Cisco Antares and the Security Model That Knows Where to Look
Cisco's compact, open-weight models show why the next important security agent may not write or fix code. It may do one bounded job well: find the few files a human needs to inspect.
It is a strong localization assistant—not an autonomous proof that code is safe, a replacement for the AppSec toolchain, or a finished vulnerability-remediation system.
As code gets cheaper to produce, verification becomes the scarce resource.
Cisco Antares targets the part of vulnerability work that often comes before a fix: finding where a known weakness is actually implemented inside an unfamiliar repository.
AI coding agents can draft features, tests, infrastructure, and fixes at a pace that changes the economics of software development. Security review does not automatically accelerate with them. A vulnerability advisory may tell a team what class of weakness exists, but someone still has to connect that intelligence to the exact files, call paths, and implementation choices inside a real codebase.
On July 21, Cisco introduced Antares, a family of small language models purpose-built for that localization step. The 350-million- and 1-billion-parameter versions are available as open-weight models on Hugging Face. A 3-billion-parameter version was evaluated in Cisco's research and is described in the announcement as coming later, but it is not part of the current public model collection.
This is the right kind of specialization for security. Antares is not positioned as a general chatbot or a coding model that happens to know some CWE definitions. It is trained to operate as a terminal agent: interpret a weakness category, search a repository, inspect candidate files, change direction when evidence is weak, and submit a ranked set of likely vulnerable files for human review.
Apache 2.0 open weights, a 32K context window, and a resource-conscious tier for local vulnerability localization. Model card
The strongest publicly released Antares model, with the highest recall among the released Antares checkpoints. Model card
The most accurate Antares variant in the standard 15-call evaluation. Cisco says it is coming soon; it is not included in the current release. Announcement
Local deployment is not a footnote. Source code is among an organization's most sensitive intellectual property. A compact model can be brought inside the same trust boundary as the repository instead of requiring the repository to be sent to a third-party model endpoint. The released weights can be served locally; Cisco's CLI analyzes a read-only repository snapshot, connects to a user-configured OpenAI-compatible inference endpoint, and returns human-readable, JSON, or SARIF output. In the CLI design described in the report, repository inspection cannot modify the snapshot or access the network. Keeping source content fully local also requires hosting the configured inference endpoint inside the organization's environment.
The technical story is not just what the model knows. It is how the model searches.
Antares turns vulnerability localization into a constrained sequence of decisions rather than a single prompt over a giant code dump.
In the technical report, each agent receives a CWE identifier and its generic description, read-only access to a repository, and a budget of 15 terminal commands. It does not receive the security advisory, a suspicious filename, a severity score, a prebuilt vector index, or candidate locations from another scanner.
That operating constraint matters. Base Granite checkpoints produced near-zero File F1 in this environment. Supervised fine-tuning taught the models security reasoning, terminal interaction, and code-search trajectories. Group Relative Policy Optimization then rewarded complete multi-turn behaviors: localization quality, valid submission, compliant tool use, and evidence-gathering before the answer. Technical report, §8.5
The reinforcement-learning stage improved the 350M model by 25% relative to its supervised checkpoint and improved the 1B and 3B versions by approximately 11–13%. Cisco's analysis describes the learned pattern as search–verify–refine. That is more consequential than another prompt template. The model has been optimized for the interaction policy it will use at deployment time. Technical report, Table 6
Cisco changed the cost of asking the security question again.
Use the explorer to compare reported localization quality with the estimated cost or runtime of one complete 500-task VLoc Bench sweep.
The Antares efficiency frontier
Compare Antares with a wider field of models by scale, then switch to cost or runtime for the models with published operational estimates.
Antares-1B outscored the 753B-parameter GLM-5.2 on File F1 in this task.
Cisco estimates the 3B Antares sweep cost at $0.82 versus $141 for GPT-5.5.
The best score in the standard 15-call comparison was GPT-5.5 at 0.229; Antares-3B reached 0.223.
The benchmark is credible evidence of progress—not a claim of autonomous AppSec.
Cisco released VLoc Bench because general coding tests do not measure whether a model can navigate an unfamiliar repository from a bare security description.
