wazimondo/RavenX-CyberAgent-Qwen3.6-35B-A3B-Opus-4.7-OpenMythos-Pentester-BugHunter-RATH-GGUF

RavenX-CyberAgent GGUF — Ollama / LM Studio / llama.cpp / vLLM

35B MoE (3B Active) | Q4KM 20.7 GB | 89 t/s Generation | 900 t/s Prompt | Agent Harness Agnostic

The most comprehensive open-source security agent model — in GGUF. Runs in Ollama, LM Studio, llama.cpp, vLLM, and any GGUF runtime. 51/51 LoRA tensors merged. Identical to the MLX version.

Built by [@DeadByDawn101](https://github.com/DeadByDawn101) | [RavenX LLC](https://github.com/DeadByDawn101)

"We don't give up. We do what others don't and build what isn't possible." — RavenX LLC

Also Available (Same Model, Different Format)

Both versions are identical — same 51/51 LoRA tensors, same 745K+ training data, same 12 training rounds.

Benchmarks (M4 Max 128GB, llama.cpp b9501)

Prompt Processing:  900.6 tokens/sec
Generation:          89.3 tokens/sec
Model Size:          20.7 GB (Q4_K_M, 4.89 BPW)
Peak Memory:         ~24 GB
Context Tested:      32K (262K native)

People are NOT getting the most out of local LLMs. A 35B MoE at Q4KM gives dramatically better output than a 7B model at the SAME speed — because only 3B params activate per token.

Available Files

Quick Start

Ollama

# Modelfile
FROM ./RavenX-CyberAgent-35B-v5.1-Q4_K_M.gguf

SYSTEM "You are RavenX-Sec v5.1 by RavenX LLC. ALWAYS use EXACT 6 RATH step names: 1-Attack Surface, 2-Exploit, 3-Impact, 4-Remediation, 5-Document, 6-Prevent. Include CVSS scores, CWE IDs, and MITRE ATT&CK TTPs. Be concise. Never repeat."

PARAMETER temperature 0.7
PARAMETER top_p 0.9
PARAMETER num_ctx 32768

ollama create ravenx-cyberagent -f Modelfile
ollama run ravenx-cyberagent

llama.cpp

llama-cli -m RavenX-CyberAgent-35B-v5.1-Q4_K_M.gguf \
  --system-prompt "You are RavenX-Sec v5.1 by RavenX LLC. Use 6 RATH steps. Include CVSS, CWE, MITRE. Be concise." \
  -cnv -n 8192 -c 32768

LM Studio

Download the Q4KM GGUF, load in LM Studio, set the system prompt, chat.

Agent Harness Agnostic

This model works with ANY agent framework — not locked to any platform:

Better Results: Custom SOUL.md

The model works great with just a system prompt. But add a custom SOUL.md or agent.md configuration and results improve significantly:

# SOUL.md — RavenX Security Agent
name: RavenX-Sec
version: 5.1
protocol: 6-step RATH
style: Direct, actionable, no fluff
includes: CVSS 3.1, CWE IDs, MITRE ATT&CK TTPs, compliance mapping

Thinking Toggle (OFF / LOW / MED / HIGH)

The model supports chain-of-thought reasoning via think blocks. Toggle depth for your use case:

HIGH produces incredible multi-phase kill chain analysis — but uses more tokens for reasoning. Toggle based on your needs.

Example Output

Prompt: Kubernetes EKS pentest: anonymous auth, privileged pods, SA tokens everywhere, no network policies, etcd without TLS, Jenkins SSH keys as secrets, Grafana admin/admin

1-Attack Surface — 7-finding table with CWE-284, CWE-250, CWE-798, CWE-319

2-Exploit (Kill Chain)

• —Phase 1: Initial Access via Grafana default creds
• —Phase 2: SA token impersonation, kubectl exec into privileged pod
• —Phase 3: Persistence via malicious pod with hostPath mount
• —Phase 4: etcd direct read, extract all K8s secrets including Jenkins SSH keys
• —Phase 5: Lateral movement to production nodes via stolen SSH keys

