--- title: "Cisco Antares Review: Local Vulnerability AI" canonical: https://wavect.io/blog/cisco-antares-local-vulnerability-localization/ language: en description: "Cisco Antares review: use the 1B local AI model for private vulnerability localization. VLoc benchmarks, GGUF, llama.cpp, CI/CD and limits." image: "https://wavect.io/img/general/bak/open_graph_preview.jpg" --- [**Back**](/blog/overview/) [![Kevin Riedl](/img/team/kevin.webp)](/team/kevin-riedl/) [Kevin Riedl](/team/kevin-riedl/) https://linkedin.com/in/wsdt 12 min read · 22 Jul 2026 Last reviewed August 7, 2026 [**Next**](/blog/meterless-ai-agent-context-layer-review/) # Cisco Antares Review: 1B Local AI for Vulnerability Localization TL;DR Cisco Antares is an open-weight family of security SLMs for vulnerability localization, not an autonomous scanner. Given a CWE description and read-only terminal access, Antares-1B explores a repository and ranks candidate source files without external retrieval. It reaches 0.209 File F1 on Cisco's 500-task VLoc Bench, but large repositories, multi-file weaknesses and semantic bugs remain difficult. A community 1.96 GB Q8_0 GGUF can run behind llama.cpp, though no public parity benchmark with the original weights exists. Deploy it in a network-disabled sandbox, keep SAST, SCA, secret scanning, dynamic testing and human review, and judge a pilot by analyst minutes per correctly localized case. Related service: [Software Quality Assurance](/services/software-quality-assurance/) **Cisco Antares is a small open-weight model for vulnerability localization: it maps a CWE weakness description to the source files a security engineer should inspect first.** The public Antares-350M and Antares-1B weights can run locally, so proprietary code does not need to leave your environment. It is not an autonomous scanner, a patch generator, or a replacement for SAST and penetration testing. That narrow scope is why Antares matters. The released [Antares-1B model](https://huggingface.co/fdtn-ai/antares-1b) has one billion parameters, uses an Apache 2.0 licence, needs no vector database or external retrieval system, and can sit behind a local OpenAI-compatible endpoint. A [community Q8_0 GGUF conversion](https://huggingface.co/mitkox/antares-1b-Q8_0-GGUF) is about 1.96 GB and can run through llama.cpp. That creates a credible private triage lane for proprietary code, including small on-device and workstation deployments. The catch is just as important: the best model in Cisco's own benchmark reaches only 0.229 File F1, and 190 of 500 tasks defeat every tested model. Antares narrows a search. It does not prove that a repository is safe. | Question | Short answer | Commercial implication | | --- | --- | --- | | Does code need to leave your environment? | No, if the weights, inference endpoint, CLI, logs, and repository sandbox are all local. | Useful for proprietary or regulated code where cloud review is not approved. | | Does Antares find proven vulnerabilities? | No. It ranks candidate files from a CWE-style description. | Keep human review and the existing AppSec toolchain. | | Can it run with llama.cpp? | A community Q8_0 GGUF is available and llama.cpp exposes a compatible local server. | Easy to pilot, but GGUF quality parity has not been published. | | Can it feed CI/CD? | Yes. The official CLI supports JSON and SARIF output. | Start as non-blocking triage, not a merge gate. | | Is it cheap? | The model is small and Apache-2.0 licensed. Integration, review, compute, and maintenance are not free. | Measure cost per reviewed, confirmed finding, not cost per token. | | Can it replace SAST or a pentest? | No. | Use it between advisory intake and expert investigation. | ## What is Cisco Antares? [Cisco Foundation AI introduced Antares](https://blogs.cisco.com/ai/introducing-antares-the-most-efficient-open-weight-ai-models-for-vulnerability-localization) on 21 July 2026 as a family of security-focused small language models. Antares-350M and Antares-1B are publicly available. Antares-3B appears in the technical report and benchmark but was still described as coming soon at publication time. The models start from IBM Granite 4.0 checkpoints. Cisco then applies supervised fine-tuning for cybersecurity reasoning, deep research, terminal use, and code search, followed by Group Relative Policy Optimization over complete repository-navigation trajectories. In plain language, Antares is trained not merely to know