Cisco releases Antares, compact AI models for finding code vulnerabilities

Cisco today introduced Antares, a family of security small language models (SLMs) purpose-built to solve one of the most expensive and time-consuming problems in software security: pinpointing where known vulnerabilities exist within a codebase. The company released two models immediately—Antares-350M and Antares-1B—as open-weight models on Hugging Face, with Antares-3B coming soon.

Vulnerability localization is difficult because software repositories are large, security signals are noisy, and relevant evidence is scattered across many files. Analysts must search through unfamiliar code, follow naming conventions, inspect call paths, and compare candidate files to decide whether a weakness is actually present. For many organizations—especially universities, public-sector institutions, and smaller security teams—the cost and infrastructure demands of traditional vulnerability management are prohibitive. Antares addresses both the technical and economic sides of this problem. The models are compact enough to run locally, keeping sensitive source code within an organization's own environment and avoiding the need to send code to the cloud. They are also fast enough to integrate into CI/CD pipelines, checking code in real time as it is prepared to merge.

Antares works by following an iterative search pattern that resembles how a human investigator works through a repository. Given a vulnerability description, each model searches for relevant code patterns, reads candidate files, incorporates new evidence, changes direction when a path is unhelpful, and narrows toward the files most likely to contain a relevant vulnerability. The model outputs a ranked list of source files along with the terminal exploration trace that led to that result, allowing security teams to prioritize analyst review during advisory triage, CWE investigations, or security checks. Reza Shokri, Associate Professor of Computer Science at the National University of Singapore, noted that Antares-1B "recognizes vulnerabilities in code it is shown, across several weakness classes and languages" and that the provided command-line interface makes it "easy to scan codebases, inspect findings, and integrate it into automated pipelines." Amin Saberi, Director of the Language, Data, and Reasoning Lab at Stanford University, highlighted that Antares delivers "near-frontier accuracy on secure code reasoning at a fraction of the cost, fast enough to run on every commit."

Traditional static analysis tools, while valuable, are often rule-heavy and require substantial triage. General-purpose coding models can reason about code but are not optimized for security investigation. Antares was inspired by pioneering research from Cisco's Foundation AI team showing that compact models can learn to search, reflect, revise their strategy, and backtrack when a path is unproductive. Benchmark testing shows that Antares models outperform many larger closed- and open-weight models in vulnerability localization at a fraction of the cost.

Because no existing benchmark measured the specific task of localizing vulnerable files from security descriptions or vulnerability classes, Cisco created the Vulnerability Localization Benchmark—a 500-task benchmark requiring models to navigate unfamiliar codebases efficiently and recognize vulnerability patterns associated with specific CWE categories. Cisco is releasing Antares as open-weight because the security community needs more accessible building blocks for practical, repository-level defense. The broader Cisco effort includes Foundry Security Spec, a model-agnostic blueprint for building agentic security evaluation systems with clear roles and guardrails; CodeGuard, secure-by-default rules and skills for AI coding agents; and Antares itself. Together, these tools aim to help all security practitioners, regardless of on-premises or resource constraints, effectively incorporate AI into everyday security operations.

Vulnerability localization has long been a bottleneck in security operations—time-intensive work that demands expertise and often requires organizations to move sensitive code outside their environment. General-purpose AI models, while capable at broad code reasoning, were not designed for the specific task of finding known vulnerabilities within a repository. Antares addresses this gap by building on research from Cisco's Foundation AI team showing that compact models can learn useful search strategies through iterative exploration rather than relying solely on model scale.

The release of Antares alongside a new Vulnerability Localization Benchmark signals a shift toward specialized, measurable AI security tools. By publishing open-weight models and a benchmark, Cisco creates a shared standard against which future work can be evaluated—moving away from proprietary, closed-loop AI security products toward an ecosystem smaller teams and resource-constrained institutions can adopt. This is particularly significant for universities, nonprofits, and public-sector organizations that have historically lacked the budget for token-intensive AI services but maintain critical software that requires ongoing vulnerability management.

Cisco frames Antares as one piece of a broader effort to mature AI-assisted security. Foundry Security Spec provides an open blueprint for building agentic security systems with clear governance; CodeGuard contributes reusable secure coding rules; and Antares adds the compact models and benchmark needed to make vulnerability localization practical and measurable. The connective theme is shifting AI in security from one-off demos toward deployable systems practitioners can evaluate, govern, and improve.

No comments yet. Be the first to share your thoughts!