What does Cisco Antares actually do?

Cisco Antares takes a vulnerability description (a CWE category, no file hints) and a source repository, then acts as a terminal agent that runs commands like grep and find to pick out the files most likely to contain the flaw. Antares is limited to 15 terminal commands per task and returns a ranked list of suspect files.

Is Antares open source and free to run locally?

Yes. Cisco Foundation AI released Antares-350M and Antares-1B under Apache-2.0 on Hugging Face, alongside the VLoc Bench evaluation set. The two published models are small enough to run on local hardware, so security teams can triage private code without sending source to a cloud API.

How does Antares compare to frontier models like GPT-5?

On Cisco's VLoc Bench, Antares-1B posts a File F1 of 0.209, ahead of much larger closed models tested in the same evaluation, including GLM-5.2 (753B), GPT-5 Mini, and Qwen3.5-122B. Antares runs the full 500-task benchmark in about 11 minutes on a single H100 GPU.

VLoc Bench is the 500-task, Apache-2.0 evaluation Cisco shipped alongside Antares. Cisco built it from real GitHub Security Advisories across six package ecosystems (npm, pip, Maven, Go, Rust, Composer), covering 147 unique CWE categories with 78% of entries linked to public CVEs.

Cisco Foundation AI · 2026-07-21 · major

Cisco Antares — 350M and 1B open-weight models that hunt code vulnerabilities

Cisco Foundation AI released Antares, a family of small language models built to locate known vulnerabilities inside real code repositories, plus a 500-task benchmark called VLoc Bench.

Small on-prem models that read a CWE, walk your repo, and tell you which files the vulnerability is hiding in.

Key specs

Antares 1 b params	1B
Antares 350 m params	350M
Vloc bench tasks	500

Quick facts

Maker	Cisco Foundation AI
Models	Antares-350M, Antares-1B (Antares-3B soon)
License	Apache-2.0 (weights and benchmark)
Backbone	IBM Granite 4.0
Benchmark	VLoc Bench — 500 tasks, 290 repos, 147 CWE categories
Availability	Hugging Face (fdtn-ai/antares-1b, fdtn-ai/antares-350m)

What is it?

Cisco Antares is a family of specialist small language models — 350M and 1B parameters, with a 3B version promised — built for one job: pointing a security engineer to the exact files in a code repository that contain a known vulnerability. Cisco Foundation AI released the weights under Apache-2.0 on Hugging Face on July 21, 2026, alongside a 500-task evaluation called VLoc Bench.

How does it work?

Each Antares model is post-trained on top of IBM Granite 4.0 with supervised fine-tuning on cybersecurity reasoning, followed by Group Relative Policy Optimization on real vulnerable-repository snapshots. At inference the model runs as a terminal agent: it reads only the CWE description, then issues up to 15 shell commands (grep, find, cat) to explore the repo and narrow down the suspect files.

Why does it matter?

Antares makes 'where is the bug' a job a 1B model can do on a laptop instead of a call to a frontier API — Cisco reports Antares-1B ahead of GLM-5.2 (753B), GPT-5 Mini, and Qwen3.5-122B on VLoc Bench. That is important for security teams who cannot ship proprietary source code to a third-party model provider.

Who is it for?

security engineers, appsec teams, and researchers benchmarking agentic code search

Frequently asked questions

What does Cisco Antares actually do?: Cisco Antares takes a vulnerability description (a CWE category, no file hints) and a source repository, then acts as a terminal agent that runs commands like grep and find to pick out the files most likely to contain the flaw. Antares is limited to 15 terminal commands per task and returns a ranked list of suspect files.
Is Antares open source and free to run locally?: Yes. Cisco Foundation AI released Antares-350M and Antares-1B under Apache-2.0 on Hugging Face, alongside the VLoc Bench evaluation set. The two published models are small enough to run on local hardware, so security teams can triage private code without sending source to a cloud API.
How does Antares compare to frontier models like GPT-5?: On Cisco's VLoc Bench, Antares-1B posts a File F1 of 0.209, ahead of much larger closed models tested in the same evaluation, including GLM-5.2 (753B), GPT-5 Mini, and Qwen3.5-122B. Antares runs the full 500-task benchmark in about 11 minutes on a single H100 GPU.
What is VLoc Bench?: VLoc Bench is the 500-task, Apache-2.0 evaluation Cisco shipped alongside Antares. Cisco built it from real GitHub Security Advisories across six package ecosystems (npm, pip, Maven, Go, Rust, Composer), covering 147 unique CWE categories with 78% of entries linked to public CVEs.

Try it

huggingface.co/fdtn-ai/antares-1b