Cisco Foundation AI Releases Antares: 350M and 1B Open-Weight Models That Localize Known Vulnerabilities Inside Real Codebases

Cisco's Foundation AI team has a habit of picking one unglamorous problem and building something small and sharp for it. This time the target is vulnerability localization: given a description of a known flaw and a real repository, figure out which files actually contain it. That sounds trivial until you've spent an afternoon grepping through someone else's dependency-heavy codebase trying to match a CWE advisory to actual source lines. Cisco calls this the expensive triage step that eats developer time before any real remediation work starts, and it built a family of models called Antares specifically to shrink it.

Two of the three models are out now on Hugging Face under Apache 2.0: Antares-350M and Antares-1B, both built on IBM's Granite 4.0 checkpoints with the usual modern plumbing — grouped-query attention, SwiGLU, RoPE, RMSNorm. A 3B version exists but hasn't been released. Cisco also published VLoc Bench, a 500-task benchmark pulled from 290 real GitHub repositories across npm, pip, Maven, Go, Rust, and Composer, covering 147 CWE categories with 78% of entries tied to actual CVEs. Ground truth comes straight from the files touched in the real security patch, which is a clean way to avoid hand-labeled guesswork.

What makes the release interesting isn't a leaderboard-topping score — it's the gap between model size and performance. Antares-1B, at roughly 1.6 billion parameters, hits a File F1 of 0.209 running inside a sandboxed agent loop with 15 read-only terminal commands and no advisory text, just a bare CWE description. GPT-5.5 scores 0.229 on the same task. A 753B-parameter open-weight model only manages 0.186. That's a two-order-of-magnitude size difference producing a result within striking distance of, and in one case behind, a model 500 times larger.

The evaluation setup itself deserves a mention because it's stricter than most benchmark theater. The model works inside a networkless Docker sandbox, output per command is capped at 2,000 characters, and it has to actively decide to submit a ranked list of files or declare no vulnerability at all. VLoc Bench even runs a second phase on the patched version of the same repo to check whether the model cries wolf on code that's already been fixed. Cisco is upfront that Antares isn't a replacement for dependency scanners, secret detection, or dynamic testing — it's meant to sit ahead of that stack, doing the unglamorous job of pointing a human or another tool at the right files faster.