Cisco releases open-weight Antares small AI models for vulnerability localization

Cisco has released Antares, a new family of small language models built for a narrow but expensive security job: finding where a known vulnerability is likely to live inside a source-code repository. The company said on July 21 that Antares-350M and Antares-1B are now available as open-weight models through Hugging Face, with a larger Antares-3B model planned.

The release is aimed at vulnerability localization, the early triage step where an analyst starts from a CWE, advisory, CVE, or similar description and searches an unfamiliar codebase for the files that matter. Cisco says the models are trained to operate more like terminal-based investigators than general coding assistants: they inspect repository contents, use standard command-line searches, revise their route as they collect evidence, and return candidate vulnerable files for human review.

Why it matters

Security teams already use static analysis, dependency checks, secret scanners, fuzzing, and manual review, but those tools do not remove the need to map an external vulnerability report to the exact implementation files in a large project. Cisco’s argument is that compact, specialized models can make that step cheaper and easier to run repeatedly, especially for organizations that cannot send proprietary source code to a hosted frontier model or pay for high-volume token usage.

The public Antares-1B model card says the model is based on IBM Granite 4.0 1B and trained with supervised fine-tuning followed by Group Relative Policy Optimization. Cisco lists Apache 2.0 as the license and describes the intended deployments as local or controlled environments for security practitioners, researchers, and developers. Access on Hugging Face is public but gated: users must agree to share contact information and requests are reviewed manually before files can be accessed.

Benchmarks and limits

Cisco also introduced a Vulnerability Localization Benchmark, or VLoc Bench, with 500 tasks from 290 real-world repositories across six package ecosystems and 147 CWE categories. The Antares-1B card reports a File F1 score of 0.209 on that benchmark and says a full 500-task sweep completed in about 13 minutes on a single H100 GPU using 16 parallel workers.

Those results are vendor-provided and should be read as a starting point rather than a guarantee in production repositories. Still, independent coverage from Help Net Security highlights the same core point: Cisco is trying to turn AI-assisted code-security triage into something small enough to run close to the code, while leaving final security decisions to the broader application security workflow and human analysts.

Sources

• blogs.cisco.com
• huggingface.co
• www.helpnetsecurity.com

Cover photo by Markus Spiske on Pexels, used under the Pexels License.