Cisco Releases Antares: Open-Weight AI Models for Code Vulnerability Detection

Cisco has released Antares, a family of compact AI models designed specifically to locate known vulnerabilities within software codebases—a task that typically demands significant analyst time and computational resources.

The company made two models available as open-weight releases on Hugging Face: Antares-350M and Antares-1B. According to Cisco, both outperform larger closed and open-weight models on vulnerability localization tasks while requiring substantially less computing power. The models are small enough to run on local infrastructure, eliminating the need to transmit proprietary source code to cloud services.

How Antares Works

Antares models follow an iterative search strategy that mirrors how security analysts investigate repositories. Starting from a vulnerability description—such as a Common Weakness Enumeration (CWE) category or security advisory—the model searches for relevant code patterns, reads candidate files, incorporates new evidence, and adjusts its approach when a path proves unproductive.

The output is a ranked list of source files likely to contain the vulnerability, accompanied by the exploration trace that led to each conclusion. Security teams can use these results to prioritize manual review during advisory triage, focused CWE investigations, or continuous integration security checks.

Cisco emphasized that Antares is not a replacement for comprehensive application security toolchains. Organizations still need dependency analysis, secret scanning, dynamic testing, and expert review. Instead, Antares addresses the expensive first stage of vulnerability triage: narrowing the search space within large codebases.

A New Benchmark for Security-Specific Localization

Cisco developed the Vulnerability Localization Benchmark to measure Antares performance—a 500-task benchmark requiring models to navigate unfamiliar codebases and recognize vulnerability patterns associated with specific CWE categories. The company noted that existing code-search benchmarks like SWE-Bench measure general software issue resolution, not security-specific file localization.

Benchmark testing showed that Antares models complete vulnerability localization runs at substantially lower estimated cost and runtime than larger comparison models, according to Cisco.

Why it matters

Vulnerability localization has historically required either expensive commercial tools or significant analyst expertise—resources that universities, nonprofits, and smaller security teams often lack. By releasing compact models that run locally, Cisco is making AI-assisted security analysis accessible to organizations with limited budgets or strict data residency requirements. The open-weight release also allows security researchers to audit, customize, and improve the models for specific use cases.

Part of a Broader Security AI Strategy

Cisco positioned Antares alongside two earlier initiatives: Foundry Security Spec, a blueprint for building agentic security evaluation systems, and CodeGuard, a corpus of secure coding rules for AI development tools. Together, these efforts aim to establish practical, auditable standards for AI in security operations.

Reza Shokri, associate professor of computer science at the National University of Singapore, noted that small models are "especially compelling" for security verification because they run locally and operate fast enough to check code in real time before deployment.

The Antares models and technical paper are available on Cisco's Hugging Face page. Details were first reported by Cisco on its corporate blog.