Skip to content
← All news
4 min read

Cisco open sourced two small AI models that find which file has the bug

Antares-350M and Antares-1B localize known vulnerabilities to a specific file by searching a codebase the way a person would. Cisco claims it's far cheaper than GPT-5.5 on its own benchmark.

Cisco's new open models find which file in your codebase has a known vulnerability, cheaply.

Cisco released two open weight models, Antares-350M and Antares-1B, on Hugging Face on July 21. They do one specific job: given a known vulnerability, find which file in a codebase it lives in.

How it actually works

Antares does not scan for novel vulnerabilities. It takes an existing CVE, CWE, or advisory description and runs an iterative, agent-like search: read the description, look for matching code patterns, open candidate files, weigh the evidence, change direction if a lead does not pan out, and converge on a ranked list of likely files. On Cisco's own 500-task benchmark, that took about an hour and under a dollar, against roughly 4.5 hours and $141 for GPT-5.5, a cost claim that is Cisco's own number, not independently verified.

Why local matters here

The pitch, per Cisco's Amin Karbasi, is that security teams without frontier-model budgets or the appetite to send source code to a third party API can run this locally instead. Cisco says it involved US government agencies in reviewing the release before shipping it, itself a sign of how seriously the dual use risk of a vulnerability-finding model is being taken industry-wide. A larger Antares-3B is planned next.

Why a build studio cares

Vulnerability localization is a genuinely useful, narrow task, and a small model that runs locally without shipping a client's codebase to an external API is the right shape of tool for security work under most compliance regimes. Worth testing against a real codebase before trusting Cisco's own benchmark numbers, but the local-first design is the part that matters regardless of the exact multiplier.

Next step: see Cisco's announcement and the models on Hugging Face. If local, privacy preserving AI tooling is a fit for a security workflow you're building, write to us at hello@gattyworks.com.

AISecurityOpen SourceCiscoAntaresOpenWeightAIVulnerabilityScanningAppSecCyberSecurityHuggingFaceDevSecOpsLocalAIOpenSourceAIforSecurity

Ready to know?

Send what you want checked or built. Fixed scope, price, and date in writing inside 24 hours, or the website or audit fee on your first project is refunded in full.

24 clock hours. Weekends included.