Cantina's open-weights exploit model ran a 60-task security eval for $2.38

The $2.38 is the cost of running the test, not of using the model on real targets. Cantina ran its 60-task evaluation for that figure and reported $74.68 to run the same tasks on Claude Opus 5 High, about 31 times more ^[10][2]. Claude also solved more of them: 43 against apex's 40, or 71.7 percent against 66.7 ^[8][7][1][3].

The comparison that argues for the training is the base model. Untuned GLM-5.3-Flash solved 36 of the same tasks and cost $4.56 to run them ^[9][10]. Cantina's reinforcement-learning fine-tune of that model solved 40 and cost $2.38, roughly half ^{[5][7][10][5]}. It is both more capable and cheaper than the model it was trained from ^[5].

Every one of those numbers comes from Cantina's own model card ^[21]. The 60 tasks were drawn from 20 held-out vulnerability cases and run in isolated environments, with verifiers that checked the final state of each target ^[6][11]. Mulackal argues public cyber benchmarks are poor proxies for the flaws customers actually hit, so Cantina built its own around offensive and defensive tasks ^[18]. That gives the company a measure it considers closer to real work. It also means no outsider can line apex up against Claude on a neutral test ^[22].

There is no hosted endpoint. In a reply, Mulackal said Cantina has no hosted option billed per token for now, and Cantina points users at an agent harness such as Codex ^[4][3]. The download is free; the running is not. A 321-billion-parameter model is inference you provision and pay for yourself, so whether the $2.38 transfers depends on your hardware and your targets ^[5].

Mulackal worked on the Solidity language and compiler at the Ethereum Foundation before co-founding Cantina and the security firm Spearbit, according to his Devcon profile ^[13]. In his October 4 post he framed security as an economics problem and cited Anthropic's September 10 report on AI-assisted "exploit foundries" as evidence the work is being automated ^[1][14][15]. He also said Cantina has earned $1 million in bug bounties, ranks first on HackerOne's US business leaderboard for 2026, and that its harnesses process trillions of tokens a month ^[16][17]. Those are claims in the post, not audited figures. Cantina came out of stealth in July with an $8 million round led by Framework Ventures ^[19].