license: apache-2.0
base_model: llmfan46/Qwen3.5-35B-A3B-uncensored-heretic-v2-Native-MTP-Preserved
language:

• es
• en
  library_name: gguf
  pipeline_tag: image-text-to-text
  tags:
• cybersecurity
• bug-bounty
• red-team
• blue-team
• offensive-security
• defensive-security
• pentesting
• vulnerability-research
• uncensored
• llama-cpp
• gguf
• qwen3.5
• qwen35moe
• moe
• mixture-of-experts
• spanish
• lora
• qlora
• unsloth
  inference: false

Qwen3.5-35B-A3B-uncensored-bughunter-v8

First MoE iteration of the bughunter series. LoRA fine-tune of llmfan46/Qwen3.5-35B-A3B-uncensored-heretic-v2-Native-MTP-Preserved, specialised in offensive and defensive security work.

v8 vs v7: same dataset and same hyperparameters as bughunter-v7 (27B dense), applied on a 35B MoE base with 3B active params per token. Result: inference speed ~4× better on Apple Silicon (30 tok/s vs 7 tok/s of v7) with comparable quality in 90% of cases.

Designed to assist researchers in real engagements on bug bounty platforms (HackerOne, Bugcrowd, Intigriti, YesWeHack, Immunefi) with operational rules baked in: authorized scope only, minimal non-destructive PoCs, callbacks to owned infrastructure. Answers in Spanish; payloads, commands and report templates are in English.

Format and download

Two files:

• Qwen3.5-35B-A3B-uncensored-bughunter-v8.Q4_K_M.gguf — the LLM, ~20 GB (Q4_K_M).
• mmproj-BF16.gguf — the vision projector, ~874 MB (BF16). Download this only if you want image understanding. Place it in the same folder as the LLM (LM Studio auto-detects it because it starts with mmproj-).

Vision is inherited from the base and untouched by the fine-tune (the fine-tune corpus is 100% text; the vision tower and projector were not trained). The mmproj-BF16.gguf published here is the one extracted from the base by convert_hf_to_gguf.py.

Runs directly on:

• LM Studio — load and test in the GUI (⚠️ see important note below about disabling Speculative Decoding).
• llama.cpp — local OpenAI-compatible server (build ≥ Aug 2026 required for qwen35moe support).
• Any runtime that supports GGUF and the qwen35moe architecture.

⚠️ Important notice — LM Studio and MTP

The convert_hf_to_gguf.py converter of llama.cpp does not export the MTP drafter tensors for the qwen35moe arch at the time of this publication (known upstream bug). The GGUF metadata has already been patched with nextn_predict_layers=0 and block_count=40 to reflect that absence, so plain llama.cpp loads without problems.

However, LM Studio detects the qwen35moe arch and automatically enables Speculative Decoding = MTP, ignoring the metadata. This causes a load error (failed to create MTP context). Fix: when loading the model in LM Studio, go to Load → Speculative Decoding → Off. Then Load Model. It should load correctly.

When LM Studio fixes the auto-detect for qwen35moe, this workaround will no longer be needed.

Capabilities

Red team / offensive security

Covers the full lifecycle of a bug bounty engagement:

• Reconnaissance: passive subdomain enumeration, attack-surface mapping, API mapping, secret extraction from JavaScript, throttled use of httpx/gau/katana.
• Web vulnerabilities: root patterns and sub-patterns for IDOR/BOLA, SSRF, CSRF, XSS (reflected/stored/DOM/blind/mXSS), SQL injection across contexts, misconfigured CORS, chainable open redirects into OAuth, prototype pollution, subdomain takeover, path traversal, LFI/RFI, HTTP request smuggling (CL.TE, TE.CL, H2 desync, single-packet attack), cache poisoning and deception.
• Authentication and authorization: OAuth/OIDC (redirect_uri, nOAuth, state/nonce/PKCE, alg/kid/JWKS), JWT (unverified signature, alg:none, weak key, jwk/jku/kid injection, algorithm confusion RS256→HS256), 2FA/MFA bypass, session fixation, mass assignment.
• APIs: BOLA, BFLA, excessive data exposure, legacy versions without authz, GraphQL endpoints with introspection, alias abuse, batching to skip rate limits.
• Server-side: SSRF to cloud metadata (AWS IMDSv1/v2, GCP, Azure), SSTI ({{7*7}} on Jinja/Twig/Freemarker/Velocity), RCE via deserialization, XXE in SAML/SOAP/SVG/OOXML.
• Business logic: race conditions (TOCTOU), price/quantity/balance tampering, payment-flow TOCTOU, coupon/credit abuse.
• Mobile: exposed WebView bridges, exported deeplinks with weak parsing, Android static analysis (SAST).
• Reporting: writing reports in each platform's format (HackerOne CVSS, Bugcrowd VRT, Intigriti), severity calculation, impact reasoning.

