# Antares: a 1B model that hunts vulnerabilities like a person

> Satyajit Ghana — Head of Engineering @ Inkers Technology
> canonical: https://ai.thesatyajit.com/articles/antares
> date: 2026-07-22
> tags: security, ai, open-weights, agents, explainer
[Antares](https://blogs.cisco.com/ai/introducing-antares-the-most-efficient-open-weight-ai-models-for-vulnerability-localization)
is a family of small security models from Cisco's Foundation AI team, built for one narrow, expensive
job: **vulnerability localization** — given a vulnerability class and a codebase, pinpoint the source
files that actually contain the flaw. Two are open-weight today under Apache 2.0 — **Antares-350M** and
**Antares-1B** — with a 3B on the way, and all three are fine-tuned from **IBM Granite 4.0**. The claim
that makes them worth a look: they beat models tens to hundreds of times their size on this task, at a
fraction of the cost, and they're small enough to run **locally** so proprietary code never leaves the
building.

## The job: localize, don't fix

Antares doesn't patch anything, doesn't explain *why* a file is vulnerable, and doesn't emit exploits.
It answers one question — *which files should a human look at first?* — and it does it the way an
analyst would: as a **terminal agent**. Given only a CWE identifier and its generic description (no
advisory text, no file hints), with the repo mounted read-only, it issues shell commands — `grep`,
`find`, `cat` — reads the output, reasons, changes direction when a lead goes cold, and finally calls
`submit_vulnerable_files` with a ranked list. The catch that makes it hard: a budget of **15 terminal
calls per task**. No vector database, no retrieval index — just exploration. Scrub a run:

<SearchTrace />

That "search, read, revise, backtrack" loop is the thing Cisco's earlier research argued you can
*train* into a small model — useful retrieval behavior from learned strategy, not from scale. Antares
is the test of whether it transfers to security.

## The numbers, and why the task is genuinely hard

To measure it they had to build a benchmark, because general code-search sets (SWE-Bench and the like)
test finding code relevant to a *dev task*, not localizing a *vulnerability* from a CWE description.
**VLoc Bench** is 500 tasks across 290 real repositories, 6 package ecosystems, and 147 CWE categories
(78% carry a real CVE); each repo is reconstructed at its pre-fix commit, and ground truth is the set
of files the actual security fix touched. The metric is **File F1** — the harmonic mean of how many
submitted files were right and how many of the right files were found.

Read the scores with the ceiling in mind: this is hard enough that **the best frontier model tops out
around 0.23**. Against that, a 1B open model at **0.209** is the story:

<Figure
  src="/articles/antares/fig1.png"
  alt="Scatter of File F1 score against parameter count on a log axis. The Antares family (350M, 1B, 3B) sits at the top-left with high F1 at tiny size; a dozen much larger open and closed models spread across the middle and right at lower or comparable F1; the closed frontier (GPT-5.5) is top-right."
  caption="File F1 vs parameters (log). The Antares family sits on the efficient frontier — tiny and high — while a dozen far larger models score lower (Antares, Figure 1)."
/>

<BenchBars
  title="File F1 on VLoc Bench — higher is better"
  unit=""
  bars={[
    { label: "Antares-3B (soon)", value: 0.223, highlight: true },
    { label: "GPT-5.5 · frontier", value: 0.221 },
    { label: "Antares-1B", value: 0.209, highlight: true },
    { label: "GLM-5.2 · 753B", value: 0.186 },
    { label: "Gemini 3 Pro · frontier", value: 0.152 },
    { label: "Antares-350M", value: 0.135, highlight: true },
    { label: "Qwen3.5-122B-A10B", value: 0.091 },
    { label: "Llama-3.3-70B", value: 0.012 },
    { label: "Granite 4.0 1B (untrained base)", value: 0.0 },
  ]}
/>

Antares-1B (0.209) clears **GLM-5.2 at 753B** (0.186) and **Gemini 3 Pro** (0.152), and the 3B
essentially matches GPT-5.5. Meanwhile several giants flail — Llama-3.3-70B lands at 0.012, plain GPT-5
at 0.048 — which tells you this isn't a capability that falls out of scale; it has to be trained in.

