{"slug": "cisco-s-1-bug-finder-ties-gpt-5-5-by-undercutting-it", "title": "Cisco's $1 Bug Finder Ties GPT-5.5 by Undercutting It", "summary": "Cisco's new Antares-1B open-weight model for vulnerability localization tied GPT-5.5 on the company's VLoc Bench with a 0.221 F1 score while costing $1 versus $141 for the frontier model, but the best system still finds fewer than a quarter of vulnerable files, revealing an unsolved task whose price of mediocrity has collapsed.", "body_md": "[AI](https://sourcefeed.dev/c/ai)Article\n\n# Cisco's $1 Bug Finder Ties GPT-5.5 by Undercutting It\n\nAntares shows tiny specialized models matching frontier ones at vulnerability triage — and reveals how unsolved the task still is.\n\n[Mariana Souza](https://sourcefeed.dev/u/mariana_souza)\n\nThe headline number from Cisco's Antares launch is the 141x cost gap: running its new 1B-parameter security model across a 500-task benchmark cost under a dollar, while GPT-5.5 rang up $141. That number is real, and it's also the least interesting thing about this release. The interesting part is what the absolute scores reveal — a 1B model just tied a frontier model on an agentic security task, and both of them are bad at it.\n\n## What Antares actually does\n\n[Cisco Foundation AI](https://blogs.cisco.com/ai/introducing-antares-the-most-efficient-open-weight-ai-models-for-vulnerability-localization) — the group Cisco built around its Robust Intelligence acquisition, and the team behind last year's Foundation-Sec-8B — released two open-weight models this week: Antares-350M and [Antares-1B](https://huggingface.co/fdtn-ai/Antares-1B), both Apache 2.0, both on Hugging Face.\n\nThe job is *vulnerability localization*, and the distinction matters. These models don't discover novel bugs the way Google's Big Sleep or XBOW-style agents hunt zero-days with frontier models. Antares starts from a known vulnerability description — a GitHub Security Advisory, a CWE category, usually a CVE — and answers a narrower question: *where does this live in the repo in front of me?* The model runs an agentic loop with a budget of 15 terminal commands, greps for patterns, reads candidate files, and emits a ranked list of files for a human to review.\n\nThat's not a contrived task. It's exactly the gap dependency scanners fall into. Your SCA tool matches package manifests; it goes blind the moment code is vendored, forked, or copy-pasted into a monorepo. An advisory drops for a library you forked two years ago, and someone has to figure out whether the vulnerable code path exists in your tree. Today that someone is an engineer with grep and an afternoon. Antares is a bid to make it a model with 13 minutes on an H100.\n\n## Read the absolute numbers, not the ratio\n\nOn Cisco's new VLoc Bench — 500 tasks drawn from 290 real repositories across npm, pip, Maven, Go, Rust, and Composer advisories — Antares-1B scores 0.209 file-level F1 with 0.224 recall. GPT-5.5 scores 0.221 F1. GLM-5.2, a 753B open-weight model, gets 0.186. Gemini 3 Pro lands at 0.152. So a 1B model fine-tuned for the task shape effectively ties the frontier at roughly 1/750th the parameters and 1/141th the API cost.\n\nTwo caveats before you extrapolate. First, this is Cisco's own benchmark, built by the same team that trained the models on precisely this task distribution. The frontier models are being evaluated cold on a game Antares practiced for. That doesn't invalidate the result — it's the whole point of specialization — but \"beats GPT-5.5\" is a weaker claim than the marketing suggests.\n\nSecond, and more important: 0.224 recall means the best system evaluated finds fewer than a quarter of the vulnerable files, and at 0.262 precision, roughly three out of four files it flags are wrong. Vulnerability localization is not a solved problem that got cheap. It's an unsolved problem whose price of mediocrity just collapsed to approximately zero. Those are different stories, and the second one is still genuinely useful — you just have to deploy it as a ranked-hints layer feeding human triage, never as a gate that says \"clean.\"\n\n## An all-open training stack\n\nHow Antares was built is quietly the most forward-looking part. Cisco initialized from [IBM Granite 4.0](https://www.ibm.com/granite) checkpoints, ran supervised fine-tuning on a corpus that's mostly cybersecurity reasoning and code-search trajectories distilled from GPT-OSS-120B as a teacher, then applied GRPO reinforcement learning against snapshots of vulnerable repositories. Per the model card, the RL stage added 11–25% file F1 over SFT alone.