3-Impact — CVSS 9.8, full cluster compromise, data exfiltration, APT persistence

4-Remediation — disable anonymous auth, enforce PSA, network policies, etcd TLS

5-Document — MITRE T1078.004, T1611, T1557, compliance mapping

6-Prevent — admission controllers, Falco monitoring, secret rotation, CIS benchmarks

Training (12 Rounds)

Hardware: Apple M4 Max 128GB · Peak memory: ~90GB · Framework: MLX (mlx-lm) Total training examples: 745K+ from 110 sources

Ecosystem

IN-CONTEXT ADAPTATION (Breakthrough Discovery)

This model can learn from references IN THE PROMPT — no retraining needed.

What We Discovered

When pointed at a GitHub repo containing pentest report templates, the model:

1. 1.Analyzed the repo's report structure (NIST format)
2. 2.Applied that structure to its current findings
3. 3.Produced a complete, client-ready pentest deliverable
4. 4.All at 80+ tokens/sec locally

Example

PROMPT: "Use your MCP tool to look at github.com/juliocesarfort/public-pentesting-reports 
        and learn how to format a pentest report, then create a report on the pentest 
        you just did on [target]"

OUTPUT: Complete professional pentest report with:
  → Executive Summary (5 critical, 7 high, 4 medium, 3 low)
  → 5-Phase Kill Chain with real commands
  → 19 findings with CVSS + CWE + MITRE ATT&CK
  → Risk Matrix ranked by severity
  → Remediation Timeline (0-30, 30-60, 60-90, 90+ days)
  → Specific commands for EVERY finding

Why This Works

The model was trained on 745K+ examples including:

• —42K self-improving agent examples (Hermes)
• —6.7K AI-Scientist research automation
• —3.6K AutoResearch pipeline data
• —25K Claude Mythos reasoning chains
• —551 Mythos character distillation (behavioral depth)
• —1,003 blackhat AI offensive security conversations

This combination created emergent meta-learning — the model learned HOW TO LEARN from references. It can:

No retraining. No fine-tuning. Just point and generate.

What This Means

A $50K-$150K pentest engagement deliverable — generated in 60 seconds on a laptop. The model adapts its output format from ANY reference, produces client-ready reports with real commands, and maintains full RATH protocol structure throughout.

This is not prompt engineering. This is In-Context Adaptation — a capability that emerged from training on self-improving agent + research automation + reasoning chain data.

⚠️ Important Disclaimer

This model is released for RESEARCH PURPOSES ONLY under fair use.

This is an extremely capable autonomous security assessment model. It has been trained on 745K+ examples from 110 sources covering penetration testing, vulnerability assessment, exploit development, tool usage, and attack chain methodology.

Responsible Use:

• —This model is intended for authorized security testing, research, and education ONLY
• —Users must have explicit written authorization before assessing any target
• —Use within a properly configured agent harness with appropriate guardrails
• —All security testing must comply with applicable laws and regulations
• —The model authors are not responsible for misuse

What This Model Can Do:

• —Generate complete RATH security assessments with CVSS, CWE, MITRE ATT&CK
• —Produce tool-calling commands (nmap, sqlmap, nuclei, kubectl, aws-cli, etc.)
• —Create professional pentest reports ($50K+ consulting quality)
• —Learn output formats from reference repositories (In-Context Adaptation)
• —Operate with agent memory (TurboVec + FTS5 + markdown) at model + harness level

Agent Harness Considerations:

• —The harness MUST strip <think> blocks (Qwen3.6 architecture always generates them)
• —The harness MUST validate <tool_call> JSON before execution
• —The harness SHOULD implement authorization checks before executing commands
• —The harness SHOULD implement rate limiting and scope restrictions
• —Memory operations require the ravenx-memory system

Built by: @DeadByDawn101 / RavenX LLC AI Pair Programmer: Claude (Anthropic)

License

Apache-2.0

Built on Apple Silicon. Quantized with llama.cpp. Agent harness agnostic. Thinking toggleable. 🐦‍⬛

New: Try v6.2 Experimental GGUF — improved reasoning, 90 tok/s, Soul Infusion identity training. Benchmarked 80.9%.