Cisco Antares models localize vulnerability search with small local AI

Cisco's new Antares models target a slow step in application security: narrowing down where a known weakness might exist in a large codebase. Released July 21, 2026, the two open-weight models (350M and 1B parameters) run entirely locally, allowing enterprises to inspect proprietary code without sending it to a cloud AI service. They operate as terminal-based code-search agents, using commands like grep, find, and cat to examine a read-only repository copy given a CWE identifier. Antares-350M supports a 32,000-token context for constrained deployments, while Antares-1B has a 128,000-token window and fits on a single GPU. Cisco stresses that the models do not confirm vulnerabilities, assign severity, or generate fixes—their output is an advisory lead for human analysts.

Benchmark results reveal significant limitations. Cisco evaluated the models on VLoc Bench, a custom benchmark of 500 tasks across 290 repositories, six ecosystems, and 147 CWEs. Antares-1B achieved a File F1 score of 0.209, and an unreleased Antares-3B reached 0.223, close to GPT-5.5's top score of 0.229. Even the best-performing model stayed below 0.23, and 190 of the 500 tasks were unsolved by any model. Performance dropped as repository size grew, and vulnerabilities spanning multiple files proved harder under the 15-command limit. Cisco advises pilots to measure false negatives, false positives, and time saved before relying on Antares in production.