Blue team / defensive security

• DFIR: incident response methodology, timeline reconstruction, artifact collection, chain of custody.
• Traffic analysis: PCAP analysis, C2 detection, DNS tunneling, exfiltration.
• Memory forensics: Volatility, resident malware identification, detection of code injection and process hollowing.
• Threat hunting: TTP-based hypothesis (ATT&CK), event correlation.
• Vulnerability management: CVSS + context prioritisation, CI/CD integration.

Built-in operational rules

When a system prompt is provided, the model incorporates ethical research rules:

• In-scope assets only, verified against the program scope before every request.
• Sustained throughput ≤1-2 req/s. Bursts only for race conditions or authorised OTP brute-force.
• Minimal non-destructive PoC: whoami/id for RCE; SELECT version() for SQLi; two owner accounts for IDOR.
• OOB callbacks always to owned infrastructure. Never to shared third-party services.
• Never use credentials, tokens or API keys found in a finding to validate access.
• Cloud metadata: proving access is enough. Never exfiltrate IAM credentials.
• Minimum reportable severity: High or Critical (except in a chain, when Low is explicitly bountied, or in humanitarian VDPs).

How it was trained

Data

14,914 examples in ShareGPT format (train), 466 valid, 309 test. Same dataset as v6 and v7 — extracted from 1,690 source documents grouped into 9 sources with weighted sampling to prioritise specialised offensive content.

Additional: 72 short conversational examples (greetings, meta-questions, ambiguous requests that get answered by asking back) to prevent format collapse — the model learns to modulate length based on the question rather than dumping methodology for any input.

Three-thirds system prompt setup:

• 33% of examples with no system prompt (the model works well without it).
• 33% with a long system prompt (the full operational ruleset).
• 33% with one of six short variants.

Hyperparameters

Same configuration as v6/v7 (proven not to trigger format collapse):

LoRA strategy on MoE (Option B — attention + shared_expert):

• Attacked: q/k/v/o_proj (attention, 10 full-attention layers out of 40) + shared_expert.{gate,up,down}_proj (backbone dense MLP always active, all 40 layers).
• NOT touched: mlp.gate.weight (expert router), mlp.experts.* (256 individual experts), mtp.* (base drafter).

Framework: Unsloth 2026.8.22 on Colab A100 80GB (~10h 20min).

Training metrics

Healthy loss curve, well-behaved cosine scheduler:

Final average training loss: 1.2522.

The eval_loss decreased monotonically throughout training with a clear plateau in the last third — sign of healthy generalisation, not overfit. Absolute losses are NOT directly comparable to v6/v7 (different bases, different architectures — dense vs MoE).

Post-processing

• Adapter merged with the BF16 base via peft.merge_and_unload() on a local Mac (32 GB RAM).
• HF → GGUF Q8_0 → Q4_K_M conversion via convert_hf_to_gguf.py + llama-quantize (llama.cpp master).
• Vision projector (mmproj) extracted separately in BF16 (874 MB).
• Post-conversion GGUF metadata patched (block_count 41 → 40, nextn_predict_layers 1 → 0) to reflect that the drafter's MTP tensors were not exported.

