Cisco introduced Antares on July 21, 2026, a family of small language models built to do one specific thing well: pinpoint where known security vulnerabilities sit inside a codebase. The first two models, Antares-350M and Antares-1B, are available now as open-weight downloads on Hugging Face. A larger Antares-3B is coming.
The models come from Cisco Foundation AI, the company's research and engineering group focused on security-specific artificial intelligence. Their target is vulnerability localization, the work of connecting external vulnerability data such as public databases, advisories, and Common Weakness Enumeration entries to the specific files in a repository where a flaw is likely to live.
That step is one of the slower and more expensive parts of software security. Analysts have to search unfamiliar code, follow naming conventions, trace call paths, and compare candidate files before deciding whether a weakness is actually present. Antares is designed to narrow that search.
How it works
Rather than scan a repository with fixed rules, Antares works through it the way a human investigator would. Each model starts from a vulnerability description, searches for relevant code patterns, reads candidate files, folds in new evidence, changes direction when a path leads nowhere, and narrows toward the files most likely to matter. The output is a ranked list of source files likely to contain the relevant vulnerability, along with the terminal exploration trace that produced it.
The models run inside a constrained loop with three tools. They receive a CWE category description and nothing else. No advisory text, no file hints, no severity details. They then issue read-only terminal commands against a Docker sandbox with networking disabled. The budget is 15 terminal calls per task. The model terminates by submitting a ranked list of vulnerable files or declaring no vulnerability found.
The benchmark results
To measure the models, Cisco built its own test, the Vulnerability Localization Benchmark. It contains 500 tasks drawn from 290 unique real-world repositories across six ecosystems: npm, pip, Maven, Go, Rust, and Composer. It covers 147 unique CWE categories, and 78% of entries carry assigned CVE identifiers.
The pattern in the data is a capability cliff, not a scaling curve. Antares-3B reaches 0.223 File F1, just under GPT-5.5 at 0.229. Antares-1B reaches 0.209, above GLM-5.2 at 753B parameters, which scores 0.186. Antares-350M reaches 0.135, above Gemma-4-31B at 0.101 and Gemini 2.5 Flash at 0.102.
Antares-1B also records the highest recall of any evaluated system at 0.224. Static analysis tools run under the same evaluation scored far lower: Semgrep at 0.086, CodeQL at 0.023, and Horusec at 0.020. Rule-based scanners recover some vulnerable files but cannot adaptively inspect repository context.
The cost story
The most striking number may be the price. Cisco puts the cost of an Antares evaluation at under 12.50 for the strongest open-weight model tested, GLM-5.2, and about $141 for the strongest closed-source model, GPT-5.5. Antares is 15.2 times cheaper than GLM-5.2 and 172 times cheaper than GPT-5.5. It also finishes benchmark runs in about an hour, compared with roughly four and a half hours for GPT-5.5.
The models are small enough to run locally, which lets security teams keep sensitive source code inside their own environment rather than sending it to a cloud service. Cisco is pitching that as a fit for universities, public-sector bodies, nonprofits, and smaller security teams that lack the budget for token-heavy commercial models.
What it does not do
Cisco was explicit about the boundaries. The models are meant to speed up the first pass of vulnerability triage, not replace it. They do not stand in for the rest of the application security stack, including dependency and software composition analysis, secret scanning, dynamic testing, and human review.
Antares is the latest piece of a broader Cisco push around AI in security. In October, the company released Project CodeGuard, an open-source framework of secure-coding rules for AI coding agents. In May it published Foundry Security Spec, an open blueprint for building agentic security evaluation systems. Cisco Foundation AI has also shipped a run of open-weight security models over the past year, including Foundation-sec-8B and a reasoning version.
The architecture is straightforward. All three models initialize from IBM Granite 4.0 checkpoints. They share a tokenizer and architecture: grouped-query attention, SwiGLU MLPs, RMSNorm, RoPE, and shared input/output embeddings. Antares-350M has 28 layers and a 32K context. Antares-1B has 40 layers and a 128K context. Both ship under the Apache 2.0 license.
The goal, as Amin Karbasi, vice president and chief scientist at Cisco Foundation AI, put it, is to build toward a system where all security practitioners, regardless of on-prem or resource constraints, can effectively incorporate AI in everyday security operations. For an industry where the cost of triage often means vulnerabilities go unexamined, a 350-million-parameter model that runs on a laptop and costs pennies per job is not a marginal improvement. It is a different category of tool.