vulnerability terms, but to search, inspect, reject weak leads, and submit file paths under a limited tool budget. The [Antares technical report](https://cisco-foundation-ai.github.io/antares/technical-report.pdf) describes a read-only, network-disabled repository environment with a maximum of 15 terminal commands. The model receives a CWE ID and generic category description, uses familiar terminal search and file-inspection tools, then returns likely vulnerable implementation files or reports that it found none. ## What does vulnerability localization mean? Vulnerability detection asks whether a weakness exists. Vulnerability localization asks where the relevant implementation lives. That distinction matters after a new advisory lands. A security team may understand the [CWE weakness category](https://cwe.mitre.org/) yet still spend hours mapping a CVE or GitHub Security Advisory across wrappers, adapters, framework conventions, and call paths in an unfamiliar repository. Antares automates the first excavation pass: 1. **Start with a bounded security hypothesis.** Supply the CWE and its generic description, not a vague instruction to find every bug. 2. **Explore the repository.** The model searches names and patterns, opens candidate files, follows imports and implementation paths, and revises its hypothesis. 3. **Submit candidate files.** The output is a ranked review queue, not a vulnerability verdict. 4. **Hand off to deterministic checks and people.** Engineers confirm reachability, exploitability, affected versions, severity, and remediation. This scope deliberately avoids cannibalizing our broader [QA process for AI-generated code](/blog/qa-for-ai-generated-code/). That article covers production-readiness failures across authorization, inputs, secrets, load, concurrency, dependencies, and regression tests. Antares owns one step inside that larger process: localizing likely vulnerable files from security descriptions. ## How good is Antares according to the benchmark? The new [Vulnerability Localization Benchmark](https://cisco-foundation-ai.github.io/vulnerability-localization-benchmark/) contains 500 tasks from 290 real repositories, six package ecosystems, and 147 CWE categories. Each task reconstructs a repository before its security fix. Ground truth comes from implementation files changed by the actual patch. Models receive only a generic CWE description and 15 terminal calls. | Model | Parameters | File F1 | Recall | | --- | --- | --- | --- | | GPT-5.5, xhigh | Frontier | 0.229 | 0.221 | | Antares-3B, GRPO | 3B | 0.223 | 0.221 | | Antares-1B, GRPO | 1B | 0.209 | 0.224 | | GLM-5.2 | 753B | 0.186 | 0.186 | | Antares-350M, GRPO | 350M | 0.135 | 0.178 | The headline is legitimate: specialization lets a 1B model outperform much larger general-purpose models on this harness. The responsible interpretation is not that Antares catches 20.9% of vulnerabilities. File F1 combines file-level precision and recall for a benchmark where every Phase A repository is known to contain a vulnerability. It does not measure end-to-end detection in a normal codebase with an unknown base rate. The limitations are commercially decisive. Cisco reports that performance drops sharply above 10 MB, vulnerabilities spanning five or more files remain difficult, and distinctive grep-friendly patterns are easier than permissions, locking, memory leaks, and other behavior-heavy weaknesses. The training-data cutoff is 10 April 2025. The model card also says Antares does not explain why a file is vulnerable, generate an exploit, or provide a patch. ## What changes when Antares runs as GGUF through llama.cpp? The public Cisco release uses Transformers-compatible weights and an official CLI that connects to a user-configured OpenAI-compatible inference endpoint. [llama.cpp provides that local server interface](https://github.com/ggml-org/llama.cpp), and the community Q8_0 conversion packages the 1B model into a roughly 1.96 GB GGUF. Architecturally, the pieces fit. A practical local setup can run the Antares GGUF on a compact GB10 system while a larger coding model handles general development work. A thin agent skill then drives the official Antares CLI or its protocol: supply the repository snapshot and CWE, collect JSON or SARIF, and return candidate files to the main coding agent for review. Because Antares is small, it does not need to monopolize the hardware that serves the larger assistant. Three claims still need to stay separate: - **The official benchmark is not a GGUF benchmark.