VLoc Bench contains 500 tasks drawn from 290 real-world repositories across six package ecosystems and 147 CWE categories. In Phase A, every repository contains a known vulnerability. The model receives a generic CWE description and is scored against implementation files derived from the actual security patch.
localization tasks
unique repositories
CWE categories
defeated every model
Antares-1B reached 0.209 macro-averaged File F1, with 0.262 precision and 0.224 recall. That is an impressive result for a 1B model, and its recall was the highest among the released Antares checkpoints. For full context, an unreleased 3B supervised-fine-tuning ablation reached 0.228 recall, while the final 3B GRPO checkpoint reached 0.221. It is also important not to translate 0.209 into “20.9% accuracy.” File F1 is the harmonic mean of file-level precision and recall, calculated per task and then averaged. Antares-1B model card, full results table
The low absolute scores are part of the story. The top model in the standard harness reached only 0.229 File F1, and 190 of 500 tasks on the published VLoc Bench leaderboard were unsolved by every evaluated system. Antares makes a difficult first stage faster and more economical. It does not make vulnerability localization solved.
The score is not a fixed property of the weights. In a separate harness-sensitivity appendix, Cisco reports that prompt and loop optimization raised Antares-3B from 0.223 to 0.235 without changing the model, while a native Claude Opus 4.6 agent with unconstrained orchestration reached 0.284 at a reported total cost of approximately $1,658. Those runs use different protocols and do not belong in the standard-harness chart above; together they show that orchestration is a meaningful performance axis. Technical report, Appendix C.3
The ground truth also has a boundary: labels are derived from implementation files changed by the security patch, with tests, documentation, and configuration excluded. That creates a reproducible benchmark target, but patch-derived files are still a proxy rather than independent proof of every file that was causally necessary to the vulnerability. VLoc Bench methodology
Your repository is part of the security system.
Performance varied more by ecosystem and repository structure than by CVSS severity. Predictable, shallow paths were easier to search than distributed implementation hierarchies. Report, §8.2
Small repositories are a different problem.
Antares-1B reached 0.843 File F1 below 100 KB. Above 10 MB, GPT-5.5 variants overtook Antares, suggesting efficient search alone is not enough for broad architectural reasoning. Report, §8.3
A stopping rule is a capability.
GPT-5.5 improved only modestly from 15 to 30 commands, then declined 39% from its peak at 100. Over-exploration can dilute evidence and confidence. Report, Figure 9
The static-analysis comparison also deserves care. Broad Semgrep was the strongest static baseline in the report, but CodeQL abstained on more than 92% of tasks primarily because the extracted repository snapshots lacked the build environments needed to create databases. That result should not be used to claim that Antares replaces production SAST. Cisco itself positions Antares as an augmentation layer alongside dependency analysis, secret scanning, dynamic testing, threat modeling, remediation workflows, and expert review. Technical report, §A.3
Every coding agent may need a security counterpart.
The long-term opportunity is a writer-checker architecture: general models create, while focused models continuously challenge specific parts of the output.
The normal instinct is to ask one frontier model to write code, review itself, explain the risk, and produce the fix. That is operationally simple, but it can concentrate blind spots. A separate security model has a different objective: it does not need to preserve the author's intent or finish the feature. It needs to search for evidence that deserves review.
Plans, writes, and tests software.
Searches read-only code for likely files tied to a known CWE.
Combines SAST, SCA, secrets, tests, evidence, and judgment.
At Cisco's reported economics, localization can move from an occasional frontier-model investigation toward a repeatable pipeline step. The important phrase is pipeline step, not final verdict. Antares can help narrow the review surface on each commit, branch, dependency update, or advisory-driven investigation. A qualified security professional still owns the determination and the remediation decision.
There is a second architectural shift here: bring the model to the code. When weights, inference, and the repository all remain inside the organization's environment, teams gain more control over source-code exposure, retention, logging, and air-gapped operation. That makes compact security models particularly relevant to public sector, regulated industries, research institutions, and any company that treats its code as crown-jewel data.
Cisco is assembling more than a model. It is assembling a security loop.
Antares becomes more interesting when placed beside Cisco's other open contributions for preventing, finding, validating, and governing software risk.
Reusable secure-coding rules guide AI agents before, during, and after generation.
Explore CodeGuardCompact terminal agents narrow vulnerability intelligence to candidate implementation files.
