Cisco followed in the footsteps of Anthropic with a series of open-weight cybersecurity models that it claimed beats AI from OpenAI and Gemini, though the jury remains out on were it stands against Anthropic's headlining Claude Mythos.
The Antares family of small language models (SLMs) are dedicated specifically to repository-level vulnerability localization. In contrast to Cisco's previous domain-specific security models, the new SLMs resemble how a "human investigator works through a repository," according to Amin Karbasi, VP and chief AI scientist at Cisco.
"Each model starts from a vulnerability description, searches for relevant code patterns, reads candidate files, incorporates new evidence, changes direction when a path is unhelpful, and narrows toward the files most likely to matter," Karbasi added.
Two of the models, Antares-350M and Antares-1B, are available on Hugging Face as open-weight releases, a common format meaning developers get their hands on the model files – known as weight – without the training data, full code, and methodology that would come in a fully open source release.
Missing Mythos #
Research by the Cisco Foundation AI team showed the Antares models scoring higher than OpenAI's GPT5.5 and Google's Gemma and Gemini models at vulnerability finding – but without toppling OpenAI's premium GPT-5.5 (xhigh) model.
Interestingly, a technical report this week from the team showed Anthropic's Claude Opus 4.6 testing higher than both Antares and 5.5 (xhigh) on benchmarks. These results aren't shown in Cisco's Antares announcement, presumably as the Anthropic tests were run through Claude Code as shipped, without the same parameters as each of the other models were. The reasons for this are unclear.
Anthropic has released more powerful models since that report's release, namely Mythos, which remains its most powerful to date and thus out of public distribution. Cisco is a member of Anthropic's Project Glasswing, which gives it exclusive access to Mythos.
Despite this, Mythos was not mentioned in Cisco's Antares announcement or testing materials.
According to Karbasi, Antares supports workflows such as locating files related to a common weakness enumeration (CWE) category in a repository snapshot, triaging advisory-driven security investigations, and augmenting static analysis with model-driven repository exploration.
It also supports a shift-left security stance with continuous integration and continuous delivery/deployment (CI/CD) triage workflows where likely vulnerable files need early review, and local security analysis in environments with strict privacy or compliance needs.