Cisco Foundation AI has released Antares, a pair of small, open-weight AI models built for one narrow but expensive job: finding exactly where a known vulnerability lives inside a company's codebase.
Two Small Models, One Specific Job
Named for the binary star system at the heart of Scorpius, the Antares family currently ships as two models, Antares-350M and Antares-1B, both available on Hugging Face. Cisco describes the target problem as one of the hardest and most expensive tasks in security: pinpointing whether and where a newly disclosed vulnerability actually exists in a company's own code.
Today, teams are stuck choosing between two flawed options. Subscribing to a frontier closed model gets expensive fast given how many vulnerabilities need checking, and it may be a nonstarter under data sovereignty rules. Downloading a general-purpose open-weight model keeps code in-house but tends to produce far more false positives, since it isn't built specifically for vulnerability localization.
How It Works
Antares is designed to mimic how a human investigator would work through an unfamiliar repository: starting from a vulnerability description, searching for matching code patterns, reading candidate files, adjusting course when a lead doesn't pan out, and narrowing down to the files most likely to contain the flaw. Cisco is explicit that the goal isn't replacing a human analyst's judgment, just handling the first pass of triage so a person isn't starting from zero.
The models are aimed squarely at organizations without frontier-scale security budgets: universities, research institutions, nonprofits, and public sector teams maintaining software with limited staff.
The Cost Numbers
To back the claim up, Cisco built a new 500-entry Vulnerability Localization Benchmark that tests whether a model can navigate an unfamiliar codebase efficiently while recognizing patterns tied to specific CWE vulnerability categories. Tested against OpenAI's GPT-5.5 and Z.ai's GLM-5.2, Cisco says Antares completed the benchmark faster and 172 times cheaper than the closed frontier model and 15.2 times cheaper than the open-weight alternative, while producing a ranked list of files likely to contain the flaw for a team to start triaging.
Stanford management science professor Amin Saberi, commenting on the release, argues that security has effectively been a luxury good reserved for organizations with frontier-scale budgets, and that always-on scanning on every commit only becomes realistic once detection gets this much cheaper.
Why This Matters Beyond Cisco
Cisco frames Antares as part of a broader push toward open specifications, reusable security knowledge, and benchmarks that make progress in AI-assisted defense measurable rather than marketing driven. Whether that ambition holds up depends on how Antares performs once independent teams outside Cisco's own benchmark start running it against messier, real-world codebases.
Either way, the release signals where the vulnerability triage market is heading: not one giant general-purpose model trying to do everything, but small, specialized models built to do one job well and cheaply enough that under-resourced teams can actually afford to run them continuously.