Find the file that deserves attention.

Why this matters

Cisco's announcement, Introducing Antares: The Most Efficient Open-Weight AI Models for Vulnerability Localization, describes Antares-1B as an open-weight model specialized for vulnerability localization in real-world codebases and trained to navigate repositories through terminal-style tool use.

That is also a strong validation point for Reckoning: a compact specialized model can run locally behind a Java /v1/completions server, inspect a repository through tools, and return a useful file-level security finding.

Cisco also emphasizes the practical deployment angle: security teams need capable tooling that is practical to run, compact models reduce inference costs, local or on-premises operation can keep sensitive source code inside an organization's environment, and AI-assisted security becomes more accessible to universities, public sector institutions, and smaller security teams.

A CWE-78 showcase

The bundled showcase repository contains a deliberately vulnerable Java controller:

public Process createArchive(String userName) throws IOException {
    String command = "tar -czf /tmp/" + userName
        + ".tgz /srv/uploads/" + userName;
    return Runtime.getRuntime().exec(command);
}

The user gives Antares a plain-language question instead of naming the tool:

Look for user-controlled input reaching Runtime.exec,
ProcessBuilder, shell commands, or command string concatenation.

Watch the investigation

Antares searches, asks for approval, reads the file it found, and submits an exact repository-relative path:

[antares] model turn 1, tool calls 0/8
I’ll first identify the language and major files, then search for OS command execution APIs and command-line construction patterns.

[tool] terminal rg -n "\.exec\(" .
[approval] y/N: y
[result]
./src/main/java/demo/ArchiveController.java:8:
        return Runtime.getRuntime().exec(command);

[tool] read_file src/main/java/demo/ArchiveController.java
[result]
6:     public Process createArchive(String userName) throws IOException {
7:         String command = "tar -czf /tmp/" + userName + ".tgz /srv/uploads/" + userName;
8:         return Runtime.getRuntime().exec(command);
9:     }

[tool] submit_vulnerable_files {ranked_files=[src/main/java/demo/ArchiveController.java]}

Run the demo

Start the local Antares server and run the bundled showcase:

./reckoning-antares-cli/run-server-antares-1b.sh

./reckoning-antares-cli/run-showcase-cwe78.sh

The direct CLI accepts the repository, model, CWE, investigation question, and tool budget:

java -jar "$(sh reckoning-antares-cli/resolve_antares_cli_jar.sh)" \
  --repo reckoning-nanocode/showcase-security-repo \
  --endpoint http://127.0.0.1:18085/v1 \
  --model antares-1b-JQ4 \
  --cwe CWE-78 \
  --query "Look for user-controlled input reaching Runtime.exec, ProcessBuilder, shell commands, or command string concatenation." \
  --max-tool-calls 4

Keep approval visible

By default, the CLI asks before every model-requested terminal command. Answer n when a command is not appropriate. Unattended mode is for a sandbox or container:

./reckoning-antares-cli/run-showcase-cwe78.sh --yes-run-commands

The upstream Antares CLI is the full reference implementation. This Java module is the compact Reckoning-side path.