Cisco releases Antares AI models for vulnerability detection

Antares does not scan code the way a linter does. Cisco trained the models to behave like a security investigator: they search a repository for patterns tied to a vulnerability description, read the files that look promising, and change strategy when a lead doesn't pan out, narrowing in on the files most likely to contain the flaw before returning a ranked list with the exploration trail that produced it^[1]. That agentic search style is a large part of why Antares beats tools built specifically for this job - Antares-1B's recall of 0.224 dwarfs Semgrep's 0.086, CodeQL's 0.023, and Horusec's 0.020 on the same benchmark^[2].

The scale story is just as striking. On the 500-task Vulnerability Localization Benchmark, the 1-billion-parameter Antares-1B posts a File F1 score of 0.209, ahead of Z.ai's 753-billion-parameter GLM-5.2 at 0.186 - a model roughly 750 times its size^[3]. Under the hood, Antares-1B is a fairly conventional transformer built on IBM Granite 4.0: 40 layers, 2048 hidden dimensions, grouped-query attention with 16 query heads and 4 key/value heads, and a 128K context window^[3]. None of that is exotic - the gains come from training the model narrowly for one job instead of asking a general-purpose model to do it as a side task.

The headline number is cost. Antares-1B completes the entire 500-task benchmark in roughly 13 to 15 minutes on a single H100 GPU running 16 parallel workers, for under $1 - GPT-5.5 needs about five hours and more than $100 to do the same run^[3][4]. Put in per-evaluation terms, Antares works out to roughly 172 times cheaper than GPT-5.5 (about $141 per evaluation) and about 15 times cheaper than GLM-5.2 (about $12.50 per evaluation)^[5].

That gap is the actual pitch. Cisco is explicit that the intended beneficiaries are not just its own enterprise customers but universities, public-sector institutions, nonprofits, and smaller security teams that could never justify a frontier-model budget for continuous code scanning^[6]. Because Antares runs locally, proprietary source code also never has to leave the organization's own machine, folding a data-sovereignty argument into the cost argument - cheap and private turn out to be the same design choice, not two separate features.

Antares-350M and Antares-1B are published under the Apache 2.0 license, but actually downloading the weights from Hugging Face requires going through a request process, and Cisco restricts approval to users it verifies as cyber defenders^[4][7]. That is a meaningful qualifier on a release Cisco is otherwise marketing as democratizing security AI: the license says anyone can use and modify the models, but the gate says Cisco decides who gets to try first.

The company is also withholding Antares-3B entirely. Rather than publishing the largest model in the family the way it did the smaller two, Cisco plans to fold Antares-3B into its own commercial security products^[4]. Taken together, the gating and the held-back flagship model suggest Cisco is treating open weights as a controlled distribution channel rather than an unconditional release - a middle path between fully closed frontier labs and a no-strings-attached open release.

Cisco is unusually candid about where Antares breaks down. The model struggles with repositories larger than 10MB, with semantic vulnerabilities that require understanding program behavior rather than pattern-matching, and with anything introduced after its training cutoff of April 10, 2025^[3]. Cisco's own documentation states that human oversight and sandbox isolation are mandatory for any deployment, and positions Antares as a complement to existing tools like Semgrep and CodeQL rather than a replacement for them^[3].

That caution extends to how the agent should be run at all. Cisco and outside commentators recommend that any AI agent exploring a codebase operate with read-only access, no network connectivity, strict path restrictions, and complete audit logging^[2]- a reminder that letting a model run shell commands against a live repository, even a small and cheap one, is still an agentic-execution risk that needs its own guardrails, separate from whether the model's vulnerability calls are accurate.