We open-weighted Antares today — open models for agentic vuln localization. Pointed one at the community reconstruction of the Devin sec evals: same recall band as a $90/run agent for ~$0.56, ~160x cheaper per run, and it runs on your laptop. (Just my own poking around, personal takes.)

Put it on a cost-capability axis and it stops being close. Recall per $10, Antares is off the chart and the hosted tools are slivers: a 350M buys ~150x more vulnerability detection per dollar than a frontier-scale security agent. Small + open is just a different curve.

None of this runs without @Matt Rickard, who rebuilt 34 of the 50 fixtures in the open (http://github.com/r2d4/devin-security-evals…), since the original eval wasn't released. Security benchmarks are most useful when anyone can reproduce and audit them, so it'd be great to see Devin open theirs too. Huge thanks to Matt for making this possible.

What shipped today: Antares-350M and Antares-1B, open-weight on HF, small models built to localize vulnerabilities in a codebase, local enough that your source never leaves the machine. http://huggingface.co/collections/fdtn-ai/antares…

Method: no swarm, no frontier backbone, no task fine-tuning. Just the model + inference-time best-of-N, sample 5 times, union the files it flags. recall@any (≥1 target file, false positives ignored), the same grade Devin security-evals use.

To be clear on scope: this is the public 34/50 reconstruction, not Devin's exact set, and Security Swarm is a hosted product, so it's a directional comparison, not a head-to-head.

Vulnerability localization shouldn't cost $90 a run or ship your source to someone else's cloud. Antares is small, open, and fast enough to gate every commit, try it out today: http://huggingface.co/collections/fdtn-ai/antares… http://cisco-foundation-ai.github.io/antares/technical-report.pdf…