** Cisco reports roughly 13 to 15 minutes for the 500-task sweep on one H100 with parallel workers. That says nothing about GB10 latency or llama.cpp throughput. - **Q8_0 parity is not established.** The conversion is convenient, but we found no published VLoc A/B between the original weights and the GGUF as of 7 August 2026. - **The community artifact is not the official Cisco release.** Pin the exact file, record its hash, retain the source model revision, and validate it on your own historical cases. ## How should Antares fit into shift-left CI/CD? Do not begin by failing every pull request. Begin by measuring whether Antares saves analyst time without hiding serious misses. 1. **Trigger on a security reason.** Use a mapped CWE from a new CVE or GHSA, a targeted campaign such as path traversal, or a scheduled shortlist of weakness categories. Avoid an unbounded “find all vulnerabilities” prompt. 2. **Create a read-only snapshot.** Mount only the repository and required metadata in a network-disabled container. Exclude secrets, build credentials, customer exports, and irrelevant generated files. 3. **Run a small, relevant slice.** Scan the changed service or dependency boundary when possible. This respects the 15-command budget and the documented large-repository weakness. 4. **Emit JSON and SARIF.** The official CLI supports both. [GitHub can ingest SARIF from third-party tools](https://docs.github.com/en/code-security/concepts/code-scanning/sarif-files) and display locations as code-scanning alerts. 5. **Require human confirmation.** A candidate becomes a finding only after a reviewer confirms the vulnerable behavior and affected path. 6. **Track accepted outcomes.** Measure precision, recall on known cases, minutes to first relevant file, reviewer minutes per confirmed finding, and silent misses. Promote Antares to a blocking gate only for a category where your own false-negative and false-positive data justify it. Even then, keep a bypass with named ownership and an audit trail. ## How can Antares support CVE and GHSA investigations? Antares performs no external retrieval. That is a privacy advantage and a workflow constraint. It will not fetch a fresh advisory for you, and its 2025 knowledge cutoff makes that a bad idea anyway. The safe advisory-driven pattern is explicit: 1. Retrieve the CVE or GHSA in a separate, governed intake step. 2. Verify the affected component, version range, CWE mapping, and advisory text. 3. Pass only the validated CWE description and locally approved context into Antares. 4. Use its candidate files to prioritize source review, dependency tracing, and patch verification. 5. Record the advisory revision, model hash, prompt, repository commit, trace, and reviewer decision. This separation prevents a stale model from inventing current vulnerability intelligence. It also makes the result reproducible when an auditor asks why a file was reviewed or ignored. ## Does local inference make the workflow secure? **Local is a useful data boundary, not a security certificate.** The model card recommends an isolated sandbox, network disabled, access restricted to authorized security staff, complete trajectory logging, and human oversight. Those controls matter because the model operates a terminal and has not received standalone conversational safety alignment. The GGUF path adds another supply-chain boundary. llama.cpp has published security advisories for malicious model parsing, including a [buffer overflow triggered by a crafted GGUF vocabulary](https://github.com/ggml-org/llama.cpp/security/advisories/GHSA-8wwf-w4qm-gpqr). Keep llama.cpp current, download model files from a pinned trusted location, verify hashes, and load untrusted weights only inside a hardened environment. Also check the less obvious egress paths: crash reporting, package installation, remote logs, CI artifacts, SARIF upload, and the main coding agent that receives Antares results. A local model does not protect code that the surrounding harness sends elsewhere. ## What Antares should complement, not replace | Control | What it catches | Why Antares still does not replace it | | --- | --- | --- | | SAST and CodeQL-style analysis | Rules, types, sources, sinks, and data flows | Deterministic findings and mature query packs remain essential. | | Software composition analysis | Known vulnerable dependencies and