Matter for AI Penetration Testing

Cantina makes a clear argument in its release. Attackers do not follow acceptable-use policies or data residency rules. They can already run open models locally and strip out safeguards. Defenders, meanwhile, face the tightest limits.

"Machine-speed attacks require machine-speed defense, and defenders need models they can run, control, and improve inside the systems they are responsible for protecting," the company wrote.

Cantina compares this to the debate over tools like Nmap and Metasploit two decades ago. Both were controversial, and both became standard equipment for security teams.

For agencies, the practical benefit is control. A model you host yourself means client source code never leaves your environment. That matters for clients with strict contracts in the USA and for teams handling personal data under India's data protection rules.

There is also a question of trust. GLM-5.3-Flash comes from a Chinese lab, and some clients will ask about that. We covered how to handle those conversations in our guide to bias and risk in Chinese AI models.

How Agencies in India and the USA Can Use AI Penetration Testing Safely

Tools like apex-flash-1 can make security testing faster and cheaper. They can also create a mess if you run them carelessly. Here is the approach I would suggest.

Get written permission first. Only test systems your client owns and has authorized in writing. Define scope, dates and allowed techniques before any model runs.
Use isolated copies. Copy Cantina's own setup. Test against a staging clone with fake data, never against production with real customer records.
Start with access control. That is where this model was trained hardest. Point it at login flows, role checks, multi-tenant boundaries and payment logic.
Keep a human in the loop. Have a security engineer confirm every finding before it goes into a report. False positives waste developer time.
Do not flood bug bounties. Never submit unverified AI findings to public programs. Google recently paused part of its open source bounty program over low-quality AI reports, as we explained in our Google bug bounty pause guide.
Track costs per finding. Measure what each confirmed bug costs you in GPU time and staff hours. That number tells you whether to self-host or buy a service.

A quick example

Say a USA fintech client hires an Indian development team to build a loan portal. Before launch, the team spins up a staging copy with synthetic borrowers and gives the AI one focused task: check whether one borrower can view or change another borrower's loan.

The model reads the API code, tries requests with different user IDs and reports a working exploit if it finds one. A senior engineer confirms it, the developers fix it, and the model reruns the same test to prove the fix holds. The whole loop takes hours instead of days.

If you want help building security checks like this into your delivery process, our software development consulting team works with clients in India and the USA on secure architecture, code review and release planning.

What Comes Next

Cantina says it is building harder, multi-step investigations, broadening its data mix and training across more agent harnesses. It also plans to publish more held-out and public benchmark results once they are validated.

Public benchmarks will be the real test. If independent results hold up, small security teams will get access to testing power that used to need a big budget. Attackers will too, which is exactly why defenders should start learning these tools now.

Key Takeaways

Cantina Security and Yeta Labs released apex-flash-1, an MIT-licensed open model for AI penetration testing and vulnerability research.
On Cantina's internal test it solved 40 of 60 tasks for about $2.38, close to Claude Opus 5 High's 43 for about $74.68.
Most training cases (72%) covered authorization and identity bugs, the top risk in the OWASP Top 10 for 2025.
The full model needs roughly 640 GB of GPU memory, so most agencies will rent hardware or use a hosted service.
Use it only with written permission, on isolated test systems, with a human checking every finding.

FAQ: AI Penetration Testing and Apex-Flash-1

What is apex-flash-1?

It is an open-weights AI model from Cantina Security, built with Yeta Labs, for security research. It is a reinforcement learning post-train of Z.ai's GLM-5.3-Flash and is published on Hugging Face under the MIT license.

How well does apex-flash-1 perform at finding bugs?

On Cantina's own held-out test of 60 tasks, it solved 40 (66.7% pass@1) for about $2.38. Claude Opus 5 High solved 43 for about $74.68. These are company-reported results on an internal benchmark, not an independent test.

Can a small agency run apex-flash-1 on its own servers?

Probably not at full precision. MarkTechPost reports that the BF16 weights need roughly 640 GB of GPU memory, which means a multi-GPU server. Community 4-bit versions exist, but test them before you rely on the results.

Is AI penetration testing legal?

Yes, when you have written permission from the system owner and stay inside the agreed scope. Running an exploit model against systems you do not own or have no authorization to test can break the law in both India and the USA.

Will AI penetration testing replace human security testers?

Not today. Cantina designed apex-flash-1 as a worker model that a larger model directs, and its results still need human review. It speeds up the search for bugs, but people still decide scope, check findings and fix the code.

About the Author

Nitin Kumar is Lead Project Coordinator at Debugged Pro. He plans software projects for clients in India and the USA and works with engineering teams on delivery, quality checks and secure releases.