Antares: Open-Weight SLMs Find CVE Files

Cisco Foundation AI introduces two open-weight Security-SLMs, tackling a tight, costly task: Vulnerability Localization. From advisory and codebase, they aim to identify the likely source files-locally, small enough for your own GPU setup and measurable against a new 500-Task-Benchmark.

Key Takeaways

Related:Hugging Face hacked: The entry was a dataset loader  /  NGINX vulnerability: Ingress and gateway under patch pressure

Why Localization Is the Expensive Part

The advisory is out, the CVE is clear – and then the costly work begins: Finding the files in a foreign or grown repository where the vulnerability lies. Analysts navigate naming conventions, call‑paths and candidate lists. Static analysis helps, but often produces noise. General‑purpose coding models can read code, but they are not optimized for security triage or terminal navigation in large code trees.

Antares precisely addresses this middle ground. Cisco describes the models as security SLMs that iterate like a human investigator: starting from a vulnerability description, searching, reading files, switching strategies, backing up, narrowing down. The result is a ranked list of likely source files plus an exploration trace. This is material for the reviewer and remains deliberately under expert control.

For cloud and platform teams, this is the difference between “we have an LLM in the chat” and “we have a gate in the pipeline that shortens the costly first hour of triage.” Localization sits before the patch. Whoever saves time and tokens here can scale advisory waves and agent‑generated code more effectively.

Antares-350M and 1B: Small, Specialized, Measurable

Live are two open-weight models: Antares-350M and Antares-1B, licensed under Apache 2.0 on Hugging Face. Antares-3B is announced. The base is IBM Granite 4.0 with a two-stage training pipeline. The Model Card for Antares-1B cites File F1 0.209 on the Vulnerability Localization Benchmark and lists comparisons with much larger systems – including GLM-5.2, Gemini 3 Pro, GPT-5 Mini and Qwen3.5-122B. The full 500-Task sweep runs in the evaluation setup in about 13 minutes on an H100 with 16 parallel workers.

Industry reports dissect the cost side: Help Net Security and SecurityWeek cite order‑of‑magnitude savings of up to 172× cheaper than GPT-5.5 and roughly 15× cheaper than GLM-5.2 on the same benchmark. Cisco itself stresses in its blog “fraction of the cost” and shows in Figure 2 markedly lower estimated costs and runtimes. For editorial framing the direction is clear – a specialized SLM beats a frontier all‑rounder on this single task. Always verify multipliers against the Model Card and paper before they enter the budget deck.

Amin Karbasi, VP and Chief AI Scientist at Cisco Foundation AI, frames the release thus: The security community needs accessible building blocks for repository‑level defense. That’s exactly why it’s open‑weight and small enough for local inference.

VLoc Bench: why SWE-Bench isn’t enough here

Cisco didn’t build the benchmark out of mere marketing enthusiasm. General coding benchmarks such as SWE-Bench (Software Engineering Benchmark) measure issue resolution and patch finding-not whether an agent, using a Common Weakness Enumeration (CWE) description or advisory, identifies vulnerable files. CodeScout gets closer (terminal agents, code search), but it targets software‑engineering tasks rather than security localization.

VLoc Bench demands both simultaneous navigation through foreign repositories and detection of vulnerability patterns for specific Common Weakness Enumeration (CWE) categories. 500 tasks, agentic. This is the benchmark against which Cisco Antares pits itself against larger closed‑ and open‑weight models-and the lever that enables teams to compare their own harnesses.

Practically, this means for Application Security (AppSec) and Platform Engineering: when you introduce Antares or a competitor, you measure localization quality and cost per advisory-not chat Elo. Without this intersection, “AI in security tooling” remains just a demo slide.

Running locally: Data residency as a feature

The cloud angle isn’t a cliché here. Many security teams aren’t permitted to ship proprietary code to external inference APIs. Compact open‑weight models that run on‑prem or within their own VPC shift the release dynamics: advisory triage and CI checks stay behind the organization’s trust boundary.

Cisco explicitly targets Antares at universities, public‑sector bodies and smaller teams that can’t afford frontier token budgets. Voices from academia in the blog (NUS, Stanford) stress the same point: security shouldn’t be a luxury good and small models are fast enough to gate agent output before merging.

Boundaries stay strict: Antares doesn’t replace dependency scanning or secret detection, DAST, container checks or threat modeling. It narrows the costly file‑search. The human and the rest of the toolchain remain in the loop – that’s how Cisco describes it.

What Cloud and Platform Teams Should Verify Now

If you take Antares seriously, you build a measurable slot in the pipeline:

• Use-Case trimming: Only Localization (Advisory → File-Rank). No mixing of expectations with auto-remediation.
• Deployment location: On-prem / private GPU vs. Managed Endpoint. Compliance and code residency take precedence over accuracy debates.
• CI gate design: For high-severity advisory files ranked, use them as a review queue, store traces, enforce human-in-the-loop.
• Internal benchmark: 20-50 of our own historical CVEs as a gold set. File F1 and time/cost against status quo (manual + SAST).
• Supply chain of weights: Verify HF (Hugging Face) models (signatures, hashes, internal mirrors). The HF (Hugging Face) dataset loader incident shows: pipeline inputs are an attack surface.

Similarly, it pays to look at Cisco’s broader package: Foundry Security Spec (Harness and Guardrails for agentic Security), CodeGuard (Secure-Coding rules for coding agents) and the open VLoc-Benchmark. Antares is the Localization building block – not the whole lock.

Frequently Asked Questions

Image source: AI-generated (July 2026)