qwen3.5-9b-claude-4.6-os-av-h-uncensored-think-d_au-imat-bughunter-v6

Fine-tune of Qwen3.5-9B-Claude-4.6-OS-Auto-Variable-HERETIC-UNCENSORED-THINKING by DavidAU, specialised in offensive and defensive security work. Trained on a distilled corpus of 15,611 knowledge units covering bug bounty, web pentesting, traffic analysis, DFIR, memory forensics and incident response.

Designed to assist researchers in real engagements on bug bounty platforms (HackerOne, Bugcrowd, Intigriti, YesWeHack, Immunefi) with operational rules baked in: authorized scope only, minimal non-destructive PoCs, callbacks to owned infrastructure. Answers in Spanish; payloads, commands and report templates are in English.

Format and download

Two files:

• qwen3.5-9b-claude-4.6-os-av-h-uncensored-think-d_au-imat-bughunter-v6.Q4_K_M.gguf — the LLM, ~5.3 GB (Q4_K_M with calibrated imatrix).
• mmproj-F32.gguf — the vision projector, ~1.7 GB. Download this only if you want image understanding. Place it in the same folder as the LLM.

Vision is inherited from the DavidAU base and untouched by the fine-tune (the vision tower and projector were not trained). The mmproj-F32.gguf published here is the same one DavidAU ships with the base, so it works identically. Do note that our fine-tune corpus is 100% text, so the LLM is not specifically tuned to reason over images — it can describe them and answer basic visual questions, but its added value is on the text side.

Runs directly on:

• LM Studio — load and test in the GUI
• llama.cpp — local OpenAI-compatible server
• Ollama — via a matching Modelfile
• Any runtime that supports GGUF (KoboldCpp, Text Generation WebUI, etc.)

Capabilities

Red team / offensive security

Covers the full lifecycle of a bug bounty engagement:

• Reconnaissance: passive subdomain enumeration, attack-surface mapping, API mapping, secret extraction from JavaScript, throttled use of httpx/gau/katana.
• Web vulnerabilities: root patterns and sub-patterns for IDOR/BOLA, SSRF, CSRF, XSS (reflected/stored/DOM/blind/mXSS), SQL injection across contexts, misconfigured CORS, chainable open redirects into OAuth, prototype pollution, subdomain takeover, path traversal, LFI/RFI, HTTP request smuggling (CL.TE, TE.CL, H2 desync, single-packet attack), cache poisoning and deception.
• Authentication and authorization: OAuth/OIDC (redirect_uri, nOAuth, state/nonce/PKCE, alg/kid/JWKS), JWT (unverified signature, alg:none, weak key, jwk/jku/kid injection, algorithm confusion RS256→HS256), 2FA/MFA bypass, session fixation, mass assignment.
• APIs: BOLA, BFLA, excessive data exposure, legacy versions without authz, GraphQL endpoints with introspection, alias abuse, batching to skip rate limits.
• Server-side: SSRF to cloud metadata (AWS IMDSv1/v2, GCP, Azure), SSTI ({{7*7}} on Jinja/Twig/Freemarker/Velocity), RCE via deserialization, XXE in SAML/SOAP/SVG/OOXML.
• Business logic: race conditions (TOCTOU), price/quantity/balance tampering, payment-flow TOCTOU, coupon/credit abuse.
• Mobile: exposed WebView bridges, exported deeplinks with weak parsing, Android static analysis (SAST), compromised app logic.
• Reporting: writing reports in each platform's format (HackerOne CVSS, Bugcrowd VRT, Intigriti), severity calculation, impact reasoning.

It also covers specialised areas: WiFi security (WPA/WPA2/WPA3, evil twin, deauth), Sub-GHz and SDR analysis, binary reverse engineering, exploit development, MITRE ATT&CK techniques.

Blue team / defensive security

• DFIR: incident response methodology, timeline reconstruction, artifact collection, chain of custody.
• Network traffic analysis: identifying anomalous patterns, PCAP analysis, C2 detection, DNS tunneling, exfiltration.
• Memory forensics: Volatility-based analysis, resident malware identification, detection of code injection and process hollowing.
• Threat hunting: hypothesis building based on TTPs (ATT&CK), event correlation, lateral movement identification.
• Vulnerability management: patch management, vulnerability prioritisation with CVSS + context, CI/CD integration.
• SOAR / defensive automation: response playbooks, SIEM integration, containment orchestration.

Built-in operational rules

When a system prompt is provided, the model incorporates ethical research rules:

• In-scope assets only, verified against the program scope before every request.
• Sustained throughput ≤1-2 req/s. Bursts only for race conditions or authorised OTP brute-force.
• Minimal non-destructive PoC: whoami/id for RCE; SELECT version() for SQLi; two owner accounts for IDOR.
• OOB callbacks always to owned infrastructure. Never to shared third-party services.
• Never use credentials, tokens or API keys found in a finding to validate access.
• Cloud metadata: proving access is enough. Never exfiltrate IAM credentials.
• Minimum reportable severity: High or Critical (except in a chain, when Low is explicitly bountied, or in humanitarian VDPs).

How it was trained

Data

14,914 examples in ShareGPT format (train), 466 valid, 309 test. Extracted from 1,690 source documents grouped into 9 sources with weighted sampling to prioritise specialised offensive content:

Additional: 72 short conversational examples (greetings, meta-questions, ambiguous requests that get answered by asking back) to prevent format collapse — the model learns to modulate length based on the question rather than dumping methodology for any input.