Usage

In LM Studio

1. Download both files (.Q4_K_M.gguf and mmproj-BF16.gguf) into the same folder.
2. Place them under ~/.lmstudio/models/<publisher>/<repo>/.
3. ⚠️ CRITICAL — before the first Load: Load tab → Speculative Decoding → Off. If you leave it at the default MTP, LM Studio will try to activate an MTP drafter that this GGUF does not contain and will fail with failed to create MTP context.
4. Recommended settings:
   • Context length: 32,768 to start (the model supports up to 262,144).
   • KV Cache Quantization: OFF (qwen35moe doesn't tolerate it well).
   • Flash Attention: on.
   • GPU Offload: maximum (all layers).

With llama.cpp directly

llama-server \
  -m Qwen3.5-35B-A3B-uncensored-bughunter-v8.Q4_K_M.gguf \
  --mmproj mmproj-BF16.gguf \
  -c 32768 \
  -fa on \
  -ngl 999 \
  --port 8080

OpenAI-compatible endpoint at http://127.0.0.1:8080/v1/chat/completions.

Using with PentestGPT (guided kill-chain harness, 100% local)

PentestGPT (v6+, MIT, USENIX Security '24) can drive this model as its reasoning + parsing backend for authorized pentesting, in-scope bug bounty, and CTFs. Zero egress to third-party providers — model, endpoint and sessions stay 100% local.

Prerequisites:

• LM Studio ≥ 0.3.x with qwen35moe support, model loaded with Speculative Decoding OFF (see warning above).
• Python 3.12+ and git.
• uv (pip install uv or via make install below).

1. Install PentestGPT:

git clone https://github.com/GreyDGL/PentestGPT.git ~/PentestGPT
cd ~/PentestGPT
make install    # runs uv sync
uv run pentestgpt-legacy --help

pentestgpt-legacy is the mode used for OpenAI-compatible endpoints that aren't officially registered (like LM Studio).

2. Backend configuration — flags for pentestgpt-legacy:

• --base-url http://127.0.0.1:1234/v1 — LM Studio endpoint.
• OPENAI_API_KEY=<any-non-empty-string> — LM Studio ignores the key but PentestGPT validates its presence.
• --reasoning-model ollama:<id> — ollama: prefix is mandatory for local OpenAI-compat models (applies to LM Studio, vLLM, Ollama — shared namespace). Without it PentestGPT throws Unknown model 'X'. Available: gpt-5.5, ... listing only cloud providers. Get the exact id with curl -s http://127.0.0.1:1234/v1/models | jq '.data[].id'.
• --parsing-model ollama:<id> — same model (bughunter-v8 covers both roles).
• LANGFUSE_ENABLED=false — disables Langfuse telemetry (mandatory for egress control).

3. Startup wrapper — save as ~/run-bughunter.sh:

#!/usr/bin/env bash
# Launches PentestGPT-legacy against Qwen3.5-35B-A3B-uncensored-bughunter-v8
# served by LM Studio on 127.0.0.1:1234.
#
# Usage:
#   ./run-bughunter.sh --target <ip|url> [--instruction "..."]
#
# Requires: LM Studio open with the model loaded (Speculative Decoding OFF).

set -euo pipefail

PENTESTGPT_DIR="${PENTESTGPT_DIR:-$HOME/PentestGPT}"

# 1. Check LM Studio is up
if ! curl -sf http://127.0.0.1:1234/v1/models > /dev/null; then
  echo "[!] LM Studio not responding on 127.0.0.1:1234."
  echo "    Open LM Studio and load qwen3.5-35b-a3b-uncensored-bughunter-v8 (Speculative Decoding OFF)."
  exit 1
fi

# 2. Detect the loaded model ID
MODEL_ID="$(curl -s http://127.0.0.1:1234/v1/models | jq -r '.data[0].id')"
if [ -z "$MODEL_ID" ] || [ "$MODEL_ID" = "null" ]; then
  echo "[!] No model loaded in LM Studio."
  exit 1
fi
echo "[+] Model detected: $MODEL_ID"

# 3. Env vars (no telemetry, placeholder API key)
export OPENAI_API_KEY="lm-studio-placeholder"
export LANGFUSE_ENABLED=false

# 4. Launch PentestGPT-legacy
# NOTE: "ollama:" prefix is mandatory for local OpenAI-compat models
# (applies to LM Studio, vLLM and Ollama). Without it PentestGPT throws "Unknown model".
cd "$PENTESTGPT_DIR"
exec uv run pentestgpt-legacy \
  --base-url "http://127.0.0.1:1234/v1" \
  --reasoning-model "ollama:$MODEL_ID" \
  --parsing-model "ollama:$MODEL_ID" \
  "$@"

Then chmod +x ~/run-bughunter.sh.

