Con0
Con0 is a state-of-the-art vision-language model specialized for cyber security, developed by Arcanic AI in collaboration with NextZero.
Con0 is built to think like a security auditor. It reads code, logs, screenshots, and infrastructure diagrams, and surfaces vulnerabilities - from classic web-application flaws to the newest AI-agent attack surfaces - with actionable remediation guidance.
What Con0 audits
Web & application security
- SQL injection (SQLi) - time-based, boolean-based, error-based, and blind variants across query builders and ORMs
- Cross-site scripting (XSS) - reflected, stored, and DOM-based injection
- Cross-site request forgery (CSRF), server-side request forgery (SSRF)
- Command injection, path traversal, XXE, deserialization
- Broken authentication, broken access control, and IDOR
- OWASP Top 10 coverage, code review, and secure-configuration assessment
AI & agent security
- Prompt injection and jailbreak surface analysis
- Tool-calling and function-dispatch misuse
- Least-privilege / permission-scope review
- Multi-step agent threat modeling
General security
- Vulnerability triage and CVE context mapping
- Incident analysis from logs, traces, and screenshots
- Secure-code guidance and remediation planning
Model architecture
- 27B parameters, hybrid Gated DeltaNet + full attention
- Native vision-language model (image + video + OCR)
- 262,144-token context window
- Flexible reasoning (thinking) control and tool calling
Benchmarks
Benchmark evaluation is in progress and will be published here.
| Benchmark | Con0 | Baseline (Qwen3.8-27B) |
|---|---|---|
| SQLi Detection | pending | pending |
| XSS Detection | pending | pending |
| OWASP Top 10 (aggregate) | pending | pending |
| Secure Coding | pending | pending |
| Prompt-Injection Detection | pending | pending |
| MMLU | pending | 84.7 |
| GSM8K | pending | 90.0 |
Usage
from transformers import AutoModelForMultimodalLM, AutoProcessor
import torch
model = AutoModelForMultimodalLM.from_pretrained(
"arcanicai/Con0", torch_dtype=torch.bfloat16, device_map="auto"
)
processor = AutoProcessor.from_pretrained("arcanicai/Con0")
messages = [{"role": "user", "content": "Review this code for SQL injection vulnerabilities."}]
text = processor.apply_chat_template(messages, tokenize=False, add_generation_prompt=True)
inputs = processor(text=[text], return_tensors="pt").to(model.device)
output = model.generate(**inputs, max_new_tokens=512)
print(processor.decode(output[0], skip_special_tokens=True))
About the developers
Con0 is developed by Arcanic AI, a research lab focused on reliable and secure AI systems, in partnership with NextZero.
License
Apache 2.0.