Cisco Foundation AI has released Antares, a family of open-weight small language models specifically designed for vulnerability localization—linking CVEs and CWE entries to specific files in a codebase. The models, available in 350M and 1B parameter variants on Hugging Face, represent a paradigm shift in how developers can secure their codebases without breaking the bank.
On Cisco’s internal benchmark of 500 entries, Antares scanned entire repositories in approximately one hour for under $1. By contrast, GPT-5.5 required roughly 4.5 hours and $141 for the same task. More remarkably, Antares outperformed about a dozen larger models in its narrow but critical task.
The security use case is compelling: organizations can now run vulnerability detection entirely on local infrastructure, keeping sensitive source code out of cloud AI services. This addresses a fundamental tension in application security—developers want AI-assisted scanning but cannot ship proprietary code to third-party APIs.
Both Antares variants run on commodity hardware, making them accessible to teams that lack enterprise security budgets. A 3B parameter version is coming soon, promising even higher accuracy for larger codebases.
The release arrives as AI-powered security tools face scrutiny for both false positives and missed vulnerabilities. By focusing on a narrow task—linking known CVEs to specific files—Antares trades generality for reliability. The model does not attempt to find novel vulnerabilities or suggest fixes; it simply answers: “Which file in this repo most likely contains the code related to CVE-XXXX-YYYY?”
For the open-source security ecosystem, Cisco’s move mirrors a broader trend: frontier models are too expensive for routine tasks, and specialized small models can deliver 90% of the value at 1% of the cost. As AI coding assistants become ubiquitous, having a lightweight vulnerability scanner in the development pipeline may become as standard as a linter.