Cisco open sourced two small AI models that find which file has the bug
Antares-350M and Antares-1B localize known vulnerabilities to a specific file by searching a codebase the way a person would. Cisco claims it's far cheaper than GPT-5.5 on its own benchmark.
Cisco's new open models find which file in your codebase has a known vulnerability, cheaply.
Cisco released two open weight models, Antares-350M and Antares-1B, on Hugging Face on July 21. They do one specific job: given a known vulnerability, find which file in a codebase it lives in.
How it actually works
Antares does not scan for novel vulnerabilities. It takes an existing CVE, CWE, or advisory description and runs an iterative, agent-like search: read the description, look for matching code patterns, open candidate files, weigh the evidence, change direction if a lead does not pan out, and converge on a ranked list of likely files. On Cisco's own 500-task benchmark, that took about an hour and under a dollar, against roughly 4.5 hours and $141 for GPT-5.5, a cost claim that is Cisco's own number, not independently verified.
Why local matters here
The pitch, per Cisco's Amin Karbasi, is that security teams without frontier-model budgets or the appetite to send source code to a third party API can run this locally instead. Cisco says it involved US government agencies in reviewing the release before shipping it, itself a sign of how seriously the dual use risk of a vulnerability-finding model is being taken industry-wide. A larger Antares-3B is planned next.
Why a build studio cares
Vulnerability localization is a genuinely useful, narrow task, and a small model that runs locally without shipping a client's codebase to an external API is the right shape of tool for security work under most compliance regimes. Worth testing against a real codebase before trusting Cisco's own benchmark numbers, but the local-first design is the part that matters regardless of the exact multiplier.
Next step: see Cisco's announcement and the models on Hugging Face. If local, privacy preserving AI tooling is a fit for a security workflow you're building, write to us at hello@gattyworks.com.