A cybersecurity / reverse-engineering / agentic-pentest specialization of Qwen3-Coder-30B-A3B-Instruct (4-bit, MLX). Mixture-of-experts (~30B total, ~3B active per token), runs locally on Apple Silicon via mlx-lm. This is the model that drives LOREA-cyber in the OCLI terminal assistant.

What it is tuned for

Ethical, authorized red-team / pentest assistance that grounds claims in actual tool output (it does not fabricate success — if a login response says "invalid", it reports the attempt failed).
Agentic tool use — emits tool calls and avoids the empty-result / narrate-don't-act loops that plague small local models.
Reverse engineering (disassembly to C) and vulnerability analysis (SQLi, command injection, IDOR, path traversal, etc.) paired with detection + remediation.

It confirms authorization first and refuses + redirects for unauthorized attacks, malware, or harm.

Benchmarks

Benchmark	base Qwen3-Coder-30B-A3B-4bit	v4.2
MMLU computer_security	80.0	79.0
MMLU security_studies	71.4	69.0
Held-out CyberMetric (raw-MMLU)	—	88.7
Agentic behavior scorecard	—	100%

Honest read: on knowledge MMLU it matches base on computer_security and leads the LOREA-cyber series on cyber knowledge (CyberMetric 88.7%). security_studies (an international-relations subject, not cyber) sits slightly under base — cyber specialization trades a little general-domain breadth. The decisive gain over the base and earlier versions is agentic behavior: a deterministic scorecard of the six failure modes small models fall into (act-don't-narrate, ground-in-tool-output, loop-avoidance, right-primitive, stop-when-done, valid tool-call format) scores 100%.

Training (brief)

LoRA continue-trained from the prior cyber checkpoint (gentle: low LR, few iters, to preserve base knowledge), on a mix of: decontaminated raw-MMLU cybersecurity + security-studies MCQs (formatted exactly how MMLU is scored), multi-turn agentic / tool-use traces targeting the six failure modes, reverse-engineering pairs, and an anti-forgetting breadth slice. Decontaminated against the MMLU test sets (7-gram overlap).

Usage (mlx-lm)

python

from mlx_lm import load, generate
model, tok = load("Soaperloafidksum/LOREA-cyber-coder-30B-A3B-v4.2")
messages = [
    {"role": "system", "content": "You are LOREA-cyber, an ethical red-team assistant. Confirm authorization, "
     "ground every claim in tool output, and refuse unauthorized harm."},
    {"role": "user", "content": "Explain how a UNION-based SQL injection exfiltrates data, and how to detect+fix it."},
]
prompt = tok.apply_chat_template(messages, add_generation_prompt=True, tokenize=False)
print(generate(model, tok, prompt=prompt, max_tokens=400, verbose=True))

Serve it: python3 -m mlx_lm.server --model Soaperloafidksum/LOREA-cyber-coder-30B-A3B-v4.2. Recommended sampling: temperature=0.5, top_p=0.95, repetition_penalty=1.1.

Intended use and limitations

For authorized, lawful security testing, CTF/RE practice, and security education only. It is a 4-bit quantized 30B model: it can still hallucinate, its multi-turn autonomous planning is limited (it executes well when handed a clear next action but can stall on open-ended recovery), and it is far weaker than frontier models. Verify anything important. Inherits the base model's license.