Antares by Cisco Foundation AI: Locally track vulnerabilities within codebases using compact, autonomous models.
Antares is a suite of small, open-weight language models developed by Cisco Foundation AI to address a precise security challenge: localizing known vulnerabilities within internal codebases. With Antares you input a vulnerability description—typically a Common Weakness Enumeration (CWE)—and the model performs autonomous, multi-step reasoning over your repository (via terminal-like access) to return files most likely to contain the issue. Compact models in this family make it feasible to run security workflows locally—avoiding cloud exposure—while offering benchmarks close to the largest, frontier-scale AI systems at significantly lower cost.
Antares is designed for teams and organizations with strong security needs but limited infrastructure or strict privacy requirements. The primary audiences include:
There is no subscription or licensing fee disclosed. Antares-350M and Antares-1B are available now as open-weight models under an Apache-2.0–compatible license. Users can access them via model repositories. In benchmarking, the evaluation of 500 vulnerability localization tasks with Antares-3B cost approximately 82 cents and took about 15 minutes on a single high-end GPU; smaller models incur lower inference costs. No pay-per-use fees or hosted API pricing are stated officially.
For decision-makers evaluating tools to improve code security workflows, Antares presents a compelling option in scenarios where source control, privacy, and cost are primary constraints. Its open-weight release of 350M and 1B models makes it accessible and transparent; organizations can inspect, self-host, and integrate without depending on external APIs. The performance metrics offer strong evidence that task-specific, compact models trained for vulnerability localization can rival much larger, generalist models for this specific task.
However, Antares does not aim to replace full security toolchains. It does not cover dependency scanning, dynamic testing, threat modeling, or remediation execution. Instead, it functions as a precision tool for initial vulnerability signal triage—helping teams focus analysts’ attention on code files most likely to contain issues. For many organizations—especially those constrained by compliance, privacy, or budget—such focused automation can make a meaningful difference.
Keep up to date with our stories on LinkedIn, Twitter, Facebook and Instagram.
