Cisco Foundation AI Releases Antares: 350M and 1B Open Weight Models Reveal Known Vulnerabilities Inside Real Codes

Cisco Foundation AI released Antaresa family of security small language models (SLMs) designed for one small security task. The task is to localize vulnerability. Given a description of the vulnerability and the cache, find the files that contain the bug.

Two open-air models are also available now at Hugging Face, Antares-350M and Antares-1B. Both are Apache 2.0. The Cisco team also submitted the Vulnerability Localization Benchmark (VLoc Benchmark), a 500-job agent test, under the same license.

The main result is not a new state of the art. It is because the 1B model reaches 0.209 File F1. GPT-5.5 reaches 0.229, and the open weight model 753B reaches 0.186.

The problem Antares is addressing

Software security depends on connecting external vulnerability information to internal source code. That information resides in community databases, advisories, and general vulnerability counts. The code resides in large repositories, modules, and is rich in dependencies.

Connecting the two is expensive. Devs search for unknown code, follow naming conventions, test call methods, and compare candidate files. Cisco’s framework is that this first decision step is where costs are concentrated.

Antares does not replace the security chain of the application. Cisco is clear about this. Dev teams still need dependency scanning, privacy scanning, dynamic testing, container testing, threat modeling, and expert reviews.

Understanding Models

Antares contains only three decoder-transformers in parameters 350M, 1B, and 3B. All three are starting from the IBM Granite 4.0 benchmarks. They share tokens and structures: clustered query attention, SwiGLU MLPs, RMSNorm, RoPE, and shared input/output embedding.

How Agent Loop works

Antares is not tested as a standalone sequence model. It runs inside a loop bound by three tools.

The model derives the definition of the CWE category and nothing else. No advisory text, no file plans, no difficulty information. It then issues read-only commands against a closed network Docker sandbox. The output command is truncated to 2,000 characters before inserting the transcript.

The budget is 15 calls per job. The model ends with a call submit_vulnerable_files with a standard list, or submit_no_vulnerability_found. The delivery itself does not count against the budget.

The output is a limited list of file paths and the test trace it produced.

What are the VLoc Bench measurements

VLoc Bench pulls 500 jobs from 290 unique real-world databases. Sources are public GitHub Security Advisories for all six ecosystems: npm, pip, Maven, Go, Rust, and Composer. It includes 147 unique CWE categories, and 78% of entries carry assigned CVE identifiers.

The basic fact is derived from the safety episode. The files have been changed to fix labels, tests, documentation, and settings have been removed.

The benchmark has two stages:

• Section A provides a summary of the risk model and results File F1.
• Section B provides a detailed summary and results True Negative Rating, checking whether the model raises a false alarm in the embedded code.

Results: task-specific training exceeds the parameter scale

The pattern in the data is a power curve, not a scaling curve.

Antares-3B reaches 0.223 File F1, just below GPT-5.5 (xhigh) at 0.229. Antares-1B reaches 0.209, more than GLM-5.2 for 753B parameters, making a score of 0.186. Antares-350M reaches 0.135, above Gemma-4-31B at 0.101 and Gemini 2.5 Flash at 0.102.

Antares-1B also records the highest recall of any system tested at 0.224.

Rigorous analytical tools were used under the same test. Semgrep scores 0.086 File F1, CodeQL scores 0.023, and Horusec scores 0.020. Cisco’s learning is that rule-based scanners find some vulnerable files but cannot dynamically check the cache context.

Where skill comes from

The untrained Granite 4.0 baseline checkpoints have results of 0.001, 0.000, and 0.000 for file F1 under the same protocol. They have the ability to call tools and still produce corrupted output within the agent loop.

The supervised configuration does the heavy lifting. It raises three scales to 0.108, 0.188, and 0.198. The SFT corpus is 71.5% cybersecurity thinking, 15.4% code search methods, and 13.1% critical research and general thinking. All the thinking traces come from one teacher, GPT-OSS-120B, to avoid changing the distribution of teachers.

GRPO then adds 11% to 25%, with the largest relative profit at 350M. Rewards are determined and calculated systematically from the trajectory script, without a learned reward model. Components include localization quality, deployment behavior, tool compliance, testing, and penalties for incorrect results.

The difference effect may be more important than stated. GRPO reduces the run-to-run standard deviation by 42% to 65%. A single GRPO test run is a more reliable measure than a single SFT run.

There is also a scale-dependent classification of learned techniques. After GRPO, the 350M and 1B models run 87% to 89% more search commands and send more files. Model 3B sits at 52% search and 37% read, and sends fewer files with higher accuracy. The award did not determine any policy.

Shipping

Key Takeaways

• Antares-1B scores 0.209 File F1 on VLoc Bench, more than GLM-5.2 on 753B parameters and Gemini 3 Pro.
• Granite 4.0 base test points get ~0.000 points under the same protocol, so after training it gives all the power.
• GRPO adds 11-25% to the F1 file and cuts run variation to 42-65%, which is very important for repeated CI scans.
• A complete sweep of 500 tasks costs less than $1 for a single H100, compared to $12.50 for GLM-5.2 and $141 for GPT-5.5.
• The most robust variant, Antares-3B, is not released, and Antares has no published Category B false alarm numbers.

Check it out Models in Hugging Face, Benchmark, GitHub Repo and Technical Report mentioned.