licences | Antares does not maintain a current dependency advisory database. | | Secret scanning | Committed credentials and tokens | Dedicated detectors are faster and more reliable for this pattern. | | Dynamic testing and pentesting | Runtime behavior, exploit paths, configuration, and chained failures | Antares reads source and returns files. It does not prove exploitability. | | Human security review | Business logic, threat context, severity, and remediation quality | The model card explicitly requires human oversight. | If you are evaluating autonomous red-team systems, our [T3MP3ST review](/blog/t3mp3st-ai-red-teaming-review-2026/) owns that separate decision. If the business question is the economics of local models versus APIs, use our [local-model break-even guide](/blog/local-models-vs-apis-break-even-eu-2026/). Keeping these intents separate gives buyers a cleaner answer and prevents the pages from competing for the same search query. ## A commercial 14-day Antares pilot 1. **Select 25 historical investigations.** Include pre-fix and patched snapshots, single-file and multi-file weaknesses, small and large repositories, and at least five cases your existing process missed or found slowly. 2. **Freeze the stack.** Record the Antares source revision, GGUF hash if used, llama.cpp build, CLI version, prompt, terminal budget, and hardware. 3. **Run blind.** Do not expose patch files or known locations to the model or reviewer performing the first pass. 4. **Compare the baseline.** Measure Antares plus analyst against the current SAST plus analyst process. 5. **Set go or no-go gates.** Require a material reduction in median triage time, no unacceptable miss on critical cases, reviewable traces, and a supportable false-positive load. The decision metric is not tokens per second. It is **analyst minutes per correctly localized investigation**, with false negatives shown beside it. If the local model makes a senior reviewer faster, keep it. If it produces an attractive stream of unverified file names, stop. ## Own the AI, including the boring parts Owning the weights is a start. Operational ownership means controlling the inference endpoint, repository boundary, logs, model and runtime updates, evaluation set, failure policy, and exit path. A model on your desk that silently depends on a vendor service is not fully local. A local model without a benchmark is not yet a controlled production system. Cloud AI is optimized for the company operating the cloud. That can still be the correct trade when capability, support, and speed outweigh data-boundary and portability concerns. The mistake is treating vendor alignment as identical to your own. Antares makes another option practical: keep the narrow security task, the code, and the evidence inside a boundary you control. ## Frequently Asked Questions ### What is Cisco Antares? Cisco Antares is a family of open-weight small language models trained for agentic vulnerability localization. Given a CWE description and read-only terminal access, it explores a repository and returns likely vulnerable implementation files for human review. ### Can Antares scan a repository locally? Yes, when the model weights, OpenAI-compatible inference endpoint, official CLI, repository sandbox, and logs all run inside your environment. The official workflow requires no external retrieval or vector database. ### Does Antares work with llama.cpp and GGUF? A community Q8_0 GGUF of Antares-1B is available and llama.cpp can serve it through an OpenAI-compatible local endpoint. Public benchmark parity between that GGUF and Cisco's original weights had not been published as of 7 August 2026. ### Can Antares find CVE or GHSA vulnerabilities? It can help localize candidate files after a trusted intake step maps an advisory to a CWE and approved description. Antares does not retrieve current advisories itself, and its training cutoff is 10 April 2025. ### Can Antares replace SAST, CodeQL, or a penetration test? No. It returns likely files, not proof of exploitability, remediation, or complete coverage. Keep static analysis, dependency and secret scanning, dynamic testing, threat modeling, and expert review. ### Should Antares block a CI pipeline? Not initially. Run it as non-blocking triage, collect precision, recall on historical cases, reviewer time, and false-negative data, then block only narrowly validated categories with an owned bypass process. ### Is Antares