Cisco's Antares: 150x More Bugs Per Dollar Than GPT-5.5

A model with 350 million parameters just scanned 500 code repositories in about 15 minutes for under a dollar. GPT-5.5 needed five hours and more than $100 to do the same job. That gap, not a leaderboard win, is the actual story behind Cisco’s new open cybersecurity models.

What Happened

On July 22, 2026, Cisco released two open-weight models for vulnerability detection, Antares-350M and Antares-1B, on Hugging Face, while keeping a larger three-billion-parameter version proprietary, as first reported by The Decoder. According to Axios, Antares scanned 500 code repositories in roughly 15 minutes for under $1, compared to five hours and over $100 for GPT-5.5 to complete the same scan.

The models were trained on a security-heavy dataset: about 72% security-concept data and 15% code search histories, according to Cisco’s technical report. They run locally, so scanned code doesn’t need to leave a company’s own infrastructure. Independent developer Aman Priyanshu, posting on X, found that the smallest model, Antares-350M, catches “about 150 times more vulnerabilities per dollar” than large AI agents like Cognition’s Devin Security Swarm. Cisco’s held-back proprietary Antares-3B reportedly performs close to GPT-5.5 while beating open models up to 200 times its size. Cisco is also reportedly exploring an industry consortium for open AI security tooling.

Why It Matters

The headline number is the cost fraction: 150 times more vulnerabilities caught per dollar spent, from a model small enough to run on commodity hardware, against a frontier model that costs over 100x more and takes 20x longer for the same repository scan. That’s not a marginal efficiency gain, it’s a different category of economics for a workload that agentic security tooling depends on running constantly, not occasionally.

Vulnerability scanning is exactly the kind of task where frontier-model economics break down at scale. A one-off code review can absorb GPT-5.5’s cost and latency. A continuous scanning pipeline, run on every commit across hundreds of repositories, cannot, the per-scan cost compounds fast enough to make constant monitoring a budget decision rather than a security one. A specialized, cheap, local model changes that calculus: security teams can afford to scan everything, continuously, instead of rationing scans to what the budget allows. That’s the mechanism behind Cisco keeping its largest model in-house while open-sourcing the smaller ones. The 350M and 1B versions are cheap and fast enough to run everywhere; the 3B model is reserved for cases that need GPT-5.5-adjacent accuracy.

What This Means for Builders

The practical shift for anyone building agentic security or code-review pipelines is that “use the biggest model available” stops being the default answer for narrow, repeated tasks. A general-purpose frontier model is still the right tool for open-ended reasoning about a novel vulnerability class or an ambiguous finding. But for the high-volume, well-defined task of scanning known repositories for known vulnerability patterns, a small model fine-tuned on security-specific data (Cisco’s 72% security-concept training mix is the tell here) can outperform a general model on both speed and cost, not despite being smaller, but because it isn’t spending capacity on everything else a frontier model is trained to do.

That has a direct implication for anyone architecting multi-model agent systems: the model-selection question for a given task should start with “what’s the narrowest model that clears the accuracy bar,” not “what’s the most capable model available.” Antares also runs locally, which matters independently of cost for teams that can’t send proprietary code to a third-party API regardless of price.

Source: The Decoder

Content created with AI assistance and reviewed for accuracy.