Qwen3.5-35B-A3B-uncensored-bughunter-v8

First MoE iteration of the bughunter series. LoRA fine-tune of llmfan46/Qwen3.5-35B-A3B-uncensored-heretic-v2-Native-MTP-Preserved, specialised in offensive and defensive security work.

v8 vs v7: same dataset and same hyperparameters as bughunter-v7 (27B dense), applied on a 35B MoE base with 3B active params per token. Result: inference speed ~4× better on Apple Silicon (30 tok/s vs 7 tok/s of v7) with comparable quality in 90% of cases.

Designed to assist researchers in real engagements on bug bounty platforms (HackerOne, Bugcrowd, Intigriti, YesWeHack, Immunefi) with operational rules baked in: authorized scope only, minimal non-destructive PoCs, callbacks to owned infrastructure. Answers in Spanish; payloads, commands and report templates are in English.

Format and download

Two files:

• Qwen3.5-35B-A3B-uncensored-bughunter-v8.Q4_K_M.gguf — the LLM, ~20 GB (Q4_K_M).
• mmproj-BF16.gguf — the vision projector, ~874 MB (BF16). Download this only if you want image understanding. Place it in the same folder as the LLM (LM Studio auto-detects it because it starts with mmproj-).

Vision is inherited from the base and untouched by the fine-tune (the fine-tune corpus is 100% text; the vision tower and projector were not trained). The mmproj-BF16.gguf published here is the one extracted from the base by convert_hf_to_gguf.py.

Runs directly on:

• LM Studio — load and test in the GUI (⚠️ see important note below about disabling Speculative Decoding).
• llama.cpp — local OpenAI-compatible server (build ≥ Aug 2026 required for qwen35moe support).
• Any runtime that supports GGUF and the qwen35moe architecture.

⚠️ Important notice — LM Studio and MTP

The convert_hf_to_gguf.py converter of llama.cpp does not export the MTP drafter tensors for the qwen35moe arch at the time of this publication (known upstream bug). The GGUF metadata has already been patched with nextn_predict_layers=0 and block_count=40 to reflect that absence, so plain llama.cpp loads without problems.

However, LM Studio detects the qwen35moe arch and automatically enables Speculative Decoding = MTP, ignoring the metadata. This causes a load error (failed to create MTP context). Fix: when loading the model in LM Studio, go to Load → Speculative Decoding → Off. Then Load Model. It should load correctly.

When LM Studio fixes the auto-detect for qwen35moe, this workaround will no longer be needed.

Capabilities

Red team / offensive security

Covers the full lifecycle of a bug bounty engagement:

• Reconnaissance: passive subdomain enumeration, attack-surface mapping, API mapping, secret extraction from JavaScript, throttled use of httpx/gau/katana.
• Web vulnerabilities: root patterns and sub-patterns for IDOR/BOLA, SSRF, CSRF, XSS (reflected/stored/DOM/blind/mXSS), SQL injection across contexts, misconfigured CORS, chainable open redirects into OAuth, prototype pollution, subdomain takeover, path traversal, LFI/RFI, HTTP request smuggling (CL.TE, TE.CL, H2 desync, single-packet attack), cache poisoning and deception.
• Authentication and authorization: OAuth/OIDC (redirect_uri, nOAuth, state/nonce/PKCE, alg/kid/JWKS), JWT (unverified signature, alg:none, weak key, jwk/jku/kid injection, algorithm confusion RS256→HS256), 2FA/MFA bypass, session fixation, mass assignment.
• APIs: BOLA, BFLA, excessive data exposure, legacy versions without authz, GraphQL endpoints with introspection, alias abuse, batching to skip rate limits.
• Server-side: SSRF to cloud metadata (AWS IMDSv1/v2, GCP, Azure), SSTI ({{7*7}} on Jinja/Twig/Freemarker/Velocity), RCE via deserialization, XXE in SAML/SOAP/SVG/OOXML.
• Business logic: race conditions (TOCTOU), price/quantity/balance tampering, payment-flow TOCTOU, coupon/credit abuse.
• Mobile: exposed WebView bridges, exported deeplinks with weak parsing, Android static analysis (SAST).
• Reporting: writing reports in each platform's format (HackerOne CVSS, Bugcrowd VRT, Intigriti), severity calculation, impact reasoning.

Blue team / defensive security

• DFIR: incident response methodology, timeline reconstruction, artifact collection, chain of custody.
• Traffic analysis: PCAP analysis, C2 detection, DNS tunneling, exfiltration.
• Memory forensics: Volatility, resident malware identification, detection of code injection and process hollowing.
• Threat hunting: TTP-based hypothesis (ATT&CK), event correlation.
• Vulnerability management: CVSS + context prioritisation, CI/CD integration.