free for commercial use? Antares-350M and Antares-1B are released under Apache 2.0. The licence removes a model fee, not the cost of integration, compute, security hardening, validation, review, and maintenance. ## Primary sources and verification date - [Cisco Foundation AI launch post](https://blogs.cisco.com/ai/introducing-antares-the-most-efficient-open-weight-ai-models-for-vulnerability-localization) - [Antares technical report](https://cisco-foundation-ai.github.io/antares/technical-report.pdf) - [Official Antares-1B model card](https://huggingface.co/fdtn-ai/antares-1b) - [VLoc Bench methodology and results](https://cisco-foundation-ai.github.io/vulnerability-localization-benchmark/) - [llama.cpp repository and local server documentation](https://github.com/ggml-org/llama.cpp) Product status, model cards, benchmark results, licences, and linked security advisories were checked on **7 August 2026**. This review is independent and unsponsored. We did not reproduce Cisco's H100 benchmark or publish a GGUF parity run, so we label those evidence gaps instead of converting them into claims. ## Final thoughts Antares makes vulnerability triage feel less like repository archaeology because it specializes in the expensive first question: where should a security engineer look? Its size, open weights, read-only agent loop, and local deployment path make private, repeated investigation commercially plausible. The model is useful precisely when its limits stay visible. It localizes candidates. It does not certify code, replace the AppSec stack, or remove the reviewer. Run it locally, sandbox it, measure it on your own old incidents, and promote it only where the evidence earns trust. Local. Private. Tiny. Slightly dangerous in the productive sense, because a small team can now own a security automation lane that used to require a much larger model and a cloud boundary. ## You may also like.. [**QA for AI-Generated Code** The broader production-readiness process for authorization, inputs, secrets, dependencies, load, failure paths, and regression coverage.](/blog/qa-for-ai-generated-code/) [**Ship the prototype or harden it first?** Choose when speed is enough and when users, money, or sensitive data require a production hardening pass.](/compare/ship-vibe-coded-as-is-vs-harden/) Models and infrastructure ## Continue through this cluster [Start with the cornerstone**Self-Hosting LLMs in the EU: When Open Weights Actually Pay Off**](/blog/self-hosting-llms-eu-cost/) - [Does Claude Watermark Text? The 2026 API Answer](/blog/claude-text-watermark-api-2026/) - [OpenKB Review: Knowledge Compiler vs RAG](/blog/openkb-review-vs-rag/) - [Unsloth Desktop Review: A Private Local AI Workstation?](/blog/unsloth-desktop-local-ai-workstation-review/) - [NeMo Switchyard 0.2: Agent Model Routing Without Training?](/blog/nemo-switchyard-model-router/) - [Firecrawl AnyDoc Review: 14 Formats to Markdown](/blog/firecrawl-anydoc-review/) Inbox, without the noise ## Follow the work that matters to you Get a short email when we publish something new. Follow the whole blog or only the problems you care about. [**Back**](/blog/overview/) [![Kevin Riedl](/img/team/kevin.webp)](/team/kevin-riedl/) [Kevin Riedl](/team/kevin-riedl/) https://linkedin.com/in/wsdt 12 min read · 22 Jul 2026 Last reviewed August 7, 2026 [**Next**](/blog/meterless-ai-agent-context-layer-review/) New posts by email × × Get new posts by email A short email when we publish. Free, no tracking. ## Structured Data ```json { "@context": "https://schema.org", "@graph": [ { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ], "employee": [ { "@id": "https://wavect.io/team/kevin-riedl/#person", "@type": "Person", "jobTitle": "Managing Director", "name": "Kevin Riedl", "url": "https://wavect.io/team/kevin-riedl/", "worksFor": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] } }, { "@id": "https://wavect.io/team/christof-jori/#person", "@type": "Person", "jobTitle": "Managing Director", "name": "Christof Jori", "url": "https://wavect.io/team/christof-jori/", "worksFor": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] } } ], "founder": [ { "@id": "https://wavect.io/team/kevin-riedl/#person", "@type": "Person", "jobTitle": "Managing Director", "name": "Kevin Riedl", "url": "https://wavect.io/team/kevin-riedl/", "worksFor": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] } }, { "@id": "https://wavect.io/team/christof-jori/#person", "@type": "Person", "jobTitle": "Managing