Finding security vulnerabilities in a large software project has always been one of the toughest jobs for developers and security teams.
Modern applications often contain millions of lines of code spread across hundreds of files, making it difficult to identify where a newly disclosed vulnerability actually exists.
Cisco hopes to simplify that process with Antares, a new family of open-weight AI models built specifically for vulnerability localization.
Released on Hugging Face, Antares-350M and Antares-1B are lightweight security-focused AI models designed to help developers quickly identify vulnerable files without relying on expensive cloud infrastructure or sending proprietary code outside their organization.
Instead of acting as a general-purpose coding assistant, Antares focuses on one task: helping security teams locate potential weaknesses faster and more accurately.
AI Built Specifically for Security Teams
Most security teams today rely on static analysis tools, vulnerability scanners, and manual code reviews. While these methods remain essential, they often generate thousands of alerts, many of which turn out to be false positives. Investigating each alert can consume valuable engineering time.
Antares approaches the problem differently. Instead of matching simple patterns, it behaves more like an experienced security researcher investigating a codebase.
Developers can provide a vulnerability description, CVE report, or security advisory, and the model begins exploring the repository using common terminal commands. It searches for related functions, analyzes source files, follows code paths, and continuously adjusts its investigation as it gathers more evidence.
If a particular search path doesn’t produce useful results, Antares can abandon that direction and try another approach rather than continuing with incorrect assumptions. This adaptive reasoning allows it to narrow down the most likely files containing the vulnerability.
Rather than returning vague suggestions, the model produces a ranked list of files that deserve immediate attention.
It also records every command and search step it performed, giving developers complete visibility into how the conclusion was reached. That transparency is particularly valuable in security workflows, where engineers need to verify AI-generated recommendations before making production changes.
Because the models are relatively small, organizations can run them entirely on local hardware, helping protect sensitive source code while reducing infrastructure costs.
Why Smaller AI Models Could Change Secure Development
Large language models have become increasingly capable at programming tasks, but their size often creates practical challenges. Running frontier AI models requires expensive GPUs, higher inference costs, and in many cases, uploading proprietary code to external cloud services.
For industries such as banking, healthcare, government, and defense, that simply isn’t an option due to strict compliance and data privacy requirements.
Cisco’s decision to build compact security-focused models addresses those concerns directly. By optimizing Antares for vulnerability localization instead of general programming, the company delivers faster inference while keeping hardware requirements relatively modest.
To evaluate performance, Cisco introduced the Vulnerability Localization Benchmark, a testing framework consisting of 500 security tasks that measure how effectively an AI model can navigate unfamiliar repositories and identify vulnerable files associated with Common Weakness Enumeration (CWE) categories.
According to Cisco, Antares achieves performance close to much larger AI models while using significantly fewer computing resources.
That makes continuous security scanning more accessible to startups, universities, open-source maintainers, and smaller engineering teams that may not have enterprise-scale AI budgets.
Antares is not intended to replace traditional application security tools. Organizations will still need dependency scanning, software composition analysis, dynamic testing, secret detection, penetration testing, and human code review.
\Instead, the AI acts as an intelligent assistant that dramatically reduces the time required to identify where developers should begin investigating.
As software projects continue growing in size and complexity, finding vulnerabilities quickly has become just as important as fixing them.
With Antares, Cisco is betting that specialized, open-weight AI models can make secure software development faster, more transparent, and far more practical for organizations that need local-first security solutions.
Source: Official Cisco Blogs, "Introducing Antares: The Most Efficient Open Weight AI Models for Vulnerability Localization"
