Cisco Unveils Antares: Open-Weight AI for Cost-Effective Source Code Security
Cisco Foundation AI has launched Antares, a suite of open-weight small language models (SLMs) designed to efficiently and affordably detect known vulnerabilities within source code.
Cisco Foundation AI has introduced Antares, a new family of open-weight small language models (SLMs) specifically engineered to tackle the complex and resource-intensive task of identifying known vulnerabilities in software source code. Named after the brightest star in the constellation Scorpius, the Antares family currently consists of two models: Antares-350M and Antares-1B, both accessible on the Hugging Face platform.
These models are purpose-built to address a critical challenge in cybersecurity: the time-consuming and expensive process of locating specific vulnerabilities within a company's codebase. When a new vulnerability is discovered, security teams must meticulously scan their own code to determine if and where it exists, a task that is increasingly reliant on AI assistance.
Traditionally, organizations have faced a difficult choice between two primary AI approaches. The first involves subscribing to and utilizing large, closed-source frontier language models (LLMs). While these models can be powerful, their usage can quickly become prohibitively expensive due to the sheer volume of vulnerabilities they help discover and the cost per query. Furthermore, data sovereignty regulations can restrict their use in certain environments.
The alternative is to employ smaller, open-weight general language models (GLMs). These models offer greater control over the 'weights'—the core intelligence of the AI—allowing organizations to maintain data sovereignty and keep sensitive code within their own infrastructure. However, GLMs often suffer from a high rate of false positives, requiring significant manual effort to sift through inaccurate findings.
Antares aims to bridge this gap by offering an open-weight SLM solution that is specifically trained for vulnerability localization. This approach promises to deliver low false positives at a significantly lower cost than large LLMs, while also respecting data sovereignty concerns, thereby improving upon both existing GLM and large-scale LLM solutions.
Cisco has developed a novel processing methodology for Antares, which mimics the investigative approach of a human security analyst. The models are designed to start with a vulnerability description, search for relevant code patterns, read candidate files, incorporate new evidence, dynamically adjust their search direction, and ultimately narrow down to the files most likely to contain the vulnerability. This process is intended to assist, not replace, expert human judgment in the initial stages of source code vulnerability triage.
The Antares models are particularly targeted towards organizations with constrained security budgets, such as universities, research institutions, non-profits, and public-sector entities that maintain critical software. To validate its performance, Cisco has also released the Vulnerability Localization Benchmark, a new 500-entry dataset designed to test models' ability to navigate unfamiliar codebases and recognize specific Common Weakness Enumeration (CWE) patterns. In tests using this benchmark, Antares demonstrated superior cost-efficiency, being 172 times cheaper than a leading closed LLM and 15.2 times cheaper than a top open-weight GLM, while also completing its tasks faster.
Cisco emphasizes its commitment to fostering a more robust ecosystem for AI-assisted defense. Their strategy involves promoting open specifications, reusable security knowledge, compact deployable models, and standardized benchmarks to measure progress. The ultimate goal is to democratize AI-powered security, making advanced capabilities accessible to all security practitioners, regardless of their organizational resources or deployment preferences.