Cisco open-sources the Antares small model: with 1B parameters, it outperforms GPT-5.5 in vulnerability localization.
Cisco’s Foundation AI team has released the Antares series of security‑focused small language models, with 350M and 1B versions now available on Hugging Face with open weights. On their self‑built vulnerability localization benchmark, the 1B version achieved a recall rate that surpasses GPT‑5.5 by a modest 22.4%.
Yesterday (July 21), Cisco dropped a pair of small language models called Antares on Hugging Face—two open‑source versions with 350M and 1B parameters, with a 3B version reportedly coming soon. These models have a single mission: helping security engineers locate vulnerabilities in massive codebases.
What’s interesting is their benchmark score. On Cisco’s own Vulnerability Localization Benchmark, Antares‑1B achieved a 22.4% vulnerable‑file recall rate, edging out GPT‑5.5’s 22.1%. A 0.3‑point difference isn’t exactly a landslide, but considering the massive gap in parameter counts, it’s enough to make people reconsider one thing: in vertical security scenarios, stacking parameters doesn’t necessarily beat a small model that’s been trained for a specific task.
What exactly is Antares doing
Let’s clear up a possible misunderstanding. Antares isn’t a model that automatically digs up 0‑days, and it doesn’t even determine whether a piece of code is truly vulnerable. What it does is vulnerability localization—you feed it a known CWE vulnerability type and description, and it searches the codebase for files that might host that vulnerability. It then returns a candidate list for security staff to manually review.
This localization approach is quite pragmatic. In current software‑security workflows, one of the most labor‑intensive steps is figuring out which files in a multi‑million‑line monorepo are affected after receiving a CVE notice or supply‑chain vulnerability alert. The traditional approach is either grep + regex, which lacks precision, or SAST scans of the entire repository, which produce too much noise. Antares acts as something in between—an “intelligent filter.”
According to Cisco’s technical report, Antares works much like a skilled security investigator:
- Receives a CWE ID and vulnerability description as input
- Actively explores the codebase structure via terminal commands (
grep,find,ls, etc.) - Gradually narrows the search scope, outputting a list of suspicious files and an inspection report
Essentially, this workflow replicates what a human security engineer would manually do after reading a CVE notice. It’s not end‑to‑end, one‑shot output—it behaves more like an agent that iteratively calls tools.
Why a small model
Cisco knew exactly what it was doing by putting a 1B‑parameter model head‑to‑head with GPT‑5.5.
First, data sovereignty. In security contexts, clients simply cannot send proprietary code to external APIs. Financial, government, and defense sectors often isolate networks so strictly that even basic external access is gated—let alone uploading source code to a cloud AI. Antares is small enough to run on a single consumer GPU, or even just CPU inference if necessary. Enterprises can embed it in CI/CD pipelines or deploy it directly within internal security platforms.
Second, cost. Vulnerability localization is a high‑frequency task—every time an upstream dependency reports a security issue, the codebase must be rescanned. Using a flagship model like GPT‑5.5 each time would make token bills skyrocket. A 1B model costs roughly 1% as much to run, while performing slightly better—an overwhelming ROI.
Third, false‑positive control. General‑purpose large models have a chronic problem in security tasks: “everything looks like a vulnerability.” They flag too much normal code as suspicious, increasing manual review effort. A domain‑specific small model has clearer decision boundaries, and Cisco’s marketing highlights its “low false‑positive rate.”
What does a 22.4% recall rate mean
That number may look low at first glance, but context matters.
Cisco’s Vulnerability Localization Benchmark spans 290 real codebases, 147 CWE types, and 500 testing tasks. This isn’t a toy dataset: the repositories are real projects, and the vulnerabilities go far beyond the usual injection or XSS classes, covering everything from memory safety to race conditions.
Under those conditions, 22.4% means the model can correctly identify about one‑fifth of vulnerable files by itself. The rest are either missed or lost in the noise. This result is almost on par with GPT‑5.5, but it shows one thing clearly: vulnerability localization remains a hard nut to crack for all current models. Understanding codebase structure, cross‑file calls, and implicit data flows is still beyond the models’ grasp.
In other words, Antares defines its own role honestly—it’s a productivity booster for human auditors, not a replacement. Cisco’s blog is explicit about this: enterprises still need the full combo of component analysis, SBOM, sensitive‑data scanning, DAST, threat modeling, vulnerability remediation, and manual review. Antares just fills one slot in that lineup.
Cisco Foundation AI’s ambitions
Antares is built by Cisco’s Foundation AI team, formed last year after Cisco reorganized its security‑AI R&D. The mission is clear: create foundational models for security‑specific domains.
Their roadmap has become visible over the past six months:
- Earlier models focused on threat‑intelligence analysis
- Now comes the vulnerability‑localization line
- Most likely next: models for log anomaly detection and malicious‑code classification
This direction differs from other big vendors betting on general‑purpose agents. Cisco has realized that security clients are inherently less willing to adopt general models, because their data is too sensitive. Rather than compete with OpenAI or Anthropic on general capabilities, it’s better to double down on small, specialized models and build a locally deployable security‑AI toolchain. The logic mirrors the early‑days approach of Cylance and CrowdStrike, which used small models for endpoint detection.
Open‑sourcing the weights was also a smart move. The security industry distrusts black boxes—both clients and regulators need the ability to audit model behavior. Open weights mean enterprises can fine‑tune internally and red teams can test reliability boundaries. By contrast, using external API‑based LLMs for security reviews would fail compliance checks right out of the gate.
Worth watching—but keep expectations in check
That said, Antares isn’t a silver bullet. A 22.4% recall rate means nearly 80% of vulnerable files still go undetected. The rest must be found by humans and other tools. Moreover, Cisco’s report shows the model performs significantly worse on multi‑language and very large monorepos—once codebases exceed a certain size, its search strategy breaks down.
For developers and security engineers, the realistic approach would be:
- Integrate Antares into the CVE‑subscription pipeline as an initial filter for affected files
- Cross‑validate with SBOM data to narrow down the manual review scope
- Don’t expect it to replace SAST or full code audits
It’s worth keeping an eye on the 3B version. Tripling the parameters—if it can push the benchmark past 30%—would make the model substantially more practical. But if the score only rises from 22.4% to, say, 24%, it may mean this approach is nearing its ceiling, limited more by training data and task definition than by model size.
The models are already live on Hugging Face. Anyone interested can download and run them directly—using transformers or vLLM works fine. Even the 350M version barely uses 8 GB of VRAM, making local experimentation practically effortless.
