Cisco Releases Antares AI Models for Localized Vulnerability Detection

Cisco's Foundation AI team has released Antares, a family of compact, open-weight models designed to automate the localization of security vulnerabilities. By enabling agentic search within a codebase, these models allow security teams to identify vulnerable files using only a Common Weakness Enumeration (CWE) description and read-only repository access.

The Antares family consists of three sizes: 350 million, 1 billion, and 3 billion parameters. While the 3B version serves as the performance ceiling, Cisco has publicly released the 350M and 1B models under the Apache 2.0 license. According to Cisco's Vulnerability Localization Benchmark, the Antares-3B model achieved a File F1 score of 0.223, nearly matching the 0.229 score of the frontier model GPT-5.5.

The Shift to Specialized Security AI

This release marks a strategic pivot toward task-specific, compact models over general-purpose large language models (LLMs). Cisco is prioritizing on-premises execution to ensure that sensitive source code remains within a company's own infrastructure. As the Cisco Foundation AI team noted, a small model trained for a specific task can beat a giant general-purpose one while ensuring that source code never leaves the machine.

This effort is supported by the FAITH evaluation hub, a broader initiative to standardize how security AI is measured. The hub recently integrated CTI-Reasoning and CWE-Prediction benchmarks, which are designed to test a model's actual security reasoning capabilities rather than its ability to simply memorize known patterns from training data.

Implications for the Industry

The performance of Antares suggests a "capability cliff" rather than a linear scaling curve, proving that highly specialized small models can rival the output of massive cloud-based systems for narrow security tasks. For enterprises, this removes the primary tension between utilizing advanced AI and maintaining strict data privacy.

By integrating these models directly into CI/CD pipelines, organizations can implement high-performance vulnerability triage locally. This approach eliminates the need to transmit proprietary code to third-party API providers and significantly reduces the operational costs associated with frontier-model tokens.

Future Outlook

As the industry moves toward agentic security workflows, the focus will likely shift toward how these localization models integrate with automated patching tools. While the 350M and 1B models are already available for public use, the industry will be watching for further updates to the Antares family and the continued expansion of the FAITH benchmark suite to validate these gains across more diverse codebase architectures.