Director", "name": "Christof Jori", "url": "https://wavect.io/team/christof-jori/", "worksFor": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] } } ], "legalRepresentative": [ { "@id": "https://wavect.io/team/kevin-riedl/#person", "@type": "Person", "jobTitle": "Managing Director", "name": "Kevin Riedl", "url": "https://wavect.io/team/kevin-riedl/", "worksFor": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] } }, { "@id": "https://wavect.io/team/christof-jori/#person", "@type": "Person", "jobTitle": "Managing Director", "name": "Christof Jori", "url": "https://wavect.io/team/christof-jori/", "worksFor": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] } } ], "name": "Wavect GmbH", "subjectOf": { "@id": "https://wavect.io/verified-claims.json#dataset", "@type": "Dataset", "creator": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] }, "description": "A machine-readable registry of quantitative and qualitative claims published by Wavect, with review dates, localized page appearances and public third-party citations where available.", "inLanguage": "en", "isAccessibleForFree": true, "license": "https://creativecommons.org/licenses/by/4.0/", "name": "Wavect verified publication claims", "url": "https://wavect.io/verified-claims.json" }, "url": "https://wavect.io/" }, { "@id": "https://wavect.io/team/kevin-riedl/#person", "@type": "Person", "jobTitle": "Managing Director", "name": "Kevin Riedl", "sameAs": [ "https://www.wikidata.org/wiki/Q139796365", "https://www.linkedin.com/in/wsdt", "https://github.com/wsdt" ], "url": "https://wavect.io/team/kevin-riedl/", "worksFor": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] } }, { "@id": "https://wavect.io/team/christof-jori/#person", "@type": "Person", "jobTitle": "Managing Director", "name": "Christof Jori", "sameAs": [ "https://www.wikidata.org/wiki/Q139796367", "https://www.linkedin.com/in/jocr77/", "https://github.com/jo-chris" ], "url": "https://wavect.io/team/christof-jori/", "worksFor": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] } }, { "@id": "https://wavect.io/#website", "@type": "WebSite", "inLanguage": [ "en", "de", "es", "zh" ], "name": "Wavect", "potentialAction": { "@type": "SearchAction", "query-input": "required name=search_term_string", "target": { "@type": "EntryPoint", "urlTemplate": "https://wavect.io/search/?q={search_term_string}" } }, "publisher": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] }, "url": "https://wavect.io/" }, { "@id": "https://wavect.io/blog/cisco-antares-local-vulnerability-localization/#webpage", "@type": "WebPage", "dateModified": "2026-07-22", "inLanguage": "en", "isPartOf": { "@id": "https://wavect.io/#website", "@type": "WebSite" }, "lastReviewed": "2026-07-22", "url": "https://wavect.io/blog/cisco-antares-local-vulnerability-localization/" } ] } ``` ```json { "@context": "https://schema.org", "@type": "BlogPosting", "abstract": "Cisco Antares is an open-weight family of security SLMs for vulnerability localization, not an autonomous scanner. Given a CWE description and read-only terminal access, Antares-1B explores a repository and ranks candidate source files without external retrieval. It reaches 0.209 File F1 on Cisco's 500-task VLoc Bench, but large repositories, multi-file weaknesses and semantic bugs remain difficult. A community 1.96 GB Q8_0 GGUF can run behind llama.cpp, though no public parity benchmark with the original weights exists. Deploy it in a network-disabled sandbox, keep SAST, SCA, secret scanning, dynamic testing and human review, and judge a pilot by analyst minutes per correctly localized case.", "articleBody": " Blog overview/AI and agents/Models and infrastructure Cisco Antares Review: 1B Local AI for Vulnerability Localization TL;DR Cisco Antares is an open-weight family of security SLMs for vulnerability localization, not an autonomous scanner. Given a CWE description and read-only terminal access, Antares-1B explores a repository and ranks candidate source files without external retrieval. It reaches 0.209 File F1 on Cisco's 500-task VLoc Bench, but large repositories, multi-file weaknesses and semantic bugs remain difficult. A community 1.96 GB Q8_0 GGUF can run behind llama.cpp, though no public parity benchmark with the original weights exists. Deploy it in a network-disabled sandbox, keep SAST, SCA, secret scanning, dynamic testing and human review, and judge a pilot by analyst minutes per