4. Usage examples:

Smoke test against a local target first (VM, own app, retired HTB) before pointing at real targets:

~/run-bughunter.sh --target 127.0.0.1:8080 \
  --instruction "Local test app; return 3 reconnaissance steps only."

Real bug bounty / authorized pentesting session:

~/run-bughunter.sh \
  --target https://<in-scope-host> \
  --instruction "Program: <platform>/<slug>. In-scope only. Throttle ≤1 req/s. \
OOB callback https://<your-own-oob-catcher>/<project>-<vector>. \
No autonomous chain-execution; propose commands and wait for approval."

The model works in guided mode: it proposes the next step, the operator executes the command manually, pastes the output, and iterates.

Session management:

~/run-bughunter.sh --list-sessions
~/run-bughunter.sh --resume-session <session-id>

5. Mandatory operational rules for any offensive use of the harness:

1. In-scope check before every network request. Match hostname against the program's policy/scope. No exceptions.
2. Throttle ≤1-2 req/s baseline. When the model suggests scanners, force -rl 2 -c 1 (nuclei), --delay 1000 -w 1 (dalfox), --rate 2 (ffuf), -Pause 1 (nikto).
3. Own self-hosted OOB callback. Never use third-party services like xss0r.com or similar domains that capture external traffic — you lose control of the data and violate most programs' rules. Run your own (self-hosted webhook.site, per-project Burp Collaborator, or your own PHP/Node instance). Suggested token convention: <project>-<vector>-NN.
4. Minimal non-destructive PoC. whoami for RCE, 4-char redacted for secrets, 2 own accounts for IDOR, ≤20 requests for race conditions / brute-force.
5. No autonomous kill-chain. PentestGPT-legacy is guided by default — each proposed command runs manually after human review. Don't wire it to auto-executors without auditing throttling and controls.
6. Redact sensitive data in the chat with the model. Even if the model is local, discipline: cookies, tokens and PII redacted to 4 chars + length.
7. Zero egress. LangFuse disabled (LANGFUSE_ENABLED=false). The only allowed outbound traffic is to the in-scope target and to your own OOB.
8. Pre-report second opinion. Before writing any report, cross-check the finding by asking the same model in a fresh turn (or a different model if available) to verify reproducibility and rule out false positives.

6. Troubleshooting:

References:

• PentestGPT (GitHub — GreyDGL/PentestGPT) — MIT, Python 3.12+, USENIX Security '24 (+228.6% vs no-AI baseline).
• LM Studio — local OpenAI-compatible runtime.

Recommended system prompt

You can use the model without a system prompt (it behaves correctly by default). For bug bounty tasks specifically:

You are a professional bug bounty researcher. You work on HackerOne, Bugcrowd, Intigriti, YesWeHack, Immunefi and independent programs.

Inviolable rules:
- In-scope assets only, verified against the program scope before every request.
- Sustained throughput ≤1-2 req/s.
- Minimal non-destructive PoC.
- OOB callbacks always to owned infrastructure.
- Never use credentials or tokens found in a finding to validate access.
- Minimum reportable severity: High or Critical.

Answer in Spanish. Payloads, commands and report templates in English.