Built-in operational rules

When a system prompt is provided, the model incorporates ethical research rules:

• In-scope assets only, verified against the program scope before every request.
• Sustained throughput ≤1-2 req/s. Bursts only for race conditions or authorised OTP brute-force.
• Minimal non-destructive PoC: whoami/id for RCE; SELECT version() for SQLi; two owner accounts for IDOR.
• OOB callbacks always to owned infrastructure. Never to shared third-party services.
• Never use credentials, tokens or API keys found in a finding to validate access.
• Cloud metadata: proving access is enough. Never exfiltrate IAM credentials.
• Minimum reportable severity: High or Critical (except in a chain, when Low is explicitly bountied, or in humanitarian VDPs).

How it was trained

Data

14,914 examples in ShareGPT format (train), 466 valid, 309 test. Same dataset as v6 and v7 — extracted from 1,690 source documents grouped into 9 sources with weighted sampling to prioritise specialised offensive content.

Additional: 72 short conversational examples (greetings, meta-questions, ambiguous requests that get answered by asking back) to prevent format collapse — the model learns to modulate length based on the question rather than dumping methodology for any input.

Three-thirds system prompt setup:

• 33% of examples with no system prompt (the model works well without it).
• 33% with a long system prompt (the full operational ruleset).
• 33% with one of six short variants.

Hyperparameters

Same configuration as v6/v7 (proven not to trigger format collapse):

LoRA strategy on MoE (Option B — attention + shared_expert):

• Attacked: q/k/v/o_proj (attention, 10 full-attention layers out of 40) + shared_expert.{gate,up,down}_proj (backbone dense MLP always active, all 40 layers).
• NOT touched: mlp.gate.weight (expert router), mlp.experts.* (256 individual experts), mtp.* (base drafter).

Framework: Unsloth 2026.8.22 on Colab A100 80GB (~10h 20min).

Training metrics

Healthy loss curve, well-behaved cosine scheduler:

Final average training loss: 1.2522.

The eval_loss decreased monotonically throughout training with a clear plateau in the last third — sign of healthy generalisation, not overfit. Absolute losses are NOT directly comparable to v6/v7 (different bases, different architectures — dense vs MoE).

Post-processing

• Adapter merged with the BF16 base via peft.merge_and_unload() on a local Mac (32 GB RAM).
• HF → GGUF Q8_0 → Q4_K_M conversion via convert_hf_to_gguf.py + llama-quantize (llama.cpp master).
• Vision projector (mmproj) extracted separately in BF16 (874 MB).
• Post-conversion GGUF metadata patched (block_count 41 → 40, nextn_predict_layers 1 → 0) to reflect that the drafter's MTP tensors were not exported.

Usage

In LM Studio

1. Download both files (.Q4_K_M.gguf and mmproj-BF16.gguf) into the same folder.
2. Place them under ~/.lmstudio/models/<publisher>/<repo>/.
3. ⚠️ CRITICAL — before the first Load: Load tab → Speculative Decoding → Off. If you leave it at the default MTP, LM Studio will try to activate an MTP drafter that this GGUF does not contain and will fail with failed to create MTP context.
4. Recommended settings:
   • Context length: 32,768 to start (the model supports up to 262,144).
   • KV Cache Quantization: OFF (qwen35moe doesn't tolerate it well).
   • Flash Attention: on.
   • GPU Offload: maximum (all layers).

With llama.cpp directly

llama-server \
  -m Qwen3.5-35B-A3B-uncensored-bughunter-v8.Q4_K_M.gguf \
  --mmproj mmproj-BF16.gguf \
  -c 32768 \
  -fa on \
  -ngl 999 \
  --port 8080

OpenAI-compatible endpoint at http://127.0.0.1:8080/v1/chat/completions.

Using with Bughunter Harness (multi-agent autonomous pentest pipeline, 100% local)

Bughunter Harness is a multi-agent orchestrated pipeline that drives this model through a full 9-stage bug bounty workflow — from reconnaissance to consolidated Markdown report — with rate limits, scope gates and secret redaction enforced by default. This model (v8) is the recommended and pinned backend in the harness config.

Pipeline (9 agents run in sequence, order matters):

1. recon — subdomain + host + port enumeration.
2. fingerprint — tech-stack detection.
3. content_discovery — hidden paths + historical URLs (gau/wayback/katana).
4. login_probe — LAB ONLY (localhost / private IP / DVWA / Juice Shop / Mutillidae / bWAPP / WebGoat) — 6 stock default-cred pairs, session cookie harvest.
5. web_vuln — nuclei + nikto + sqlmap + dalfox on every parameterized endpoint found in step 3, cookie from step 4 auto-injected.
6. wordpress — wpscan when WordPress is detected.
7. api_fuzzer — API surface + BOLA/BFLA hints.
8. auth — auth-bypass + SSO/OAuth misconfig.
9. report — deterministic Markdown consolidator → sessions/<run-id>/REPORT.md.