## Training, not scale

The cleanest evidence is the backbone itself. The same **Granite 4.0 1B** weights, untrained for this
task, score a flat **0.000** — they can't navigate a repo and submit useful files at all. Everything
Antares can do comes from a two-stage pipeline: **SFT** on cybersecurity reasoning, deep-research
traces, and terminal code-search trajectories, then **GRPO** — reinforcement learning over full
multi-turn agent trajectories with verifiable rewards for localization quality, valid submissions,
tool-use compliance, and exploration behavior. Pick a size and watch the build-up:

<StageLift />

GRPO isn't cosmetic — it adds a real slice on top of SFT (+0.021 File F1 at 1B) by teaching the model
to *verify and stop* rather than imitate a trajectory. And it stacks down the size ladder: even the
**350M** GRPO model (0.135) beats a 753B open model.

## The economics: cheap enough to run on every commit

Accuracy-per-parameter only matters if it turns into accuracy-per-dollar, and this is where small wins
outright. The full 500-task sweep costs about **$0.71** for Antares-1B — versus **$12.50** for GLM-5.2
(15.2× more) and **$141** for GPT-5.5 (172× more) — and Antares-1B finishes it in **~13 minutes on a
single H100** with 16 parallel workers.

<Figure
  src="/articles/antares/fig2.png"
  alt="Cost-per-evaluation (log, USD) against runtime in hours. The Antares family clusters at the bottom-left near $0.60–$0.82 and well under an hour; GLM-5.2 sits at $12.50 (15.2x more), and GPT-5.5 at $141 and ~4.7 hours (172x more)."
  caption="Estimated cost and runtime for a full benchmark sweep — Antares is 15.2× cheaper than the best open model and 172× cheaper than the frontier (Antares, Figure 2)."
/>

That's the unlock the researchers keep pointing at: as Stanford's Amin Saberi puts it, "near-frontier
accuracy on secure code reasoning at a fraction of the cost, fast enough to run on every commit." A
model this size runs on-prem, so — in NUS professor Reza Shokri's framing — "proprietary code never
leaves the machine," which matters most for the universities, public-sector teams, and smaller shops
that were priced out of token-heavy frontier models. It ships with a CLI that sweeps a read-only repo
snapshot and returns candidates as human-readable, JSON, or **SARIF** for CI/CD triage.

## Where it breaks

Cisco is refreshingly specific about the limits, and they follow directly from the design. The
15-command budget means performance **degrades on large repos** (>10MB) and on multi-file
vulnerabilities needing 5+ files of context. It's strong on **grep-able** patterns (CWE-843 Type
Confusion, CWE-1321 Prototype Pollution) and weak on ones that need real semantic understanding
(CWE-732 Incorrect Permissions, CWE-667 Improper Locking, CWE-401 Memory Leak). It has an April 2025
knowledge cutoff, and — by design — it tells you *which* files, never *why*. It's a first-pass triage
aid with a human in the loop, not a replacement for the security toolchain.

## The take

Antares is a clean demonstration of a claim that keeps getting more useful: for a **narrow, well-shaped
task**, the behavior that matters — search, verify, backtrack, know when to stop — can be trained into
a sub-1B model until it beats models 100–750× its size, cheaply enough to run always-on. It won't
generalize; it's not supposed to. It's part of Cisco's broader push (alongside its Foundry Security
Spec and CodeGuard efforts) to make AI security tooling something you can measure and deploy rather
than demo — and "frontier-adjacent accuracy at $0.71 a run, on hardware you own" is a genuinely
different offer than one more giant model behind an API.

---

*Source: [Introducing Antares](https://blogs.cisco.com/ai/introducing-antares-the-most-efficient-open-weight-ai-models-for-vulnerability-localization)
(Cisco Foundation AI, 21 July 2026), the [Antares model cards](https://huggingface.co/collections/fdtn-ai/antares),
and the [technical report](https://cisco-foundation-ai.github.io/antares/technical-report.pdf). Figures
are Cisco's; the interactives are mine.*