Cisco's 1B-parameter bug hunter: Antares localizes vulnerabilities without your code ever leaving the building

Cisco's Foundation AI group has released Antares-350M and Antares-1B, two open-weight small language models built for a single security task, and published them on Hugging Face. The task is vulnerability localization: given a codebase and the description of a known flaw, find the files that actually contain it. It sounds narrow, and that is the point. Security teams triaging advisories spend much of their time answering exactly this question across repositories they did not write, and frontier models are an expensive instrument for it. What Antares does differently is work the problem the way a human investigator would rather than scanning against fixed rules — starting from the vulnerability description, searching for relevant code patterns, reading candidate files, folding new evidence back into the search and abandoning paths that lead nowhere. Cisco's claim is that a model shaped around that loop does not need to be large. The comparisons the company publishes are pointed. Antares-1B is said to outperform Google's Gemini 3 Pro on this task and to sit level with Z.ai's GLM-5.2 — a 744-billion-parameter model. Cisco also previews an unreleased Antares-3B that it says beats both GLM-5.2 and OpenAI's GPT-5.5. On throughput the gap is starker still: 500 repositories scanned in 15 minutes against roughly five hours for frontier models, at a cost Cisco puts at about 172 times cheaper than GPT-5.5. The deployment argument may matter more than the benchmark one. A model that fits on a laptop can run inside the perimeter, which means proprietary source code is never sent to a third-party API for analysis — a constraint that has kept a lot of security teams away from LLM-assisted triage entirely. Open weights make that verifiable rather than promised. The obvious caveat is that these figures are the vendor's own, on a task the vendor selected, and independent replication has not yet appeared. But the direction is one worth watching: a purpose-built small model beating general-purpose giants at a narrow job is a considerably cheaper future than the one where every security workflow calls a frontier API.