Find → Classify → Fix → Verify → Report
The first security model that completes the full vulnerability lifecycle.
Built by @DeadByDawn101 (RavenX LLC)
Status: v1.0 — Autonomous security analysis proven
License: MIT — Security knowledge should be open.
RavenX-Sec is a fine-tuned LLM specialized in offensive security, vulnerability discovery, and real-time remediation. Unlike existing security LLMs that only find vulnerabilities, RavenX-Sec completes the full lifecycle.
Trained on the combined intelligence of five security toolchains, a world model for attack dynamics, and industry-standard compliance frameworks — this model understands both the attacker's perspective and the defender's playbook.
Every pentest report ends with a list of findings. Those findings sit in a Jira queue. A security TPM tracks them against SLAs. Developers scramble to remediate. Weeks pass. Some findings expire unpatched.
What if the model that found the vulnerability also generated the fix?
RavenX-Sec v1.0 (v0.5 checkpoint) produces autonomous 5-step security assessments:
| Step | What It Does | Example Output |
|---|---|---|
| 1. Environment Analysis | Identifies software, version, attack surface | "OpenSSH 7.4 from 2016, flagged as outdated" |
| 2. Threat Modeling | Maps attack vectors | "Code execution, 2FA bypass, privilege escalation, DoS" |
| 3. Framework Mapping | CVSS + NIST CSF + OWASP | "CVSS 9.8 (AV:N/AC:L/PR:N/UI:N), NIST Detect→Respond→Recover, OWASP A03+A04" |
| 4. Remediation | Distro-specific commands | "sudo apt upgrade -y / sudo dnf upgrade -y" |
| 5. Verification | Post-fix validation | "Run Lynis/ClamAV scan to confirm patch applied" |
| Version | Data | Loss | Output |
|---|---|---|---|
| v0.1 | 51K, rank 64, LR 2e-4 | 5.728 | ❌ Garbage (destabilized) |
| v0.2 | 51K, rank 16, LR 1e-5 | 0.021 | ✅ Basic classification |
| v0.3 | 51K, rank 32, LR 1e-5 | 0.021 | ✅ Full defense-in-depth |
| v0.4 | 321K, rank 32, LR 1e-5 | 0.027 | |
| v0.5 (v1.0) | 125K, rank 32, LR 1e-5 | 0.027 | 🏆 Full RATH protocol |
Key insight: Security-dominant data mix (58% security) + capped agentic data (50K) produces the best results. More data isn't always better — the right ratio matters.
┌──────────────────────────────────────────────────────────────────┐
│ RavenX-Sec Model │
│ │
│ ┌────────────┐ ┌────────────┐ ┌────────────┐ ┌────────────┐ │
│ │ Offensive │ │ Analytical │ │ Defensive │ │ Reporting │ │
│ │ │ │ │ │ │ │ │ │
│ │ Priv-esc │ │ CVSS score │ │ Code fixes │ │ POA&M │ │
│ │ Web pentest│ │ OWASP map │ │ Config │ │ Compliance │ │
│ │ API testing│ │ NIST CSF │ │ hardening │ │ SLA track │ │
│ │ RE/binary │ │ Kill chain │ │ Patch gen │ │ Executive │ │
│ │ Exploit │ │ ATT&CK │ │ Validation │ │ summary │ │
│ │ chains │ │ mapping │ │ Regression │ │ │ │
│ └────────────┘ └────────────┘ └────────────┘ └────────────┘ │
│ │
│ ┌──────────────────────────────────────────────────────────────┐ │
│ │ LeWM Security World Model │ │
│ │ Encodes system state → Predicts attack dynamics → │ │
│ │ Models remediation impact → Detects anomalies │ │
│ └──────────────────────────────────────────────────────────────┘ │
└──────────────────────────────────────────────────────────────────┘
| Layer | Component | Purpose |
|---|---|---|
| World Model | LeWM (JEPA) | Learns security system dynamics — predicts attack progression, models remediation impact, detects anomalous states |
| Compression | TriAttention | 10.7x KV cache compression for efficient long-context security reasoning |
| Training | MOOSE-Star | Tractable training for complex multi-step security reasoning chains |
| Fine-tuning | Jackrong Pipeline | QLoRA (4-bit) via Unsloth on security-specific instruction data |
| Base Model | Qwen3-8B | Foundation language understanding and code generation |
| Evaluation | GLM-5.1 | Judge model for quality validation of generated findings and fixes |
Traditional security models classify vulnerabilities from static text. RavenX-Sec understands dynamics — how systems evolve under attack and remediation.
