Security
Apex Field Report
An empirical study of 4,032 machine-generated findings across 612 production web applications and APIs.
Software teams can now produce and ship code faster than they can review it. The security defects that reach production are changing with that pace.
The Apex Field Report examines the first quarter of operation for Apex, Cantina’s autonomous offensive-security system. From April 8 through July 17, 2026, Apex developed attack hypotheses and looked for evidence of exploitable weaknesses across authorized, live web applications and APIs.
Download the full Apex Field Report (PDF, 8.2 MB)
What the study found
- 4,032 CVSS-scored findings across 612 production targets
- 702 findings scored high severity or above, including 124 critical findings
- 37.4% of targets contained at least one high-or-critical finding
- 99.9% of findings were network-reachable
- 93.4% required no user interaction
- 53.0% required no privileges
Most findings were medium severity, but the high-impact tail was substantial. The most common vulnerability classes were secret and sensitive-data exposure, broken authentication, and broken access control. Together, those missing-control categories accounted for more than half of the findings classified in the report’s taxonomy.
What the findings looked like in practice
Six de-identified case studies show the range and impact of vulnerabilities Apex discovered:
- Cross-account token theft through web-cache deception
- Victim-independent account takeover through HTTP parameter pollution
- Server-side template injection leading to remote code execution
- Mass exposure of personally identifiable information through a leaked live API credential
- Unauthenticated remote code execution through a document-processing sink
- Stored cross-user XSS through a trusted real-time message field
All target identities, endpoints, credentials, and reproduction details are redacted or paraphrased. Vendor disposition is reported only for the selected cases where the affected organization provided it.
Where risk concentrates
Exposure was uneven across the target set. The median target carried four findings, while the most affected carried 55. More than a third of the production applications analyzed had at least one high-or-critical finding.
The leading categories point to security boundaries that application code must preserve across many local changes: authentication gates, tenant ownership checks, credential handling, and safe treatment of untrusted input. Functional happy-path tests rarely exercise those boundaries.
What this means for AI-assisted development
The study does not record whether vulnerable code was written by a person or a model, and it does not claim that AI assistance caused any individual finding. It does show the security problem created when development output grows faster than threat modeling and review capacity.
Continuous adversarial testing can help close that gap when it produces reproducible evidence, filters its results carefully, and stays connected to human triage and remediation.
Read the full report
The complete field report includes the study design, severity and exploitability distributions, vulnerability taxonomy, six redacted case studies, limitations, and methodology notes.