Cisco Releases Open-Weight LLMs to Accelerate Vulnerability Localization
Cisco has launched Antares, a family of open-weight large language models designed to significantly reduce the time and resources needed for security analysts to pinpoint vulnerabilities within codebases.
Cisco has introduced Antares, a new family of open-weight large language models (LLMs) specifically engineered to accelerate the critical process of vulnerability localization. This development aims to democratize advanced security tooling by making it more accessible and cost-effective for a wider range of organizations.
The core challenge Antares addresses is the time-consuming and expertise-intensive task of identifying the exact code locations where vulnerabilities reside within large and complex software projects. Security analysts often face the daunting prospect of sifting through thousands of files, deciphering unfamiliar naming conventions, and piecing together disparate clues from vulnerability advisories. Antares is designed to streamline this initial triage phase, significantly reducing the hours and specialized knowledge required.
Released as open-weight models on Hugging Face, Antares-350M and Antares-1B are compact enough to run on local or on-premises hardware. This feature is particularly beneficial for organizations that must maintain the confidentiality of their source code, as it eliminates the need to transmit sensitive data to cloud providers. Furthermore, running these models locally reduces operational costs per analysis job.
Cisco is targeting Antares towards universities, public sector institutions, research organizations, and smaller security teams. These entities often operate with tight budgets but are responsible for maintaining critical software. By offering powerful AI capabilities at a lower cost and with reduced infrastructure requirements, Cisco aims to level the playing field in application security.
The Antares models operate by mimicking a human investigator's approach. They begin with a vulnerability description, search for matching code patterns, analyze candidate files, incorporate new evidence, backtrack when necessary, and ultimately narrow down the search to the most likely files containing the vulnerability. The output is a ranked list of source files accompanied by the specific trace that led to that conclusion. This methodology is rooted in earlier Cisco research demonstrating that compact models can effectively learn search strategies, reflect on findings, and revise their approach.
Antares is positioned as one component within a broader application security toolchain. It complements existing tools for dependency analysis, secret scanning, dynamic testing, threat modeling, and expert review, rather than replacing them. Cisco developed a specific benchmark, the Vulnerability Localization Benchmark, comprising 500 entries focused on CWE-style security descriptions and advisories, to accurately measure the models' performance in this specialized task.
Performance benchmarks indicate that the Antares models achieve competitive results, even when compared to much larger, proprietary systems. On Cisco's benchmark, Antares-1B outperforms models like GLM-5.2 and Gemini 3 Pro, while the upcoming Antares-3B is expected to rival strong GPT-5.5 configurations. Crucially, the cost per evaluation for Antares is dramatically lower—approximately 172 times cheaper than GPT-5.5 and 15.2 times cheaper than GLM-5.2. This cost-efficiency extends to runtime, with Antares models completing tasks significantly faster.
The implications of Antares extend beyond mere efficiency. As Stanford University professor Amin Saberi noted, making advanced AI-based vulnerability detection affordable and accessible ensures that robust security practices are not a luxury. In an era where attackers are increasingly leveraging AI, tools like Antares are essential for enabling continuous, efficient security scanning for all teams, regardless of their budget.