Cisco's Antares Models Bring Local AI to Vulnerability Triage

Cisco has released two open-weight models, Antares-350M and Antares-1B, designed to help security teams narrow down vulnerable code searches. These models can run locally, allowing organizations to examine proprietary code without sending it to an outside AI service.

The models use commands such as grep, find, and cat to inspect a read-only repository copy and identify files that may contain a weakness. They return candidate files in human-readable, JSON, or SARIF format for use in existing review workflows.

Cisco evaluated Antares on VLoc Bench, a benchmark it created from 500 tasks involving 290 repositories, six software ecosystems, and 147 CWE categories. Antares-1B recorded a File F1 score of 0.209, while the unreleased Antares-3B reached 0.223, close to the leading GPT-5.5 configuration at 0.229.

The models have some limitations, as performance fell as repositories grew, and vulnerabilities spanning at least five files were more difficult under the benchmark's 15-command limit. Cisco recommends a pilot to measure false negatives, irrelevant file suggestions, analyst time saved, and performance across the organization's own languages and repository structures.