Design goals — safe-by-default, model-agnostic:

• Rate limit enforced across every tool call.
• Scope allowlist gate before every network request.
• Secrets and PII redacted in prompts.
• No destructive commands (no rm, drop, wipe, …).
• Attribution headers, email + Telegram notifications, temp-file cleanup, live progress panel.

Backend support: LM Studio, Ollama, Llama.cpp (all local) — plus OpenAI, Anthropic, NVIDIA NIM, Google Gemini (cloud) via --servertype. Local is recommended for privacy + zero cost.

Setup with LM Studio (fastest path):

1. Install LM Studio: https://lmstudio.ai
2. In LM Studio → Discover → download mmp2055/Qwen3.5-35B-A3B-uncensored-bughunter-v8 (~19 GB Q4_K_M + optional mmproj).
3. LM Studio → Developer → Local Server → Start Server on port 1234.
4. ⚠️ Turn OFF Speculative Decoding in the model's Settings (see warning at the top of this README — mandatory for qwen35moe today).
5. ⚠️ Turn ON Tool Use in the model's Settings (required for the agent pipeline to call run_shell, http_get, etc.).

Install the harness:

git clone https://github.com/marcodemm/bughunter-harness.git
cd bughunter-harness
python3 -m venv .venv
source .venv/bin/activate
pip install --upgrade pip
pip install -r requirements.txt

# Copy templates
cp config.example.yaml config.yaml
cp scope.example.txt scope.txt

# Edit config.yaml (backend, SMTP/Telegram optional, custom_headers, …)
# Edit scope.txt with hostnames you are authorized to test

The default llm.model in config.example.yaml is already pinned to this v8 model — no config change needed if you follow the LM Studio setup above.

Quick start:

source .venv/bin/activate
python harness.py

At the prompt:

Objective (one-line goal for the agent). Type /quit or /bye to exit.
Inline flags (sticky): --email ADDR  --scope PAT (repeat)  -o PATH

> http://localhost:3000/

The orchestrator runs the 9 agents in sequence and produces sessions/<run-id>/REPORT.md at the end.

Optional tooling (harness auto-detects and uses whatever is installed):

# macOS Homebrew — most useful subset
brew install nuclei ffuf httpx subfinder katana nmap nikto \
             feroxbuster wpscan dnsx naabu jq sqlmap
brew install gau waybackurls        # historical URL discovery
go install github.com/hahwul/dalfox/v2@latest   # active XSS scanner
nuclei -update-templates             # first run

Plus SecLists at /opt/homebrew/share/seclists for content_discovery and api_fuzzer wordlists.

Mandatory operational rules for any offensive use:

1. In-scope check before every network request — hostname matched against scope.txt allowlist. No exceptions.
2. Throttle ≤1-2 req/s baseline — nuclei -rl 2 -c 1, dalfox --delay 1000 -w 1, ffuf --rate 2, nikto -Pause 1.
3. Own self-hosted OOB callback — never third-party services (loss of data control + violates most programs). Suggested token convention: <project>-<vector>-NN.
4. Minimal non-destructive PoC — whoami for RCE, 4-char redacted for secrets, 2 own accounts for IDOR, ≤20 requests for races.
5. Redact sensitive data — cookies, tokens and PII redacted to 4 chars + length before entering the model prompt (the harness enforces this by default).
6. Zero egress beyond target + OOB — no telemetry to third-party observability platforms.
7. Pre-report second opinion — before writing any report, re-check the finding in a fresh session or with a different model to verify reproducibility.

Troubleshooting:

References:

• Bughunter Harness (GitHub — marcodemm/bughunter-harness) — multi-agent local-LLM pentest pipeline. Model-agnostic (LM Studio / Ollama / Llama.cpp / OpenAI / Anthropic / NVIDIA / Gemini). This v8 model is the pinned default in config.example.yaml.
• LM Studio — local OpenAI-compatible runtime.
• SecLists — wordlists used by content_discovery and api_fuzzer.

Recommended system prompt

You can use the model without a system prompt (it behaves correctly by default). For bug bounty tasks specifically:

You are a professional bug bounty researcher. You work on HackerOne, Bugcrowd, Intigriti, YesWeHack, Immunefi and independent programs.

Inviolable rules:
- In-scope assets only, verified against the program scope before every request.
- Sustained throughput ≤1-2 req/s.
- Minimal non-destructive PoC.
- OOB callbacks always to owned infrastructure.
- Never use credentials or tokens found in a finding to validate access.
- Minimum reportable severity: High or Critical.

