Cisco posts Antares open-weight models for vulnerability triage

Cisco Systems has released Antares, a set of open-weight small language models designed to identify which files in a code repository are likely tied to a known security flaw. The first two models, Antares-350M and Antares-1B, are available on Hugging Face, with no pricing announced and a larger Antares-3B model still to come.

The release comes from Cisco Foundation AI, the company’s security-focused AI research and engineering unit. Cisco is aiming Antares at vulnerability localization, the triage step that connects external security information, including public vulnerability databases, advisories and Common Weakness Enumeration categories, to the parts of a codebase where the weakness may exist.

That job is expensive because it is usually manual. Security analysts may have to inspect unfamiliar repositories, interpret naming patterns, follow call paths and compare multiple candidate files before deciding where a flaw is likely to sit. Cisco says Antares is meant to reduce that search area, rather than replace the rest of the application security process.

The models are small enough to run locally, according to Cisco. That matters for organizations unwilling or unable to send proprietary source code to a hosted model provider. Cisco is positioning the models for universities, public-sector organizations, nonprofits and smaller security teams that may not have the budget for high-volume use of commercial models.

Antares does not rely on static rules to scan a repository, according to Cisco. The company says the models start with a vulnerability description, search for relevant code patterns, inspect candidate files, incorporate evidence as they go and change course when a search path does not produce useful results. The output is a ranked set of source files likely to contain the vulnerability, along with the terminal exploration trace used to reach that result.

Cisco’s benchmark is also part of the pitch

Cisco also created a test suite for the release. Its Vulnerability Localization Benchmark contains 500 entries and asks a model to work through an unfamiliar codebase to connect vulnerability patterns with files tied to specific weakness categories. Cisco said existing code-search tests measure broader software issue discovery, rather than security-specific file localization from vulnerability descriptions.

On that company-built benchmark, Cisco said Antares outperformed roughly a dozen larger open- and closed-weight models on accuracy while costing less to run. Cisco reported an Antares evaluation cost of under $1, compared with about $12.50 for GLM-5.2, which it called the strongest open-weight model in its test, and about $141 for GPT-5.5, which it called the strongest closed-source model. Cisco described those figures as 15.2 times and 172 times cheaper, respectively.

Cisco also said Antares completed benchmark runs in about one hour, versus roughly four and a half hours for GPT-5.5. Those are Cisco-reported results on Cisco’s own benchmark, so buyers should treat them as an early claim rather than a settled comparison across production security environments.

Antares extends a broader run of Cisco security AI releases. The company previously released Project CodeGuard, an open-source secure-coding framework for AI coding agents, and published Foundry Security Spec, an open blueprint for agentic security evaluation systems. Cisco Foundation AI has also released open-weight security models including Foundation-sec-8B and a reasoning variant.

Amin Karbasi, vice president and chief scientist at Cisco Foundation AI, wrote in a blog post that the goal is to help security practitioners use AI in daily security work regardless of on-premises requirements or resource constraints. Cisco also said Antares is limited to first-pass vulnerability triage and is not a substitute for dependency analysis, software composition analysis, secret scanning, dynamic testing or human review.

This story draws on original reporting from SiliconANGLE.