Cisco releases small open AI models for code vulnerability scanning

Cisco has released two small open AI models, Antares-350M and Antares-1B, for finding vulnerabilities in software code. The company is positioning the models on cost and data control, claiming they can run locally and scan code without sending sensitive repositories to an external model provider.

The models are available through a Hugging Face collection. Cisco has not disclosed commercial pricing tied to the open releases, and the company is withholding a larger three-billion-parameter Antares model for use in its own products, according to reporting cited by The Decoder.

Cisco’s main pitch is efficiency rather than model size. Aman Priyanshu, a developer associated with the project, said on X that Antares-350M identifies about 150 times more vulnerabilities per dollar than large AI agents such as Cognition’s Devin Security Swarm. That is a company-side benchmark claim, not an independently established industry measure.

Axios reported that, in Cisco’s own tests, Antares scanned 500 code repositories in roughly 15 minutes at a cost of less than $1. GPT-5.5, used on the same task, took five hours and cost more than $100, according to the same report. The underlying test setup, repository mix and evaluation criteria were not detailed in the summary reporting.

Smaller models, narrower job

The Antares release fits a familiar enterprise AI pattern: use a specialized model for a narrow workflow instead of paying for a general-purpose frontier model on every task. Vulnerability detection is a natural target for that argument because code scanning can involve large volumes of proprietary source code and repeated runs across many repositories.

Cisco’s technical report says the Antares models were trained on a data mix heavily weighted toward cybersecurity material. Roughly 72% of the training data covered security concepts, while about 15% came from code search histories, according to the report. Cisco did not describe the full remaining composition in the summarized material.

Local execution is also part of the pitch. If the models run inside a company’s own environment, teams can test private code without handing it to an external API. That will be more relevant to security teams and regulated enterprises than to developers already comfortable sending code to hosted assistants.

The larger Antares model is not part of the open release. Cisco is keeping the three-billion-parameter version for its own products, where it reportedly performs close to GPT-5.5 and outperforms open models up to 200 times larger. Those performance claims come from Cisco’s testing and were not accompanied in the summary by third-party validation.

Cisco is also considering an industry consortium for open AI security tools. The company has not announced members, governance, timing or a deliverable for that effort. For now, the concrete move is the release of two small models and a cost-performance argument aimed at security teams deciding whether every AI-assisted code review needs a frontier model.

This story draws on original reporting from The Decoder.