Developer Shishir Rahman has released CyberAgent v3.5, an open-source, fully offline AI security agent that tackles the two biggest headaches in automated penetration testing: data leakage and hallucination. By fine-tuning Qwen 2.5 (3B) with Unsloth, Rahman created a deterministic tool-calling agent that runs entirely on local hardware, keeping sensitive network topologies and exploit responses off third-party cloud servers.

The Architecture: Small Model, Big Security

Rahman’s approach rejects the trend of using bloated 70B models or expensive cloud APIs like OpenAI and Anthropic. Instead, he fine-tuned the Qwen2.5-3B-Instruct base model using a curated 60MB+ multi-turn cybersecurity dataset. The final quantized GGUF Q4_K_M model weighs in at just 1.93 GB and executes with zero API latency and zero cost per token. It runs smoothly on consumer hardware via Ollama or Llama.cpp, requiring less than 4GB of VRAM/RAM.

57 Native Tools and Deterministic ReAct Loops

CyberAgent operates on deterministic ReAct loops with strict Human-in-the-Loop (HITL) safeguards, addressing the common issue where general-purpose LLMs break automated workflows with inconsistent syntax. The agent comes equipped with 57 native tools divided into three phases: External Attack Surface Recon (WHOIS, ASN geolocation, DNS audits), Vulnerability Discovery (WAF fingerprinting, soft-404 detection, credential leak extraction), and Automated Hardening (generating nginx configs and compliance-mapped PDF reports for PCI-DSS 4.0, GDPR, and ISO 27001).

Quickstart and Open Source Availability

The project is MIT-licensed and available on GitHub and Hugging Face. Users can pull the model directly via Ollama using the command ollama run HFShishir/CyberAgent-3B-GGUF and launch the agent through a CLI or a Cyberpunk-themed desktop GUI. This release signals a growing trend among security engineers who prioritize privacy and determinism over raw model scale.

Key Takeaways

  • CyberAgent v3.5 is a 100% offline AI security agent fine-tuned from Qwen 2.5 (3B) using Unsloth.
  • The model is quantized to 1.93 GB and runs on consumer hardware with under 4GB RAM/VRAM.
  • It includes 57 native tools for recon, vulnerability discovery, and automated hardening.
  • The project eliminates data leakage risks by avoiding cloud LLM APIs for sensitive network data.
  • Code and model weights are open-sourced under the MIT License on GitHub and Hugging Face.

The Bottom Line

CyberAgent proves that you don't need massive parameter counts to solve specific, high-stakes problems like security auditing. By prioritizing determinism and local execution, Rahman offers a compelling blueprint for developers tired of paying for cloud inference and worrying about data sovereignty.