Cisco unveils 'Antares,' a small AI that identifies vulnerability locations, achieving GPT-5.5 level performance at a low cost.

Cisco has announced Antares , a suite of small language models specifically designed to narrow down files in source code that are likely to contain known vulnerabilities. Antares operates with fewer computing resources than large, general-purpose AI models and is designed to allow analysis within an organization's environment without sending sensitive source code to an external cloud.

Introducing Antares: Highly Efficient Open Weight AI Models for Vulnerability Localization - Cisco Blogs

Introducing Antares: @Cisco 's family of small language models for locating known vulnerabilities in code.

Antares-350M and Antares-1B are live on Hugging Face now. They can outperform many larger closed- and open-weight models at a fraction of the cost.

Small enough to run… pic.twitter.com/xbwlLKJLEL

— Cisco AI (@CiscoAI) July 21, 2026

Cisco launches Antares AI models to find software vulnerabilities
https://www.axios.com/2026/07/21/cisco-open-source-ai-models-cybersecurity

When investigating software vulnerabilities, security professionals need to use publicly available vulnerability information and security advisories as clues to find problematic files within a massive codebase. However, the code that leads to a vulnerability may only consist of a few lines out of millions of lines of code, and tracing the relevant files and processing flow requires a great deal of time and expertise.

Antares, developed by Cisco, is a small-scale language model specifically designed for the task of narrowing down which files contain vulnerabilities. Unlike typical coding assistance AI, it searches the repository, reads candidate files, and changes its search strategy if no clues are found, in order to find files that are likely to contain vulnerabilities.

Today, @cisco launched Antares: a family of open-weight, small language models that pinpoint where known vulnerabilities exist within a codebase. Testing shows our Antares models outperform many open- and closed-weight models at critical security tasks — at a fraction of the…

— Chuck Robbins (@ChuckRobbins) July 21, 2026

Upon receiving a vulnerability description, Antares searches for related code patterns and uses the findings to determine the next areas for investigation. Ultimately, it ranks the source files most likely to contain the vulnerability and outputs a record of the search process that led to that conclusion.

Cisco has released Antares-350M and Antares-1B , models with 350 million and 1 billion parameters respectively, in open weight format. The model weights are provided via Hugging Face and can be downloaded by users who Cisco has confirmed are cyber defense users. According to the overseas news media Axios, the more powerful Antares-3B with 3 billion parameters will not be made publicly available and is planned to be incorporated into Cisco's security products.

Open-source is not the cause of the cybersecurity crisis, it's the solution! https://t.co/YpykmLGv7B pic.twitter.com/x9wuHs4kvv

— clem ???? (@ClementDelangue) July 21, 2026

To evaluate Antares, Cisco also developed the 'Vulnerability Localization Benchmark,' which consists of 500 challenges using real software repositories. This benchmark measures whether Antares can efficiently explore an unknown codebase, recognize the characteristics of vulnerabilities classified by CWE, and identify files that contain the problem.

According to Cisco, the Antares-3B/1B performed in the same benchmark close to that of much larger models, including OpenAI's GPT-5.5 and Z.ai's GLM-5.2 .

Furthermore, according to Cisco, in a test handling 500 issues from 290 real-world repositories, GPT-5.5 cost over $100 (over 16,300 yen) and took about 5 hours, while Antares completed the process in about 15 minutes for less than $1 (about 163 yen) for each model.

Because software needs to be re-examined every time it's updated, continuously using large-scale models can be costly and time-consuming. Cisco explains that the smaller Antares is suitable for integration into CI/CD pipelines that perform checks every time the code changes, or for real-time verification of code generated by AI coding agents.

Furthermore, because Antares can run in a local environment or on a server within an organization, there is no need to send confidential source code to external AI providers. This makes it easier to implement for universities, research institutions, non-profit organizations, public institutions, and small security teams that do not have the budget to continuously use large-scale cloud-based models.

However, Antares does not automatically fix vulnerabilities or replace all existing security measures. It is positioned as a support tool to narrow down the files that need to be checked in the early stages of an investigation, in combination with dependency analysis, sensitive information detection, dynamic testing, container and infrastructure inspection, and expert review.

Cisco explains that the goal of Antares is to make AI-powered security widely available as a practical, measurable, and manageable technology, rather than making it an expensive system only accessible to a select few large enterprises. The company says it aims to build a foundation for integrating AI into everyday security operations by combining open specifications, security knowledge, a compact and easy-to-deploy model, and common benchmarks.