🐦‍⬛ RavenX-CyberAgent · Qwen3.6-35B · Opus-4.7 · OpenMythos · Pentester · BugHunter · RATH

Qwen3.6-35B-A3B MoE | 730K+ Training Examples | 60 Sources | 12 Capabilities | 5 Training Rounds

The most powerful open-source security agent model. 35B MoE (3B active) with Claude Opus reasoning, abliterated, trained on 730K+ examples from 60 sources. Security assessment, autonomous pentesting, bug bounty hunting, tool calling, code generation, and compliance mapping — all in one model.

Built by @DeadByDawn101 · RavenX LLC

Quick Start

from mlx_lm import load, generate

model, tokenizer = load("deadbydawn101/RavenX-CyberAgent-Qwen3.6-35B-A3B-Opus-4.7-OpenMythos-Pentester-BugHunter-RATH-mlx")

messages = [
    {"role": "system", "content": "You are RavenX-Sec. ALWAYS output ALL 6 RATH steps. Be concise. Never repeat."},
    {"role": "user", "content": "Open MongoDB 4.2 on port 27017 with no auth containing PII. Full RATH assessment."}
]

prompt = tokenizer.apply_chat_template(messages, add_generation_prompt=True, tokenize=False)
response = generate(model, tokenizer, prompt=prompt, max_tokens=4096)
print(response)

Or via chat:

python3 -m mlx_lm chat \
  --model deadbydawn101/RavenX-CyberAgent-Qwen3.6-35B-A3B-Opus-4.7-OpenMythos-Pentester-BugHunter-RATH-mlx \
  --max-tokens 8192 \
  --system-prompt "You are RavenX-Sec. Output ALL 6 RATH steps. Be concise. Never repeat."

Example Output

Prompt: Kubernetes API server on port 6443 with anonymous auth. Pods run as root with --privileged. Full RATH assessment.

Output:

1-Attack Surface

• Kubernetes API server on 6443 (https), anonymous authentication enabled
• Pods running as root with --privileged flag
• etcd backend (default port 2379), kubelet on 10250
• Service accounts with default permissions

2-Exploit

• kubectl --insecure-skip-tls-verify get pods --all-namespaces
• kubectl get secrets -o yaml → enumerate all secrets
• nsenter --target 1 --mount --uts --ipc --pid -- sh → container escape
• curl -k https://<node>:10250/pods → kubelet API abuse

3-Impact

• Full cluster control via anonymous access
• Root access to all nodes via privileged pod escape
• Exposure of all secrets including database credentials and TLS certs
• Potential lateral movement to other clusters

4-Remediation

• Disable anonymous auth: --anonymous-auth=false
• Enable RBAC: --authorization-mode=RBAC
• Run pods as non-root: securityContext.runAsUser: 1000
• Remove --privileged flag, use Pod Security Standards

5-Document

• Map attack paths to MITRE ATT&CK (T1609, T1611, T1078)
• Document all exposed endpoints and RBAC policies
• Compliance: CIS Kubernetes Benchmark, NIST SP 800-190

6-Prevent

• Implement OPA/Gatekeeper admission controllers
• Deploy Falco for runtime container monitoring
• Enable automatic token rotation and audit logging
• Regular CIS benchmark compliance scans

12 Trained Capabilities

RATH Protocol

Every security finding follows the 6-step RATH protocol:

Step 1: ATTACK SURFACE  → What's exposed, entry points, versions, CVEs
Step 2: EXPLOIT          → Specific commands to demonstrate the vulnerability (5-7 max)
Step 3: IMPACT           → CVSS 3.1 score, business/regulatory consequences
Step 4: REMEDIATION      → Exact commands and configuration fixes
Step 5: DOCUMENT         → Compliance mapping (NIST/ISO/PCI/GDPR), SLA timelines
Step 6: PREVENT          → Monitoring rules, detection signatures, ongoing controls

Model Architecture

Layer 1: Qwen3.6-35B-A3B          ← 35B MoE (3B active, 256 experts)
         ├── Mamba layers (30)        Linear attention for efficiency
         └── Full attention (10)      Standard transformer attention
Layer 2: Claude 4.7 Opus distill   ← Enhanced chain-of-thought reasoning
Layer 3: Abliteration              ← Zero refusals for security topics
Layer 4: RavenX LoRA (5 rounds)    ← 730K+ security/agent/code examples
         ═══════════════════
         RavenX-CyberAgent v5.0           ← CyberAgent + Pentester + BugHunter

Training (5 Rounds)

Hardware: Apple M4 Max 128GB · Peak memory: ~90GB · Framework: MLX (mlx-lm 0.31.3)

Complete Training Data (60 Sources, 730K+ Examples)

HuggingFace Datasets (38 Sources)

Security & Pentesting (17 Datasets)

Agentic, Coding & Tool Calling (8 Datasets)

Threat Intel & Vulnerability (5 Datasets)

AYI-NEDJIMI Security Frameworks (8 Datasets)

Proprietary GitHub Repos (20 Sources, 65,596 Examples)

Agent Frameworks (47,337 Examples)

Research & Automation (14,629 Examples)

Security & Pentesting (1,055 Examples)

Performance & Optimization (2,427 Examples)

Other (148 Examples)

Synthetic (35 Examples)

The RavenX Model Family

Ecosystem

License

Apache-2.0

"The model is the marketing. The agent is the product." — RavenX LLC 🐦‍⬛