Based on LeWorldModel (Maes et al., 2026), a Joint Embedding Predictive Architecture that learns world models from raw observations:
Security Applications:
| Capability | How It Works |
|---|---|
| Attack chain prediction | Encode current system state (ports, services, configs) → predict next state if vulnerability is exploited |
| Remediation impact modeling | Apply "fix action" to state → predict new state → verify vulnerability resolved with no regressions |
| Anomaly detection | Learn "normal" system dynamics → flag deviations that indicate compromise, lateral movement, or exfiltration |
| Offline learning | Train on historical pentest data, vulnerability scans, and incident logs without explicit reward signals |
Trajectory Training Format:
{
"trajectory": [
{"state": "port 22 open, SSH 7.4", "action": "scan", "t": 0},
{"state": "CVE-2018-15473 found", "action": "enumerate", "t": 1},
{"state": "valid user confirmed", "action": "exploit", "t": 2},
{"state": "shell obtained", "action": "remediate", "t": 3},
{"state": "SSH 8.9, hardened", "action": "verify", "t": 4},
{"state": "clean scan", "action": "done", "t": 5}
]
}The world model learns: given any (state, action) pair → predict the next state. This enables planning — simulating attack chains and remediation outcomes before they happen.
| Source Repo | What We Extract |
|---|---|
| hackingBuddyGPT | Linux priv-esc sequences, web pentest patterns, API testing, agent round logs |
| PentestGPT | CTF solutions, autonomous pentest sessions, XBOW benchmark (86.5%) |
| Shannon | White-box vuln discovery, exploit PoCs, source code → vulnerability mappings |
| Ghidra | RE methodology, binary analysis heuristics, malware indicators |
| Source | What We Extract |
|---|---|
| NIST NVD | CVE descriptions, CVSS vectors, CWE mappings (~250K CVEs) |
| OWASP Top 10 | Prevention checklists, remediation code examples |
| CIS Benchmarks | Hardening configs for Linux, Windows, cloud, containers |
| MITRE ATT&CK | Technique → mitigation mappings, detection rules |
| GitHub fix commits | Security fix diffs → remediation pattern extraction |
CVSS v3.1/v4.0 • NIST CSF 2.0 • ISO 27001 • PCI DSS v4.0 • HIPAA • SOX
| Source | What We Extract |
|---|---|
| Pentest engagement logs | Attack state trajectories with timestamps |
| Vulnerability scan histories | System state evolution over time |
| Incident response timelines | Compromise → detection → containment → recovery chains |
| Remediation tracking (POA&M) | Fix applied → verification → closure trajectories |
| Source | What We Extract |
|---|---|
| claude_mythos_distilled_25k | 25K high-quality distilled examples across 6 categories — cybersecurity (exploit chains, supply-chain attacks, model poisoning, detection-as-code), advanced coding (memory-safe implementations, formal verification, SIMD), agentic planning (autonomous agent architectures, self-critique loops), mathematical reasoning, scientific analysis. Apache-2.0 licensed. |
| Source | What We Extract |
|---|---|
| WithinUsAI/AgentAngel_100k | 500K rows across 5 splits (Q&A, instruct, thinking, reasoning, chat). Evidence-backed agentic coding with verification checks. CC0-1.0 licensed. |
| Source | What We Extract |
|---|---|
| JetBrains-Research/commit-chronicle | Millions of Git commits with code diffs, message histories, filters for security patches |
| bigcode/commitpack | Billions of tokens of code changes across 300+ languages, keyword/regex-matched fix patterns |
| ByteDance/PatchEval | 1,000 real-world vulnerabilities, 65 CWE categories, raw patch diffs with executable validation |
| Source | What We Extract |
|---|---|
| bigcode/vuln-eval | Evaluate capacity to recognize, isolate, and repair classic vulnerabilities |
| Fraser/cwe-benchmark | Source code mapped to CWE IDs — vulnerable syntax vs secure counterparts |
| Source | What We Extract |
|---|---|
| bigcode/the-stack-v2 | Filter by .yml/.yaml (Ansible), .tf/.hcl (Terraform), .sh (Shell) for IaC security baselines |
| codeparrot/github-code | Massive GitHub sweep, segmentable by language for production infrastructure-as-code |
| Source | What We Extract |
|---|---|
| HackerSignal Threat Intel | Historical cybersecurity docs, exploit scripts, PoCs linked to CVE lifecycle |
| isek/cybersecurity-instructions | Instruction-tuning with adversarial examples, RE walkthroughs, security scripting |
Extract interaction traces from source repos → normalize to instruction format → synthesize find→classify→fix chains → quality filter → ~500K examples
Train the security world model on system state trajectories:
- 15M parameters, single GPU (RTX 3090)
- Two-loss training: prediction loss + SIGReg anti-collapse
- Input: system state observations + security actions
- Output: predicted next system state in latent space
{
"base_model": "Qwen3-8B",
"method": "QLoRA (4-bit)",
"framework": "Unsloth + HuggingFace TRL",
"rank": 64,
"alpha": 128,
"learning_rate": 2e-4,
"max_seq_len": 8192,
"hardware": "RTX 3090 (24 GB VRAM + 64 GB UVM)"
}Apply MOOSE-Star training methodology for complex multi-step security reasoning.