Explore the modelsA model-agnostic blueprint defines roles, provenance, coverage, validation, and a defensible done signal.
Explore FoundryCodeGuard raises the floor by steering coding agents toward secure defaults. Antares addresses the expensive localization step. Foundry Security Spec defines the system around detection and validation so that findings are bounded, reviewable, and auditable. Cisco is connecting prevention knowledge, specialist models, open evaluation, and operational guardrails instead of treating “AI security” as one opaque product claim.
That is a compelling Cisco story. The durable advantage may not be owning one model at the top of one leaderboard. It may be giving defenders an open set of layers they can evaluate, run locally, integrate with existing tools, and improve as the underlying models change.
The strongest way to tell the Antares story is to keep the truth boundary visible.
Cisco's demonstrated results are meaningful. The intended workflow is promising. Several production questions still require evidence in each organization's environment.
What the release supports
- Strong File F1 and recall for compact models on VLoc Bench Phase A.
- Terminal-based localization from a generic CWE description.
- Read-only, network-disabled repository exploration.
- Fast, low-cost evaluation on Cisco's reported H100 setup.
- Open weights for 350M and 1B under Apache 2.0.
Where Cisco is taking it
- Advisory- and CWE-driven analyst triage.
- Local or air-gapped security workflows.
- CI/CD integration through JSON and SARIF.
- Augmentation of existing AppSec tools.
- Human-reviewed prioritization of candidate files.
What the benchmark does not prove
- Reliable discovery of unknown vulnerabilities without a supplied weakness category.
- Line-level cause, exploitability, or a validated explanation.
- Autonomous patch generation or safe remediation.
- False-alarm performance on patched code in the Antares report.
- Production performance on every large or proprietary repository.
“Open-weight” also deserves precision. The model weights are licensed under Apache 2.0, but Cisco's model card describes proprietary SFT and GRPO corpora, and the Hugging Face repositories currently require an access-request form that shares contact information with the repository authors; the form says requests are reviewed manually. The release improves deployment control and community access; it does not make the full training process independently reproducible.
Pilot Antares as a prioritization layer, then earn the right to automate more.
A useful first deployment measures whether the model makes analysts faster and more focused without weakening the controls already in place.
Use a CVE, GHSA, or CWE-driven investigation where the relevant weakness category is already available.
Mount a disposable repository snapshot read-only, disable network access, set resource limits, and retain the terminal trace.
Compare Antares with SAST, software composition analysis, secret scanning, tests, and expert review—not against a straw-man alternative.
Track time to first relevant file, candidate precision, missed implementation files, patched-code false alarms, and results by repository size.
Treat findings as review signals until the model is calibrated on the organization's languages, architecture, and clean-code baseline.
If Cisco can make vulnerability localization cheap enough, fast enough, and private enough to run continuously, the model becomes a new layer between vulnerability intelligence and human judgment. That is a narrower claim than autonomous security—and a much more useful one.
Source Trail View the Primary Evidence and Editorial Boundaries Cisco's measured claims, intended uses, and author interpretation are kept distinct throughout the brief.
Cisco Antares Announcement
Primary release source for the model family, public availability, intended role, local-deployment case, and connection to Cisco's broader open security work.
Antares Technical Report
Primary source for architecture, training, evaluation protocol, performance, cost, runtime, repository-size analysis, tool-budget and harness-sensitivity analysis, limitations, and safety guidance.
VLoc Bench
Primary benchmark source for the two-phase design, 500 tasks, 290 repositories, 147 CWE categories, dataset construction, public harness, and leaderboard.
Antares Model Cards
Primary deployment and governance source for intended and out-of-scope uses, training-data status, access conditions, licensing, inference guidance, and known limitations. Access conditions checked July 22, 2026.
Foundry Security Spec
Cisco's model-agnostic blueprint for agentic security evaluation, including defined roles, validation, provenance, coverage, guardrails, and stopping conditions.
Project CodeGuard
Cisco's secure-by-default rule framework for guiding AI coding agents before, during, and after code generation.
Interpretation Boundary
The security-sidecar architecture, machine-defensibility argument, and recommended pilot scorecard are author analysis grounded in Cisco's reported results. They are not Cisco product commitments.
React or leave a comment.
Where would a local security model create the most leverage in your software workflow?