Cisco's 1B Security Model Ties GPT-5.5 at Finding Bugs for $0.82. Read the Scoreboard Again: Everybody Is Failing.

TL;DR

On July 21, Cisco Foundation AI dropped two open-weight security models under Apache 2.0: Antares-1B and Antares-350M. They do one job, vulnerability localization, and they do it as terminal agents. On a 500-task benchmark the 1B model posts 0.209 file F1 against GPT-5.5's 0.221 and beats GLM-5.2, a 753B model, at 0.186. The whole sweep costs under a dollar versus roughly $141 for the frontier run. The uncomfortable part is the absolute numbers: on this task, the entire field is failing.

What vulnerability localization actually is

You get an advisory. A CVE, a CWE class, a paragraph of prose describing a flaw. You do not get a file path. Your job is to find which files in an unfamiliar repository the flaw actually lives in.

It is the plumber problem. Somebody calls and says there is a leak somewhere in the building, and before you can fix anything you have to walk the whole place opening cabinets. The fix is the easy part. Finding the pipe is what eats the afternoon.

This is the step security teams currently pay senior humans to do, or pay a frontier API to do at frontier token prices across every advisory in the queue. Cisco's argument is that this specific step is narrow enough to hand to a model small enough to run on your own hardware, which also means your proprietary source never leaves the building.

The scoreboard

Cisco evaluated on VLoc Bench: 500 tasks drawn from 290 real-world repositories, scored on file-level F1, precision, and recall. Here is where things land, straight off the model cards.

Two readings of that chart, and you need both.

The flattering one: a 1B model trained for one task closes to within 0.012 F1 of GPT-5.5 and comfortably clears GLM-5.2 at 753 billion parameters and Gemini 3 Pro. Antares-1B also posts the highest recall in its table at 0.224, ahead of GPT-5.5's 0.211, which for a triage tool is the number that matters most. Missing the file is worse than handing an analyst one extra file to skim.

The honest one: 0.221 is the frontier here. In most launch posts a number like that would be quietly relabeled as the y-axis minimum. Vulnerability localization on real repositories is nowhere near solved by anyone, and the useful thing Cisco published is not a win, it is a difficulty measurement with a price tag attached.

The cost column is the actual story

If everyone is roughly equally bad, then the only variable left is what the badness costs you. That is where the gap stops being incremental.

Cisco puts the multipliers at 15.2x cheaper than GLM-5.2 and 172x cheaper than GPT-5.5. Runtime moves the same direction: SiliconANGLE reports the Antares sweep finishing in about an hour against roughly four and a half for GPT-5.5, and the 350M model card claims the full 500-task run in about 11 minutes on a single H100 with 16 parallel workers.

Reframe that as a policy decision rather than a benchmark. At $141 a sweep you triage the advisories that look scary. At $0.82 you run every advisory against every repo on a cron, and you stop rationing the boring work.

How it works: it is an agent, not a classifier

Antares does not embed your repo and score similarity. It gets a sandboxed terminal and investigates, which is the design choice that makes a 1B model competitive at all.

The generation format is explicit: a <think> block for reasoning, a <tool_call> block issuing shell commands like grep, find, and cat, then a <tool_response> section carrying the output back. It runs that loop for up to 15 terminal calls and then terminates by calling either submit_vulnerable_files or submit_no_vulnerability_found.

That last one matters more than it looks. A model that can only ever return a file list will always return a file list. Giving it an explicit way to say "nothing here" is what separates a triage tool from a noise generator.

Trained on trajectories, not answers

The recipe is two stages on top of IBM Granite 4.0 (350M and 1B respectively, with a 128K context window on the 1B). First, supervised fine-tuning on security reasoning, deep research, and code-search trajectory data. Then Group Relative Policy Optimization, reinforcement learning over complete multi-turn agent trajectories with verifiable rewards.

The verifiable part is why this works at this size. Whether the submitted file contains the vulnerability is a fact you can check, so the reward is not a taste judgment. You are not teaching the model what a vulnerability looks like in the abstract, you are teaching it a search policy: which directory to open next, when a path is dead, when to stop.

What it cannot do

Cisco documents the limits, which is more than most model cards manage.

• Big repos hurt. Performance degrades on repositories over 10MB when the terminal budget is tight. Fifteen grep calls does not go far in a monorepo.
• It pattern-matches, it does not reason about semantics. Strong on classes like CWE-843 (type confusion) and CWE-1321 (prototype pollution), which have recognizable shapes in code. Weak on CWE-732 (incorrect permission assignment) and CWE-667 (improper locking), where the flaw is in intent rather than syntax.
• Stale knowledge. The stated knowledge cutoff is April 10, 2025.
• Not autonomous. The card calls for system-level sandboxing and human oversight. You are handing an LLM a shell inside your source tree, so treat the sandbox as load-bearing, not decorative.

Running it

Standard open-weight paths, all of them. Serve it with vLLM via vllm serve fdtn-ai/antares-1b for an OpenAI-compatible endpoint, or with SGLang, or load it directly through Transformers. Quantized builds are available for llama.cpp, Ollama, and LM Studio.

At 350M and 1B parameters, "runs locally" is not a stretch claim requiring a rented H100. It is a laptop. The H100 figure is about sweeping 500 tasks in parallel, not about clearing a memory floor.

A larger Antares-3B is announced but not yet released, and reporting around the launch suggests it lands closer still to GPT-5.5. Until the weights are public, treat that as a roadmap item rather than a result.

Why this shape of release keeps showing up

Antares is another entry in the pattern that has defined the last month: pick one task with a checkable answer, take a small open base, run RL on real trajectories, and ship weights that beat models a hundred times larger inside that lane. It is not a frontier challenger and Cisco never claims it is.

The strategic read for a builder is that the expensive-generalist default is losing ground on any task you can score automatically. If you can write a function that returns true when the answer is right, you can probably fine-tune something small enough to run in your own CI and stop paying per token for it.

Key Takeaways

• Cisco Foundation AI released Antares-350M and Antares-1B on July 21 under Apache 2.0, both built on IBM Granite 4.0, both aimed only at vulnerability localization.
• Antares-1B scores 0.209 file F1 on the 500-task VLoc Bench against GPT-5.5's 0.221, GLM-5.2 (753B) at 0.186, and Gemini 3 Pro at 0.152, with the best recall in the table at 0.224.
• A full sweep costs about $0.82 versus roughly $12.50 for GLM-5.2 and $141 for GPT-5.5, which Cisco puts at 15.2x and 172x cheaper.
• Absolute scores are low across the board. This benchmark measures how unsolved the task is, not who solved it.
• The models work as terminal agents with grep-style tool calls and a 15-call budget, trained with SFT plus GRPO over full agent trajectories with verifiable rewards.
• Documented weaknesses: repos over 10MB, semantic CWE classes like CWE-732 and CWE-667, and an April 2025 knowledge cutoff. A 3B version is promised but unreleased.

Sources: Cisco Blogs: Introducing Antares, Hugging Face: fdtn-ai/antares-1b, Hugging Face: fdtn-ai/antares-350m, Hugging Face: Antares collection, SiliconANGLE, Help Net Security