2026-07-22 · 6 min · security · ai · open-weights · agents · explainer
Antares is a family of small security models from Cisco's Foundation AI team, built for one narrow, expensive job: vulnerability localization — given a vulnerability class and a codebase, pinpoint the source files that actually contain the flaw. Two are open-weight today under Apache 2.0 — Antares-350M and Antares-1B — with a 3B on the way, and all three are fine-tuned from IBM Granite 4.0. The claim that makes them worth a look: they beat models tens to hundreds of times their size on this task, at a fraction of the cost, and they're small enough to run locally so proprietary code never leaves the building.
The job: localize, don't fix
Antares doesn't patch anything, doesn't explain why a file is vulnerable, and doesn't emit exploits.
It answers one question — which files should a human look at first? — and it does it the way an
analyst would: as a terminal agent. Given only a CWE identifier and its generic description (no
advisory text, no file hints), with the repo mounted read-only, it issues shell commands — grep,
find, cat — reads the output, reasons, changes direction when a lead goes cold, and finally calls
submit_vulnerable_files with a ranked list. The catch that makes it hard: a budget of 15 terminal
calls per task. No vector database, no retrieval index — just exploration. Scrub a run:
src/cli.py:42: os.system(f"ping -c1 {host}")
src/net/probe.py:88: subprocess.run(cmd, shell=True)
src/util/safe.py:12: subprocess.run(shlex.quote(a))host = request.args.get('host')
...
os.system(f"ping -c1 {host}")17: host = request.args.get('host')
42: os.system(f"ping -c1 {host}")subprocess.run(["ping", shlex.quote(a)]) # arg-list, quoted
Note the fourth step: it checks a second candidate, sees shlex.quote, and rules it outinstead of over-reporting. That “search, read, revise, backtrack” behavior is the whole trick — and it’s learned, not a property of scale.
That "search, read, revise, backtrack" loop is the thing Cisco's earlier research argued you can train into a small model — useful retrieval behavior from learned strategy, not from scale. Antares is the test of whether it transfers to security.
The numbers, and why the task is genuinely hard
To measure it they had to build a benchmark, because general code-search sets (SWE-Bench and the like) test finding code relevant to a dev task, not localizing a vulnerability from a CWE description. VLoc Bench is 500 tasks across 290 real repositories, 6 package ecosystems, and 147 CWE categories (78% carry a real CVE); each repo is reconstructed at its pre-fix commit, and ground truth is the set of files the actual security fix touched. The metric is File F1 — the harmonic mean of how many submitted files were right and how many of the right files were found.
Read the scores with the ceiling in mind: this is hard enough that the best frontier model tops out around 0.23. Against that, a 1B open model at 0.209 is the story:
Antares-1B (0.209) clears GLM-5.2 at 753B (0.186) and Gemini 3 Pro (0.152), and the 3B essentially matches GPT-5.5. Meanwhile several giants flail — Llama-3.3-70B lands at 0.012, plain GPT-5 at 0.048 — which tells you this isn't a capability that falls out of scale; it has to be trained in.
Training, not scale
The cleanest evidence is the backbone itself. The same Granite 4.0 1B weights, untrained for this task, score a flat 0.000 — they can't navigate a repo and submit useful files at all. Everything Antares can do comes from a two-stage pipeline: SFT on cybersecurity reasoning, deep-research traces, and terminal code-search trajectories, then GRPO — reinforcement learning over full multi-turn agent trajectories with verifiable rewards for localization quality, valid submissions, tool-use compliance, and exploration behavior. Pick a size and watch the build-up:
The backbone starts at 0.000 — same weights, no idea how to do the job. Training is the entire difference, and even the 350M GRPO model beats a 753B open model. GRPO adds a real slice on top of SFT (+0.021 at 1B): learning to verify and stop, not just imitate.
GRPO isn't cosmetic — it adds a real slice on top of SFT (+0.021 File F1 at 1B) by teaching the model to verify and stop rather than imitate a trajectory. And it stacks down the size ladder: even the 350M GRPO model (0.135) beats a 753B open model.
The economics: cheap enough to run on every commit
Accuracy-per-parameter only matters if it turns into accuracy-per-dollar, and this is where small wins outright. The full 500-task sweep costs about 12.50 for GLM-5.2 (15.2× more) and $141 for GPT-5.5 (172× more) — and Antares-1B finishes it in ~13 minutes on a single H100 with 16 parallel workers.
That's the unlock the researchers keep pointing at: as Stanford's Amin Saberi puts it, "near-frontier accuracy on secure code reasoning at a fraction of the cost, fast enough to run on every commit." A model this size runs on-prem, so — in NUS professor Reza Shokri's framing — "proprietary code never leaves the machine," which matters most for the universities, public-sector teams, and smaller shops that were priced out of token-heavy frontier models. It ships with a CLI that sweeps a read-only repo snapshot and returns candidates as human-readable, JSON, or SARIF for CI/CD triage.
Where it breaks
Cisco is refreshingly specific about the limits, and they follow directly from the design. The 15-command budget means performance degrades on large repos (>10MB) and on multi-file vulnerabilities needing 5+ files of context. It's strong on grep-able patterns (CWE-843 Type Confusion, CWE-1321 Prototype Pollution) and weak on ones that need real semantic understanding (CWE-732 Incorrect Permissions, CWE-667 Improper Locking, CWE-401 Memory Leak). It has an April 2025 knowledge cutoff, and — by design — it tells you which files, never why. It's a first-pass triage aid with a human in the loop, not a replacement for the security toolchain.
The take
Antares is a clean demonstration of a claim that keeps getting more useful: for a narrow, well-shaped task, the behavior that matters — search, verify, backtrack, know when to stop — can be trained into a sub-1B model until it beats models 100–750× its size, cheaply enough to run always-on. It won't generalize; it's not supposed to. It's part of Cisco's broader push (alongside its Foundry Security Spec and CodeGuard efforts) to make AI security tooling something you can measure and deploy rather than demo — and "frontier-adjacent accuracy at $0.71 a run, on hardware you own" is a genuinely different offer than one more giant model behind an API.
Source: Introducing Antares (Cisco Foundation AI, 21 July 2026), the Antares model cards, and the technical report. Figures are Cisco's; the interactives are mine.