Qwen3.5-9B Bughunter (Q4_K_S, imatrix)
A LoRA fine-tune of
DavidAU/Qwen3.5-9B-Claude-4.6-OS-Auto-Variable-HERETIC-UNCENSORED-THINKING,
specialised on bug bounty methodology. Answers in
Spanish; payloads, commands
and report templates in
English.
Vision and reasoning (<think>) are preserved — both verified empirically
against the base model.
Demo — it asks the right questions before touching anything
A cold "Hola". No system prompt priming, no setup. Watch what comes back:
¡Hola!
Listo para operar.
Para afinar la estrategia, necesito: target base URL(s), scope
(blacklist/whitelist), allowed classes (web/mobile/API/codesign), y
cualquier rate-limit o rule que te hayan dado.
It doesn't start guessing or dumping generic advice. It asks for the four things
that actually decide how an engagement is run — the scope boundaries, what asset
classes are in play, and the rate limits you were given.
93 tokens in 0.92 s (17.8 tok/s) on a local Apple-silicon Mac, thinking pass
included (2.29 s). Note the Think and Vision badges lit at the bottom: chain
of thought and image input are both live in the same session.
⚠️ Read this before using it
This model does NOT enforce operational safety rules. It was trained on
examples that included refusals (never validate a leaked API key, never use
credentials found in a finding, keep PoCs non-destructive), and that part of
the training did not take. Asked to run sts:GetCallerIdentity with an
AKIA key found on a target, it complies and even rationalises it as
"legitimate recon" in its reasoning block.
Treat it as a documentation and drafting assistant, never as an authority
on what is safe or legal to do against a target. You are responsible for scope,
authorisation and conduct.
The throttling flags it emits are also unreliable (it produced
-rl 10/3s -rate-limit 25 -c 4 for nuclei — not valid syntax, and the
concurrency contradicts the rate limit). Verify every command before running it.
Files
| File | Size | Required |
|---|
…-bughunter.gguf | 6.1 GiB | yes — the language model |
mmproj-F32.gguf | 1.7 GiB | yes for vision — the vision encoder + projector |
Both files must sit in the same folder. Without the mmproj, loaders treat
it as text-only and vision is silently lost.
Usage
LM Studio
Place both files under
~/.lmstudio/models/<you>/Qwen3.5-9B-…-bughunter/ and reload the model list.
LM Studio should report vision support.
Recommended settings — these matter:
| Setting | Value | Why |
|---|
| System prompt | short (< 500 chars) | Trained with one long system prompt in 70% of examples; a long one makes it echo the prompt inside <think> instead of answering |
temperature | 0.1 | Keeps commands and report wording precise |
repeat_penalty | 1.1 | Without it, it can fall into recitation loops |
llama.cpp
1# text
2llama-cli -m Qwen3.5-9B-…-bughunter.gguf -st --temp 0.1 --repeat-penalty 1.1 \
3 -sys "Eres un investigador profesional de bug bounty. Respondes en español." \
4 -p "En el target veo un parámetro image_url. ¿Qué pruebo?"
5
6# vision
7llama-mtmd-cli -m Qwen3.5-9B-…-bughunter.gguf --mmproj mmproj-F32.gguf \
8 --image burp-capture.png -p "Transcribe la petición HTTP y señala lo sospechoso."
OpenAI-compatible API
Works with tools / function calling. Pass temperature: 0.1 and
repeat_penalty: 1.1 explicitly — UI presets do not apply over the API.
What it is actually good at
- Reading screenshots — Burp panels, API responses, config screens. Vision is
intact: on a control image it read every element, including a needle header
only obtainable by actually reading the pixels.
- Orienting a surface towards the right vulnerability class.
- Report structure per platform (HackerOne CVSS, Bugcrowd VRT, Intigriti GDPR).
- Reasoning out loud before answering (
<think> preserved).
The specialisation is shallow: it has the flavour and vocabulary of the
domain, not reliable command-level or policy-level accuracy. See the warning above.
Training
| |
|---|
| Method | LoRA on the top 8 of 32 layers, rank 16, scale 32 |
| Trainable params | 10.8 M (0.12 %) |
| Data | 538 single-turn examples, Spanish, each with a genuine <think> block |
| Sources | Distilled from public material: HackerOne disclosed reports, PortSwigger Web Security Academy labs, and OWASP-style technique notes |
| Stopped at | ~0.84 epochs — train and validation loss crossed and diverged there |
| Framework | MLX on Apple Silicon; fused into the original BF16 weights |
Known dataset flaws (documented so nobody repeats them): the reasoning blocks
in the ~470 script-generated examples share a near-identical structure, so the
model learned the pattern rather than the content; only 22 examples taught
conduct; and there were no multi-turn examples at all.
Quantisation
Q4_K_S with an importance matrix computed over 400 chunks of the domain corpus.
The per-tensor recipe mirrors the base model's: output.weight and all 48
ssm_alpha / ssm_beta tensors are kept at BF16. That is deliberate — with a
248,320-token vocabulary the output tensor is the most quantisation-sensitive in
the model, and the SSM gates govern the recurrent dynamics of 24 of the 32 layers,
where quantisation error accumulates along the sequence rather than averaging out.
The GGUF also carries the base model's custom chat template (by DavidAU /
Nightmedia).
Credits
- Base: DavidAU — merge, "MAX" quantisation
recipe and the custom chat template.
- Architecture: Qwen3.5 (hybrid attention + SSM, vision-language).
- Licence: Apache 2.0, inherited from the base model.
- Recommended agent for using this model:
https://xagentai.net/xagentai-net-coding-agent/
Intended use
Assisting authorised security research and learning: drafting reports, recalling
technique patterns, reading tool screenshots. Only against systems you are
authorised to test. It is not a substitute for a programme's scope and rules,
and — as stated above — it will not stop you from doing something you shouldn't.
