Meet Antares: The Tiny AI That Hunts Vulnerabilities Without Ever Leaving the Building

Somewhere right now, a security analyst is staring at a vulnerability advisory that says, essentially, “this weakness exists somewhere in your codebase, good luck.” No file names. No line numbers. Just a CWE category and a repository with more folders than a filing cabinet at the DMV.

That gap between “here’s a vulnerability class” and “here’s the exact file it’s hiding in” is where a lot of security teams quietly lose their evenings. Cisco’s Foundation AI group decided to build something to close it, and the result is a small, oddly charming family of AI models called Antares. It doesn’t write code. It doesn’t patch anything. It just goes and finds where the problem is hiding, the way a bloodhound finds a scent trail, except the bloodhound runs on a single GPU and costs less per search than a vending machine snack.

So what actually is Antares?

Antares is a family of open-weight small language models built by Cisco Foundation AI for one job and one job only: vulnerability localization. Give it a CWE identifier (the standard catalog of software weakness categories, like CWE-78 for OS command injection), a generic description of that weakness, and read-only access to a repository, and it goes to work the way a security engineer would at 2 a.m. running on cold coffee. It issues plain terminal commands like grep, find, and cat, reads what comes back, forms a hypothesis, and narrows the search until it has a ranked list of suspect files.

“Think of it less as a security guard and more as the world’s most focused intern, one who has read every CWE category ever published and refuses to get distracted by literally anything else in the building.”

It’s not a chatbot, and it will disappoint you if you try to ask it about your weekend plans. It’s not a general coding assistant either. It doesn’t fix anything, doesn’t assign severity, and doesn’t confirm that a vulnerability is real.

The workflow above is the whole trick, condensed into four steps: get the mission brief (a CWE and read-only repo access), explore the codebase with terminal commands, search and verify while rejecting weak leads, then submit a ranked, ready-to-review list of candidate files. Fifteen commands, and it’s done. No vector database, no external retrieval system, nothing calling home. Everything happens inside the boundary you control, which is exactly the point.

Small models, oddly big results

Here’s the part that made security researchers do a double take. Cisco built its own benchmark for this, called VLoc Bench, made of 500 tasks pulled from 290 repositories across six software ecosystems and 147 CWE categories. Each task hands a model a repository with a known, patched vulnerability and asks it to find the files that patch later touched. It’s a genuinely hard test, and 190 of the 500 tasks weren’t solved by any model at all.

That’s a rounding error apart from GPT-5.5, a frontier model with a small country’s worth of parameters, and Antares-3B got there while being dramatically smaller and running entirely on hardware you could fit under a desk. A 753-billion-parameter open-weight model, for comparison, only managed 0.186. Bigger, in this one narrow job, was not better.

The cost numbers are where this stops being a research curiosity and starts being a budget conversation. Running that 500-task evaluation on Antares costs about $0.82. Running it against the GPT-5.5 API costs around $141. Under a fifth of a cent per task is the kind of number that turns “we should scan for this eventually” into “why aren’t we already scanning for this on every commit.”

The training approach is worth a sentence too, mostly because the acronym is fun to say out loud. Antares uses Group Relative Policy Optimization, GRPO, to learn search strategies from verifiable rewards, essentially rewarding the model for actually finding the right files instead of just sounding confident about the wrong ones. It’s the difference between a detective who follows evidence and one who just really believes in his theory.

Why “runs locally” is the whole pitch

The models come in three sizes, 350M, 1B, and 3B, built to scale from mobile and IoT devices up to a single workstation GPU. The 350M and 1B weights are on Hugging Face right now under Apache 2.0. All three are small enough to run air-gapped, on-premises, with no source code ever leaving your network.

Every cloud-based AI security tool has the same awkward disclosure buried in its terms of service: your proprietary code needs to travel to someone else’s servers to get analyzed.

For a startup, that’s a mild discomfort. For a bank, a hospital system, a defense contractor, or basically anyone with a compliance officer who has opinions, that’s a hard no. Antares sidesteps the whole question by never asking your code to leave the room.

What it’s actually good for

Cisco is upfront that Antares isn’t trying to replace your entire application security stack, and it shouldn’t. You still need dependency and software composition analysis, secret scanning, dynamic testing, and a human being who understands your architecture well enough to say “wait, that’s actually fine.” What Antares does is take over the specific, tedious step of “where do I even start looking,” which is exactly the step most teams handle worst. A few ways businesses are already slotting it in:

Notice a theme. None of these use cases ask Antares to be the last line of defense. They all ask it to be the first, fast, cheap pass that makes the expensive human review go further. That’s a much more honest pitch than “AI will secure your code,” and it’s also, refreshingly, one that’s actually backed by numbers instead of vibes.

Where it still struggles

If your stack is mostly Java, temper your expectations accordingly, or at least don’t fire your static analysis tools just yet. Performance also drops as repositories get bigger, and vulnerabilities that span five or more files are genuinely hard under the 15-command budget. This is a scout, not a psychic. It narrows the search radius; it doesn’t guarantee a bullseye.

The takeaway

The interesting story here isn’t really “Cisco made a small AI model.” It’s that a 3-billion-parameter model, trained specifically to search and reason about vulnerability locations, can go toe to toe with a frontier model built to do everything, at a fraction of the cost, entirely on hardware you own.

“Security can’t be a luxury good, yet advanced AI-based detection has largely belonged to organizations with frontier-scale budgets.”

— Amin Karbasi, VP and Chief AI Scientist, Cisco Foundation AI

Antares is a bet that specialization beats scale, at least for this one very specific, very tedious job. It won’t replace your security team. It will make the unglamorous part of their job, the part where they stare at a CWE number and a thousand-file repository and sigh, considerably shorter. For a lot of organizations that never had a frontier-model budget to begin with, that’s the whole point.

Sources and further reading

• Cisco Blogs: Introducing Antares: Highly Efficient Open Weight AI Models for Vulnerability Localization
• Hugging Face: fdtn-ai/antares-350m model card
• Cisco Foundation AI: Antares: Foundation Models for Agentic Vulnerability Localization (technical report)
• TechRepublic: Cisco Antares Models Bring Local AI to Vulnerability Triage
• MarkTechPost: Cisco Foundation AI Releases Antares
• Help Net Security: Cisco’s open-weight Antares models make vulnerability localization cheaper