Software teams spend too much time turning public vulnerability reports into actionable fixes. Security advisories, CWE entries and CVE IDs describe the flaw in abstract terms, while the actual code lives in large, modular repositories with deep dependency trees. Developers must search unfamiliar code, follow naming conventions, trace call paths and compare many candidate files just to locate where the problem resides. This first‑triage step is where most of the cost in application security concentrates, yet existing tools—static scanners, dependency checkers, dynamic analyzers—either miss context‑specific issues or generate too many false positives, forcing experts to manual review.
Antares addresses this bottleneck by focusing a small language models that excel at one task: given a vulnerability description and a repository, return the files that likely contain the flaw. The models run inside a tight agent loop with three read‑only tools—terminal commands, a file submission call, and a “no vulnerability found” call—limited to 15 terminal interactions per task. This design forces the model to explore the codebase efficiently, produce a ranked list of suspect files, and stop when evidence is sufficient.
Because Antares is derived from IBM Granite checkpoints and further refined with supervised fine‑tuning and GRPO reinforcement learning, even the 350‑million‑parameter version outperforms much larger open‑weight models on the Vulnerability Localization Benchmark, while the 1‑billion‑parameter variant surpasses a 753‑billion‑parameter baseline. The approach needs only a modest GPU (a single H100 or equivalent) and costs under a dollar to scan 500 tasks, making it practical for CI pipelines or nightly scans. Teams retain their existing scanners for broader coverage but gain a targeted, low‑overhead triage step that reduces manual effort and speeds remediation.
Adopting Antares means shifting from expensive, guess‑driven searches to a guided, model‑assisted localization that fits easily into existing security workflows, lowers operational cost, and improves the signal‑to‑noise ratio of vulnerability findings.
#AI #Product #Security #DevSecOps #VulnerabilityManagement #OpenSource