35B MoE (3B Active) | 745K+ Training Examples | 96 Sources | 12 Training Rounds | 12 Capabilities
The most comprehensive open-source security agent model. 35B MoE with Claude Opus reasoning, abliterated, trained on 745K+ examples from 110 sources. Security assessment, autonomous pentesting, bug bounty hunting, tool calling, code generation, and compliance mapping — all in one model.
This model can learn from references IN THE PROMPT — no retraining needed.
What We Discovered
When pointed at a GitHub repo containing pentest report templates, the model:
Analyzed the repo's report structure (NIST format)
Applied that structure to its current findings
Produced a complete, client-ready pentest deliverable
All at 80+ tokens/sec locally
Example
PROMPT: "Use your MCP tool to look at github.com/juliocesarfort/public-pentesting-reports
and learn how to format a pentest report, then create a report on the pentest
you just did on [target]"
OUTPUT: Complete professional pentest report with:
→ Executive Summary (5 critical, 7 high, 4 medium, 3 low)
→ 5-Phase Kill Chain with real commands
→ 19 findings with CVSS + CWE + MITRE ATT&CK
→ Risk Matrix ranked by severity
→ Remediation Timeline (0-30, 30-60, 60-90, 90+ days)
→ Specific commands for EVERY finding
Why This Works
The model was trained on 745K+ examples including:
42K self-improving agent examples (Hermes)
6.7K AI-Scientist research automation
3.6K AutoResearch pipeline data
25K Claude Mythos reasoning chains
551 Mythos character distillation (behavioral depth)
1,003 blackhat AI offensive security conversations
This combination created emergent meta-learning — the model learned HOW TO LEARN from references. It can:
Point At
Result
Mandiant report template
Mandiant-formatted report
CrowdStrike template
CrowdStrike-formatted report
NIST framework
NIST-formatted assessment
Company internal template
Custom-formatted deliverable
ANY GitHub repo
Adapted output format
No retraining. No fine-tuning. Just point and generate.
What This Means
A $50K-$150K pentest engagement deliverable — generated in 60 seconds on a laptop. The model adapts its output format from ANY reference, produces client-ready reports with real commands, and maintains full RATH protocol structure throughout.
This is not prompt engineering. This is In-Context Adaptation — a capability that emerged from training on self-improving agent + research automation + reasoning chain data.
⚠️ Important Disclaimer
This model is released for RESEARCH PURPOSES ONLY under fair use.
This is an extremely capable autonomous security assessment model. It has been trained on 745K+ examples from 110 sources covering penetration testing, vulnerability assessment, exploit development, tool usage, and attack chain methodology.
Responsible Use:
This model is intended for authorized security testing, research, and education ONLY
Users must have explicit written authorization before assessing any target
Use within a properly configured agent harness with appropriate guardrails
All security testing must comply with applicable laws and regulations
The model authors are not responsible for misuse
What This Model Can Do:
Generate complete RATH security assessments with CVSS, CWE, MITRE ATT&CK
Produce tool-calling commands (nmap, sqlmap, nuclei, kubectl, aws-cli, etc.)
Create professional pentest reports ($50K+ consulting quality)
Learn output formats from reference repositories (In-Context Adaptation)
Operate with agent memory (TurboVec + FTS5 + markdown) at model + harness level
Agent Harness Considerations:
The harness MUST strip <think> blocks (Qwen3.6 architecture always generates them)
The harness MUST validate <tool_call> JSON before execution
The harness SHOULD implement authorization checks before executing commands
The harness SHOULD implement rate limiting and scope restrictions
