en.Wedoany.com Reported - Cisco's foundational AI team has released two open-weight security models, Antares-350M and Antares-1B, designed to identify known vulnerabilities in existing codebases. This move serves as a quiet response to the current AI model arms race, as Cisco believes that locating software vulnerabilities does not require large and expensive systems, nor should proprietary source code be sent to third-party AI providers for this purpose.
Both models are hosted on the Hugging Face platform for community use, but Cisco will approve access on a case-by-case basis. Cisco has retained a larger 3-billion-parameter model that has not been publicly released. These are not general-purpose chatbots, but AI agents specifically designed for vulnerability localization tasks. Starting from a vulnerability description, Antares searches and reads candidate files within the codebase; if a path yields no results, it automatically backtracks, ultimately returning a ranked list of files most likely to contain the defect. The model is named after the red supergiant star Antares, which is about 1,000 times the size of the Sun.
Cisco states that these small models significantly exceed expectations for their size. In its own benchmark of 500 vulnerability localization tests, Antares-1B outperformed Google's Gemini 3 Pro and matched Z.ai's GLM-5.2. The unreleased 3B-parameter model surpassed both GLM-5.2 and OpenAI's GPT-5.5. The core advantages lie in speed and cost: Chief AI Scientist Amin Karbasi told tech publication The Register that Antares processes 500 codebases in 15 minutes, while frontier models require 5 hours; the cost is under $1, compared to $100 to $150 for large systems.
The foundation for speed and cost lies in the training approach—the model is not designed for chat, but optimized for search. Due to its small size and flexibility, it can run multiple searches simultaneously and switch strategies when an attack path proves ineffective. Local deployment is another selling point. With open weights and a small footprint, enterprises can keep proprietary code on their own servers, avoiding uploads to cloud AI service providers. For regulated industries, retaining code internally offers significant value.
Cisco's restrictions on access are driven by security considerations. As Reza Shokri, a computer scientist at the National University of Singapore, noted, tools capable of finding vulnerabilities can also be used by attackers to exploit them, and AI agents are already capable of writing more code with greater exploitation capabilities. Cisco currently limits access to academic, non-profit, and small public sector security teams, while retaining its most powerful model. Its goal is to ensure that advanced AI defense does not become a luxury, especially as attackers are already deploying their own AI systems. Cisco believes the advantage in this contest no longer depends on model parameter size, but on who can actually use it.
