Antares-3B beats models 200x its size on vulnerability scans

Antares-3B closes in on GPT-5.5's vulnerability-localization accuracy, using a 3-billion-parameter model built on IBM's Granite base, per the arXiv paper posted August 3.

That's the story for builders: a full 500-task evaluation sweep finishes in about 15 minutes on one H100. Amortized, that's under 2 seconds and under $0.002 per task, cheap enough for continuous scanning inside a CI budget, not a frontier-API one.

Training combines supervised fine-tuning on cybersecurity reasoning and repository-exploration data with reinforcement learning from verifiable rewards run over vulnerable repositories, per the paper.

It ships in three sizes: 350M, 1B, and 3B parameters.

Size-adjusted, the 3B version beats open-weight models 200 times larger, per the paper.

The paper doesn't say whether the gains hold on vulnerability classes outside its training repositories or on codebases in unfamiliar languages.

A related paper found that post-training on office workflows, with no software-engineering tasks included, still improved SWE-Bench Pro results. It's more evidence that domain-specific training data can matter more than raw parameter count.

At that price, running vulnerability localization on every pull request costs less than the CI minutes it takes to execute. That turns it from a paid security vendor's product into a default CI step, assuming the accuracy holds outside the paper's benchmark repos.

Posted to arXiv August 3, the paper puts a per-task price on agentic vulnerability scanning at this model size for the first time.