Can an Open Model Do Security Research? Cantina's apex-flash-1 Solves 40 of 60 Held-Out Bug Tasks

Cantina Security and Yeta Labs released apex-flash-1, an open-weights vulnerability research model built as a GRPO fine-tune of Z.ai's GLM-5.3-Flash, available on Hugging Face under the MIT license. On Cantina's internal 60-task benchmark, it solved 40 tasks (66.7%) for about $2.38, while Claude Opus 5 High solved 43 (71.7%) for about $74.68. The 321.3B-parameter model requires roughly 640 GB of GPU memory in BF16.