Cisco launches Antares AI models for code flaw pinpointing

Cisco has introduced Antares, a family of open-weight small language models designed to help security teams identify where known software vulnerabilities exist within source code repositories.

The company has released two models, Antares-350M and Antares-1B, as open-weight models through Hugging Face. Cisco said the models are designed to localise vulnerable code while remaining compact enough to run locally, allowing organisations to analyse proprietary source code without sending it to cloud-based services.

The release forms part of Cisco's broader AI security portfolio, alongside Foundry Security Spec, CodeGuard and a new Vulnerability Localization Benchmark intended to measure repository-level vulnerability detection.

Security focus

Cisco said vulnerability localisation remains one of the most time-consuming parts of software security because analysts must connect information from public vulnerability databases, advisories and Common Weakness Enumeration categories with large internal code repositories.

The company said investigators often need to examine unfamiliar codebases, inspect call paths, compare multiple files and determine whether a reported weakness is present.

Antares was developed specifically for this workflow rather than broader software development tasks.

Cisco said the models follow an iterative search process that begins with a vulnerability description before searching repositories, evaluating candidate files and refining results as additional evidence becomes available.

Instead of producing patches, the models generate a ranked list of source files that are likely to contain the relevant vulnerability together with the terminal exploration trace used to reach that conclusion.

Cisco said this output is intended to support analyst review during advisory investigations, Common Weakness Enumeration analysis and continuous integration and deployment security workflows.

The company said Antares complements existing application security tools rather than replacing software composition analysis, dynamic testing, secret scanning, infrastructure security checks or expert review.

Local deployment

Cisco said compact language models reduce computing costs while allowing organisations to keep sensitive source code inside their own environments.

The company said this approach could benefit universities, public sector organisations and smaller security teams that may lack access to larger AI infrastructure.

Antares has been designed for deployment in environments with strict privacy or regulatory requirements where source code cannot leave local infrastructure.

"Software has always shipped with vulnerabilities, and vast bodies of legacy code still carry latent flaws. AI now pushes on the problem from both sides: agents write more of the code, and are growing capable of exploiting it. That makes cheap, continuous verification a control that has to sit close to the loop, checking code before it lands. Small models are especially compelling here: they run locally, so proprietary code never leaves the machine, and they're fast enough to gate an agent's output in real time. Antares-1b is a good example: it recognizes vulnerabilities in code it is shown, across several weakness classes and languages. The provided CLI packages the model's capabilities into a practical workflow, making it easy to scan codebases, inspect findings, and integrate it into automated pipelines. What I found compelling was seeing a model this small navigate a codebase and identify security issues that would otherwise require larger models or more manual analysis," said Reza Shokri, Associate Professor of Computer Science, National University of Singapore.

Measuring results

Cisco also introduced the Vulnerability Localization Benchmark to evaluate AI models against repository-level security investigations.

The benchmark contains 500 tasks requiring models to navigate unfamiliar repositories and identify files associated with specific vulnerability categories.

Cisco said existing software engineering benchmarks primarily assess issue resolution or code search rather than vulnerability localisation from security advisories or Common Weakness Enumeration descriptions.

The company said the benchmark was developed to measure AI systems built specifically for security investigations.

Open ecosystem

Cisco said it chose to release Antares as an open-weight model to encourage broader adoption of AI-assisted security tools and support organisations with limited security resources.

The company said the release aligns with its wider effort to develop AI systems that can be evaluated, governed and deployed across enterprise security environments.

"Security can't be a luxury good, yet advanced AI-based detection has largely belonged to organizations with frontier-scale budgets. Antares's results change that equation: near-frontier accuracy on secure code reasoning at a fraction of the cost, fast enough to run on every commit. At a moment when attackers are already using AI, that kind of efficiency isn't a nice-to-have; it's what makes always-on security scanning possible for every team," said Amin Saberi, Professor of Management Science and Engineering and Director of Language, Data, and Reasoning Lab, Stanford University.