correctly localized case. Related service: Software Quality Assurance Cisco Antares is a small open-weight model for vulnerability localization: it maps a CWE weakness description to the source files a security engineer should inspect first. The public Antares-350M and Antares-1B weights can run locally, so proprietary code does not need to leave your environment. It is not an autonomous scanner, a patch generator, or a replacement for SAST and penetration testing. That narrow scope is why Antares matters. The released Antares-1B model has one billion parameters, uses an Apache 2.0 licence, needs no vector database or external retrieval system, and can sit behind a local OpenAI-compatible endpoint. A community Q8_0 GGUF conversion is about 1.96 GB and can run through llama.cpp. That creates a credible private triage lane for proprietary code, including small on-device and workstation deployments. The catch is just as important: the best model in Cisco's own benchmark reaches only 0.229 File F1, and 190 of 500 tasks defeat every tested model. Antares narrows a search. It does not prove that a repository is safe. Cisco Antares buyer verdict, verified 7 August 2026 QuestionShort answerCommercial implication Does code need to leave your environment?No, if the weights, inference endpoint, CLI, logs, and repository sandbox are all local.Useful for proprietary or regulated code where cloud review is not approved. Does Antares find proven vulnerabilities?No. It ranks candidate files from a CWE-style description.Keep human review and the existing AppSec toolchain. Can it run with llama.cpp?A community Q8_0 GGUF is available and llama.cpp exposes a compatible local server.Easy to pilot, but GGUF quality parity has not been published. Can it feed CI/CD?Yes. The official CLI supports JSON and SARIF output.Start as non-blocking triage, not a merge gate. Is it cheap?The model is small and Apache-2.0 licensed. Integration, review, compute, and maintenance are not free.Measure cost per reviewed, confirmed finding, not cost per token. Can it replace SAST or a pentest?No.Use it between advisory intake and expert investigation. What is Cisco Antares? Cisco Foundation AI introduced Antares on 21 July 2026 as a family of security-focused small language models. Antares-350M and Antares-1B are publicly available. Antares-3B appears in the technical report and benchmark but was still described as coming soon at publication time. The models start from IBM Granite 4.0 checkpoints. Cisco then applies supervised fine-tuning for cybersecurity reasoning, deep research, terminal use, and code search, followed by Group Relative Policy Optimization over complete repository-navigation trajectories. In plain language, Antares is trained not merely to know vulnerability terms, but to search, inspect, reject weak leads, and submit file paths under a limited tool budget. The Antares technical report describes a read-only, network-disabled repository environment with a maximum of 15 terminal commands. The model receives a CWE ID and generic category description, uses familiar terminal search and file-inspection tools, then returns likely vulnerable implementation files or reports that it found none. What does vulnerability localization mean? Vulnerability detection asks whether a weakness exists. Vulnerability localization asks where the relevant implementation lives. That distinction matters after a new advisory lands. A security team may understand the CWE weakness category yet still spend hours mapping a CVE or GitHub Security Advisory across wrappers, adapters, framework conventions, and call paths in an unfamiliar repository. Antares automates the first excavation pass: Start with a bounded security hypothesis. Supply the CWE and its generic description, not a vague instruction to find every bug. Explore the repository. The model searches names and patterns, opens candidate files, follows imports and implementation paths, and revises its hypothesis. Submit candidate files. The output is a ranked review queue, not a vulnerability verdict. Hand off to deterministic checks and people. Engineers confirm reachability, exploitability, affected versions,", "articleSection": "Engineering", "author": { "@id": "https://wavect.io/team/kevin-riedl/#person", "@type": "Person", "name": "Kevin Riedl", "sameAs": [ "https://www.wikidata.org/wiki/Q139796365", "https://www.linkedin.com/in/wsdt", "https://github.com/wsdt" ], "url": "https://wavect.io/team/kevin-riedl/" }, "dateModified": "2026-08-07", "datePublished": "2026-07-22", "description": "Cisco Antares is an open-weight family of security SLMs for vulnerability localization, not an autonomous scanner. Given a CWE description and read-only terminal access, Antares-1B explores a repository and ranks candidate source files without external retrieval. It reaches 0.209 File F1 on Cisco's 500-task VLoc Bench, but large repositories, multi-file weaknesses and semantic bugs remain difficult. A community 1.96 GB Q8_0 GGUF can run behind llama.cpp, though no public parity benchmark with the original weights exists. Deploy it in a network-disabled sandbox, keep SAST, SCA, secret scanning, dynamic testing and human review, and judge a pilot by analyst minutes per correctly localized case.", "headline": "Cisco Antares Review: 1B Local AI for Vulnerability Localization", "image": "https://wavect.io/img/blog/headers/header_cisco-antares-local-vulnerability-localization.svg", "inLanguage": "en", "mainEntityOfPage": { "@id": "https://wavect.io/blog/cisco-antares-local-vulnerability-localization/", "@type": "WebPage" }, "publisher": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] }, "url": "https://wavect.io/blog/cisco-antares-local-vulnerability-localization/", "wordCount": 2843 } ``` ```json { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "item": "https://wavect.io/", "name": "Home", "position": 1 }, { "@type": "ListItem", "item": "https://wavect.io/blog/overview/", "name": "Blog overview", "position": 2 }, { "@type": "ListItem", "item": "https://wavect.io/blog/topics/ai-agents/", "name": "AI and agents", "position": 3 }, { "@type": "ListItem", "item": "https://wavect.io/blog/clusters/models-infrastructure/", "name": "Models and infrastructure", "position": 4 }, { "@type": "ListItem", "item": "https://wavect.io/blog/cisco-antares-local-vulnerability-localization/", "name": "Cisco Antares Review: Local Vulnerability AI | ", "position": 5 } ] } ``` ```json { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "acceptedAnswer": { "@type": "Answer", "text": "Cisco Antares is a family of open-weight small language models trained for agentic vulnerability localization. Given a CWE description and read-only terminal access, it explores a repository and returns likely vulnerable implementation files for human review." }, "name": "What is Cisco Antares?" }, { "@type": "Question", "acceptedAnswer": { "@type": "Answer", "text": "Yes, when the model weights, OpenAI-compatible inference endpoint, official CLI, repository sandbox, and logs all run inside your environment. The official workflow requires no external retrieval or vector database." }, "name": "Can Antares scan a repository locally?" }, { "@type": "Question", "acceptedAnswer": { "@type": "Answer", "text": "A community Q8_0 GGUF of Antares-1B is available and llama.cpp can serve it through an OpenAI-compatible local endpoint. Public benchmark parity between that GGUF and Cisco's original weights had not been published as of 7 August 2026." }, "name": "Does Antares work with llama.cpp and GGUF?" }, { "@type": "Question", "acceptedAnswer": { "@type": "Answer", "text": "It can help localize candidate files after a trusted intake step maps an advisory to a CWE and approved description. Antares does not retrieve current advisories itself, and its training cutoff is 10 April 2025." }, "name": "Can Antares find CVE or GHSA vulnerabilities?" }, { "@type": "Question", "acceptedAnswer": { "@type": "Answer", "text": "No. It returns likely files, not proof of exploitability, remediation, or complete coverage. Keep static analysis, dependency and secret scanning, dynamic testing, threat modeling, and expert review." }, "name": "Can Antares replace SAST, CodeQL, or a penetration test?" }, { "@type": "Question", "acceptedAnswer": { "@type": "Answer", "text": "Not initially. Run it as non-blocking triage, collect precision, recall on historical cases, reviewer time, and false-negative data, then block only narrowly validated categories with an owned bypass process." }, "name": "Should Antares block a CI pipeline?" }, { "@type": "Question", "acceptedAnswer": { "@type": "Answer", "text": "Antares-350M and Antares-1B are released under Apache 2.0. The licence removes a model fee, not the cost of integration, compute, security hardening, validation, review, and maintenance." }, "name": "Is Antares free for commercial use?" } ] } ```