Answer in Spanish. Payloads, commands and report templates in English.

For fine-tuners: LoRA adapter available in /adapter

If you want to build on top of this fine-tune, the LoRA adapter used to train this model is published inside this same repo under /adapter:

adapter/
├── adapter_config.json           # PEFT config: rank 8, alpha 16, dropout 0.05
├── adapter_model.safetensors     # LoRA delta weights (~17 MB, 4.2M params)
├── chat_template.jinja
├── tokenizer_config.json
├── tokenizer.json
└── README.md

Merge into the base and use as a standalone model:

import torch
from transformers import AutoModelForImageTextToText, AutoProcessor
from peft import PeftModel
from huggingface_hub import snapshot_download

BASE = "llmfan46/Qwen3.5-35B-A3B-uncensored-heretic-v2-Native-MTP-Preserved"
adapter_dir = snapshot_download(
    "mmp2055/Qwen3.5-35B-A3B-uncensored-bughunter-v8",
    allow_patterns="adapter/*",
)

base = AutoModelForImageTextToText.from_pretrained(BASE, dtype=torch.bfloat16, device_map="cpu", trust_remote_code=True)
model = PeftModel.from_pretrained(base, f"{adapter_dir}/adapter")
model = model.merge_and_unload()
processor = AutoProcessor.from_pretrained(BASE, trust_remote_code=True)

Known limitations

• Uncensored model. Based on llmfan46's "heretic v2" decensoring work over Qwen3.5-35B-A3B. The additional fine-tune reinforces the ethical researcher role, but the user is responsible for using it within applicable law and authorised scope.
• Fine-tuned on a 100% text dataset. Vision comes from the base's untouched projector — works for general descriptions but is not fine-tuned for security-specific screenshot analysis.
• Corpus mostly in Spanish with English technical terminology.
• ⚠️ Known hallucination — CL.TE: when asked about HTTP Request Smuggling with CL.TE, the model may describe it incorrectly as "Command Line Testing" or similar. The concept is under-represented in the training dataset. Always verify smuggling concepts against sources (PortSwigger, OWASP).
• LoRA only touches the 10 full-attention layers (out of 40 total — the other 30 linear_attention/DeltaNet layers remain unadapted) + the 40 shared_expert layers (dense backbone). The 256 individual experts per layer were NOT touched to preserve the pretraining specialisation.
• MTP drafter not exported: llama.cpp master does not yet support MTP tensor export for qwen35moe arch. Without the drafter, there is no speculative-decoding speedup (the model runs at ~30 tok/s on Apple Silicon M5 instead of the ~50-60 that MTP would enable).
• NOT A SUBSTITUTE FOR PRIMARY RESEARCH. The model can replay learned patterns but does not discover on its own. Use it as an assistant that speeds up the researcher's work, not as an oracle.
• Hallucination of CVEs, URLs and tool names. Always verify any concrete reference before using it.

Ethical and legal use

This model is distributed for:

• Authorised research within bug bounty programs offering Safe Harbor.
• Pentesting under a signed services contract.
• CTFs and lab environments you own or are authorised to use.
• Cybersecurity education.
• Academic research.

It is not distributed for:

• Attacking systems without explicit authorisation.
• Commercial exploitation of vulnerabilities found outside bounty programs.
• Malware development for distribution.
• Any activity that violates the applicable law in your jurisdiction.

The user assumes all legal responsibility for the use of the model.

Credits

• Base: llmfan46 — Qwen3.5-35B-A3B decensored "heretic v2" with MTP preserved.
• Architecture: Qwen3.5 MoE (qwen35moe, 256 experts with 8 active per token + dense shared expert, hybrid attention Gated DeltaNet + full attention, context up to 262,144 tokens, native Multi-Token Prediction).
• Training framework: Unsloth — day-1 support for qwen3_5_moe.
• Inference: llama.cpp.
• Prior work in this series: bughunter-v6 (9B GGUF) · bughunter-v7 (27B GGUF+MLX).
• Licence: Apache 2.0, inherited from the base.
• Recommended agent for using this model: https://xagentai.net/xagentai-net-coding-agent/

Citation

@misc{qwen35moe_bughunter_v8,
  title  = {Qwen3.5-35B-A3B-uncensored-bughunter-v8: MoE fine-tune specialised in bug bounty and offensive/defensive security},
  year   = {2026},
  base   = {llmfan46/Qwen3.5-35B-A3B-uncensored-heretic-v2-Native-MTP-Preserved},
  method = {LoRA fine-tune (rank=8, lr=1e-5, 1 epoch, QLoRA 4-bit, Unsloth) on attention + shared_expert layers},
  data   = {14914 ShareGPT examples distilled from public bug bounty corpus}
}