Introducing Antares: Highly Efficient Open Weight AI Models for Vulnerability Localization

Cisco is introducing Antares, a family of security small language models (SLMs) purpose-built to pinpoint where known vulnerabilities exist within a codebase.

Cisco is releasing Antares-350M and Antares-1B as open-weight models on Hugging Face. Benchmark testing shows they outperform many larger closed- and open-weight models on vulnerability localization at a fraction of the cost, and are compact enough to run locally so sensitive codebases need not go to the cloud. Antares-3B is coming soon (held for Cisco products / limited release per secondary reporting).

Problem

Connecting external vulnerability knowledge (databases, advisories, CWEs) to internal code is costly: large repos, noisy signals, evidence spread across files. Compact local models reduce inference cost and support privacy/compliance-sensitive environments (universities, public sector, smaller teams).

How Antares works

Antares uses iterative terminal-based search resembling a human investigator: start from a vulnerability description, search patterns, read candidates, backtrack when unproductive, narrow to likely files. Outputs a ranked list of source files plus an exploration trace. Intended for CWE localization, advisory triage, augmenting SAST, CI/CD early review — not a full AppSec replacement.

Benchmark

Cisco introduced the Vulnerability Localization Benchmark (VLoc): 500 tasks requiring navigation of unfamiliar codebases and recognition of CWE-associated vulnerability patterns. Adjacent work (CodeScout) targets general code localization, not security-specific CWE/advisory localization.

Ecosystem context

Part of Cisco Foundation AI efforts alongside Foundry Security Spec (agentic security evaluation blueprint) and CodeGuard (secure-by-default coding rules). Authors include Amin Karbasi and collaborators (Supriti Vijay, Aman Priyanshu, and others).