For fine-tuners: LoRA adapter available in /adapter

If you want to build on top of this fine-tune, the LoRA adapter used to train this model is published inside this same repo under /adapter:

adapter/
├── adapter_config.json           # PEFT config: rank 8, alpha 16, dropout 0.05
├── adapter_model.safetensors     # LoRA delta weights (~17 MB, 4.2M params)
├── chat_template.jinja
├── tokenizer_config.json
├── tokenizer.json
└── README.md

Merge into the base and use as a standalone model:

import torch
from transformers import AutoModelForImageTextToText, AutoProcessor
from peft import PeftModel
from huggingface_hub import snapshot_download

BASE = "llmfan46/Qwen3.5-35B-A3B-uncensored-heretic-v2-Native-MTP-Preserved"
adapter_dir = snapshot_download(
    "mmp2055/Qwen3.5-35B-A3B-uncensored-bughunter-v8",
    allow_patterns="adapter/*",
)

base = AutoModelForImageTextToText.from_pretrained(BASE, dtype=torch.bfloat16, device_map="cpu", trust_remote_code=True)
model = PeftModel.from_pretrained(base, f"{adapter_dir}/adapter")
model = model.merge_and_unload()
processor = AutoProcessor.from_pretrained(BASE, trust_remote_code=True)

Known limitations

• Uncensored model. Based on llmfan46's "heretic v2" decensoring work over Qwen3.5-35B-A3B. The additional fine-tune reinforces the ethical researcher role, but the user is responsible for using it within applicable law and authorised scope.
• Fine-tuned on a 100% text dataset. Vision comes from the base's untouched projector — works for general descriptions but is not fine-tuned for security-specific screenshot analysis.
• Corpus mostly in Spanish with English technical terminology.
• ⚠️ Known hallucination — CL.TE: when asked about HTTP Request Smuggling with CL.TE, the model may describe it incorrectly as "Command Line Testing" or similar. The concept is under-represented in the training dataset. Always verify smuggling concepts against sources (PortSwigger, OWASP).
• LoRA only touches the 10 full-attention layers (out of 40 total — the other 30 linear_attention/DeltaNet layers remain unadapted) + the 40 shared_expert layers (dense backbone). The 256 individual experts per layer were NOT touched to preserve the pretraining specialisation.
• MTP drafter not exported: llama.cpp master does not yet support MTP tensor export for qwen35moe arch. Without the drafter, there is no speculative-decoding speedup (the model runs at ~30 tok/s on Apple Silicon M5 instead of the ~50-60 that MTP would enable).
• NOT A SUBSTITUTE FOR PRIMARY RESEARCH. The model can replay learned patterns but does not discover on its own. Use it as an assistant that speeds up the researcher's work, not as an oracle.
• Hallucination of CVEs, URLs and tool names. Always verify any concrete reference before using it.

Ethical and legal use

This model is distributed for:

• Authorised research within bug bounty programs offering Safe Harbor.
• Pentesting under a signed services contract.
• CTFs and lab environments you own or are authorised to use.
• Cybersecurity education.
• Academic research.

It is not distributed for:

• Attacking systems without explicit authorisation.
• Commercial exploitation of vulnerabilities found outside bounty programs.
• Malware development for distribution.
• Any activity that violates the applicable law in your jurisdiction.

The user assumes all legal responsibility for the use of the model.

Credits

• Base: llmfan46 — Qwen3.5-35B-A3B decensored "heretic v2" with MTP preserved.
• Architecture: Qwen3.5 MoE (qwen35moe, 256 experts with 8 active per token + dense shared expert, hybrid attention Gated DeltaNet + full attention, context up to 262,144 tokens, native Multi-Token Prediction).
• Training framework: Unsloth — day-1 support for qwen3_5_moe.
• Inference: llama.cpp.
• Prior work in this series: bughunter-v6 (9B GGUF) · bughunter-v7 (27B GGUF+MLX).
• Licence: Apache 2.0, inherited from the base.
• Recommended agent for using this model: https://xagentai.net/xagentai-net-coding-agent/

Citation

@misc{qwen35moe_bughunter_v8,
  title  = {Qwen3.5-35B-A3B-uncensored-bughunter-v8: MoE fine-tune specialised in bug bounty and offensive/defensive security},
  year   = {2026},
  base   = {llmfan46/Qwen3.5-35B-A3B-uncensored-heretic-v2-Native-MTP-Preserved},
  method = {LoRA fine-tune (rank=8, lr=1e-5, 1 epoch, QLoRA 4-bit, Unsloth) on attention + shared_expert layers},
  data   = {14914 ShareGPT examples distilled from public bug bounty corpus}
}