GRPO for rewarding successful find→fix cycles and penalizing false positives.
- Mac nodes (312 GB): Host full model via oMLX
- Linux rig (RTX 3090): Accelerate compute-heavy layers
- TurboQuant bridge: Compressed KV for cross-backend transfer
- OpenClaw / Hermes: Security-specialized agent persona
- Claude Code: MCP tool server for real-time analysis
- CI/CD: Pre-commit security review hook
- Jira / ServiceNow: Automatic finding creation with remediation
RavenX-Sec/
├── data/
│ ├── offensive/ # From hackingBuddyGPT, PentestGPT, Shannon
│ ├── defensive/ # CVE fixes, CIS benchmarks, hardening
│ ├── analytical/ # CVSS, OWASP, NIST, ATT&CK mappings
│ ├── synthetic/ # Synthesized find→classify→fix chains
│ └── world_model/ # System state trajectories for LeWM
├── training/
│ ├── sft/ # Supervised fine-tuning (Jackrong method)
│ ├── lewm/ # LeWM world model training
│ ├── moose/ # MOOSE-Star enhancement
│ ├── rl/ # Future GRPO reinforcement learning
│ └── eval/ # Evaluation benchmarks
├── models/
│ ├── configs/ # Model and LoRA configurations
│ └── checkpoints/ # Training checkpoints
├── deploy/
│ ├── star-platinum/ # Cluster deployment configs
│ ├── agent/ # Agent persona definitions
│ └── api/ # OpenAI-compatible API server
├── tools/
│ ├── extract_hackingbuddy.py
│ ├── extract_pentestgpt.py
│ ├── extract_shannon.py
│ ├── extract_ghidra.py
│ ├── synthesize_chains.py
│ ├── build_trajectories.py # Build LeWM training trajectories
│ └── quality_filter.py
└── docs/
├── ARCHITECTURE.md
├── TRAINING.md
├── DATA_PIPELINE.md
└── LEWM_SECURITY.md # LeWM world model for security
| Repo | Purpose | License |
|---|---|---|
| DeadByDawn101/hackingBuddyGPT | Offensive security agent framework | MIT |
| DeadByDawn101/PentestGPT | Autonomous penetration testing (USENIX Security 2024) | MIT |
| DeadByDawn101/shannon | White-box AI pentester (96.15% XBOW) | AGPL-3.0 |
| DeadByDawn101/ghidra | Reverse engineering framework | Apache-2.0 |
| DeadByDawn101/OpenMythos | RDT architecture reference | MIT |
| Jackrong LLM fine-tuning guide | SFT pipeline | — |
| MOOSE-Star | ICML 2026 training methodology | — |
| LeWorldModel | JEPA world model from pixels | — |
| claude_mythos_distilled_25k | 25K distilled examples: cybersecurity, advanced coding, agentic planning, math reasoning, scientific analysis | Apache-2.0 |
- LeWorldModel (arXiv:2603.19312) — Stable end-to-end JEPA from pixels
- TriAttention (arXiv:2604.04921) — 10.7x KV compression
- MOOSE-Star (ICML 2026) — Tractable training for scientific discovery
- PentestGPT (USENIX Security 2024)
- hackingBuddyGPT (FSE'23)
- CVSS v4.0
- NIST CSF 2.0
- MITRE ATT&CK
"We don't give up. We do what others don't and build what isn't possible."
— RavenX LLC