Antares-350M

Antares-350M is the smaller of the two vulnerability-localization models Cisco Foundation AI published on 21 July 2026 under Apache 2.0, and it is the one that makes the argument. On Cisco's 500-task VLoc Bench it reaches a file-level F1 of 0.135 with precision 0.136 and recall 0.178 — ahead of Gemini 2.5 Flash (0.102), Gemma-4-31B (0.101), GPT-5 Mini (0.098) and Qwen3.5-122B-A10B (0.091). A third of a billion parameters outscoring frontier and 100-billion-class models is only possible because the task is narrow and the training is aimed squarely at it. The model is a terminal agent, not a chat assistant. Given a CWE description of a known vulnerability, it explores a mounted repository with shell commands — grep, find, cat — and returns the files it believes are affected, along with the trace of its search. Cisco trained it in two stages: supervised fine-tuning on cybersecurity reasoning, deep-research data and code-search trajectories, then GRPO reinforcement learning over complete agent trajectories with multi-component verifiable rewards. Underneath is an auto-regressive decoder-only transformer on IBM's Granite 4.0 350M backbone: 28 layers, hidden dimension 1024, 16 attention heads with 4 KV heads, SwiGLU, RMSNorm, RoPE, a 100,352-token vocabulary and a 32,000-token context window. Data cutoff is 10 April 2025. Cisco is unusually candid about the limits. The model struggles on repositories larger than 10 MB within its 15-command budget, it is good at pattern-matching vulnerability classes and weak on semantic ones, and it does not generate exploits or explanations. It is a triage instrument for shift-left security and CI/CD, meant to run sandboxed with a human reading its output — not a substitute for an application-security toolchain. The larger Antares-1B has its own profile; a 3B variant is announced but unreleased.

▸Videos

No videos yet.

▸Reviews