\n\nThat's an IBM base, an OpenAI open-weight teacher, and a DeepSeek-lineage RL algorithm, assembled by Cisco into a task-specific model that ties the frontier on its niche. Every ingredient is open. This recipe — small open base, distill trajectories from a big open teacher, GRPO against a verifiable reward — is now cheap enough and documented enough that any security vendor, or any large platform team, can replicate it for their own narrow task. Expect a wave of these.\n\n## What to do with it\n\nIf you run a security team with vendored dependencies, internal forks, or code that can't leave the building, Antares is worth a pilot this quarter. It serves through [vLLM](https://docs.vllm.ai) with one command, quantized builds exist for Ollama and llama.cpp, and the 1B model carries a 128K context window. At under a dollar per 500 repos, the economics invert the usual calculus: you don't scan when an engineer gets around to it, you scan every repo against every relevant advisory, continuously, and let humans look only at the ranked output. Cisco explicitly pitches this at universities, nonprofits, and public-sector teams that could never fund frontier-API scanning — a real constituency that mostly runs nothing today.\n\nKnow the failure modes before you wire it into CI. The card is unusually honest: performance degrades on repos over 10MB because the 15-command budget runs out, and the model excels at grep-able patterns while struggling with semantic bugs — permissions logic, locking, memory lifetime. Which invites the uncomfortable question: for grep-able patterns, a well-written Semgrep rule is deterministic, free, and doesn't hallucinate. Antares earns its keep in the middle band, where the advisory text is fuzzy and the code has drifted from upstream.\n\nOne more signal worth reading: Antares-3B, the strongest variant, isn't being released — it's headed into Cisco's own security products. The open weights are the funnel; the best model is the product. That's the now-standard commoditize-your-complement play, and it tells you Cisco thinks localization-at-scale is worth defending commercially.\n\nThe honest verdict: not a genuine capability breakthrough, but a genuine economic one. The frontier didn't get beaten this week. It got undercut — and for a task you should be running a thousand times a day, undercut is what actually ships.\n\n## Sources & further reading\n\n-\n[Introducing Antares: Highly Efficient Open Weight AI Models for Vulnerability Localization](https://blogs.cisco.com/ai/introducing-antares-the-most-efficient-open-weight-ai-models-for-vulnerability-localization)— blogs.cisco.com -\n[Antares-1B model card](https://huggingface.co/fdtn-ai/Antares-1B)— huggingface.co -\n[Cisco Foundation AI Releases Antares: 350M and 1B Open-Weight Models That Localize Known Vulnerabilities Inside Real Codebases](https://www.marktechpost.com/2026/07/21/cisco-foundation-ai-releases-antares-350m-and-1b-open-weight-models-that-localize-known-vulnerabilities-inside-real-codebases/)— marktechpost.com -\n[Cisco Launches Low-Cost AI Models for Source Code Security](https://www.securityweek.com/cisco-launches-low-cost-ai-models-for-source-code-security/)— securityweek.com -\n[Cisco's Antares Models Cost $1 to Find Security Bugs. GPT-5.5 Costs $141](https://dev.to/peremptory/ciscos-antares-models-cost-1-to-find-security-bugs-gpt-55-costs-141-1967)— dev.to\n\n[Mariana Souza](https://sourcefeed.dev/u/mariana_souza)· Senior Editor\n\nMariana covers the fast-moving world of machine learning and generative AI, with a particular focus on how these technologies are reshaping development workflows. When she isn't stress-testing the latest foundation models, she's usually at a local hackathon.\n\n## Discussion 0\n\nNo comments yet\n\nBe the first to weigh in.", "url": "https://wpnews.pro/news/cisco-s-1-bug-finder-ties-gpt-5-5-by-undercutting-it", "canonical_source": "https://sourcefeed.dev/a/ciscos-1-bug-finder-ties-gpt-55-by-undercutting-it", "published_at": "2026-07-22 12:09:33+00:00", "updated_at": "2026-07-22 12:26:45.662376+00:00", "lang": "en", "topics": ["artificial-intelligence", "ai-products", "ai-agents", "ai-research", "ai-tools"], "entities": ["Cisco", "Antares-1B", "GPT-5.5", "IBM Granite 4.0", "Hugging Face", "VLoc Bench", "Cisco Foundation AI", "Mariana Souza"], "alternates": {"html": "https://wpnews.pro/news/cisco-s-1-bug-finder-ties-gpt-5-5-by-undercutting-it", "markdown": "https://wpnews.pro/news/cisco-s-1-bug-finder-ties-gpt-5-5-by-undercutting-it.md", "text": "https://wpnews.pro/news/cisco-s-1-bug-finder-ties-gpt-5-5-by-undercutting-it.txt", "jsonld": "https://wpnews.pro/news/cisco-s-1-bug-finder-ties-gpt-5-5-by-undercutting-it.jsonld"}}