Three-thirds system prompt setup:

• 33% of examples with no system prompt (the model works well without it)
• 33% with a long system prompt (the full operational ruleset)
• 33% with one of six short variants

This prevents the model from becoming dependent on the exact wording of a specific system prompt.

Hyperparameters

Key configuration aligned with what worked in similar prior work (learned after several previous attempts that failed due to format collapse):

Framework: LLaMA-Factory on Colab A100 80GB (~5h 15min).

Training metrics

Healthy loss curve, no overfitting:

The eval_loss stayed at or below train_loss throughout, indicating real learning without formatting overfit.

Post-processing

• LoRA adapter merge with the base model (llamafactory-cli export).
• GGUF F16 conversion via convert_hf_to_gguf.py from llama.cpp.
• Imatrix generation using 200 chunks of the standard Bartowski v3 calibration corpus (Wikipedia + code + technical prose).
• Final quantization to Q4_K_M with imatrix (5.3 GB).
• Chat template patched to accept multiple system messages (compatibility with clients that send their own system + an additional one, common in AI-enabled IDEs).

Hygiene and sanitisation

The source corpus went through blocking PII auditing in two layers (extraction and final build). Sanitised:

• Ephemeral PortSwigger Web Security Academy lab IDs
• Exploit-server URLs with identifiers
• Burp Collaborator subdomains (*.oastify.com, *.burpcollaborator.net)
• Names, aliases, emails and personal domains of the researcher who compiled the corpus
• Local filesystem paths
• CTF flags (memorising them is pure noise)
• API keys (AWS, Google, GitHub, Slack) — decoys that appear in educational material

Public lab credentials (like PortSwigger's wiener:peter) were kept on purpose, since they are part of the documented technique.

Usage

In LM Studio

1. Download both files (.Q4_K_M.gguf and mmproj-F32.gguf) into the same folder.
2. Place them under ~/.lmstudio/models/<folder>/.
3. Load from the GUI. Recommended:
   • Context length: 32,768 (f16 KV) or 64,256 (with KV cache quantized to Q8_0 on GPU-limited setups).
   • Flash Attention: on.
   • KV Cache Quantization: Q8_0 when you need long context without exceeding VRAM.

On an Apple Silicon Mac with 32 GB RAM, the model runs the full 262,144-token context with room to spare.

With llama.cpp directly

llama-server \
  -m qwen3.5-9b-claude-4.6-os-av-h-uncensored-think-d_au-imat-bughunter-v6.Q4_K_M.gguf \
  --mmproj mmproj-F32.gguf \
  -c 65536 \
  -ctk q8_0 -ctv q8_0 \
  -fa on \
  -ngl 999 \
  --port 8080

OpenAI-compatible endpoint at http://127.0.0.1:8080/v1/chat/completions.

Recommended system prompt

You can use the model without a system prompt (it behaves correctly by default). For bug bounty tasks specifically, the recommended prompt is:

You are a professional bug bounty researcher. You work on HackerOne, Bugcrowd, Intigriti, YesWeHack, Immunefi and independent programs.

Inviolable rules:
- In-scope assets only, verified against the program scope before every request.
- Sustained throughput ≤1-2 req/s.
- Minimal non-destructive PoC.
- OOB callbacks always to owned infrastructure.
- Never use credentials or tokens found in a finding to validate access.
- Minimum reportable severity: High or Critical.

Answer in Spanish. Payloads, commands and report templates in English.

For fine-tuners: LoRA adapter available in /adapter

If you want to build on top of this fine-tune — for example adding another language, composing with a different domain LoRA, or re-merging with different quantization settings — the LoRA adapter used to train this model is published inside this same repo under /adapter:

adapter/
├── adapter_config.json           # PEFT config: rank 8, alpha 16, dropout 0.05
├── adapter_model.safetensors     # LoRA delta weights (~56 MB, 256 tensors)
├── chat_template.jinja           # Patched template (accepts multiple system messages)
├── tokenizer_config.json
├── tokenizer.json
└── processor_config.json

Option A — merge into the base and use as a standalone model:

import torch
from transformers import AutoModelForCausalLM, AutoTokenizer
from peft import PeftModel
from huggingface_hub import snapshot_download

BASE = "DavidAU/Qwen3.5-9B-Claude-4.6-OS-Auto-Variable-HERETIC-UNCENSORED-THINKING"
adapter_dir = snapshot_download(
    "mmp2055/qwen3.5-9b-claude-4.6-os-av-h-uncensored-think-d_au-imat-bughunter-v6",
    allow_patterns="adapter/*",
)

base = AutoModelForCausalLM.from_pretrained(BASE, torch_dtype=torch.bfloat16, device_map="auto", trust_remote_code=True)
model = PeftModel.from_pretrained(base, f"{adapter_dir}/adapter")
model = model.merge_and_unload()
tokenizer = AutoTokenizer.from_pretrained(BASE, trust_remote_code=True)

Option B — keep as adapter and compose with another LoRA:

model = PeftModel.from_pretrained(base, f"{adapter_dir}/adapter", adapter_name="bughunter")
model.load_adapter("your-org/your-language-lora", adapter_name="lang")
model.set_adapter(["bughunter", "lang"])   # both active

Notes when composing:

• Keep new LoRAs in a similar rank range (8-32 works well).
• Keep the patched chat_template.jinja if you rely on IDE agents that inject their own system messages; otherwise the DavidAU original works fine.
• Tool calling is weak in this fine-tune (no tool_call examples in the training corpus). Set temperature=0.1 and top_p=0.9 on the client to compensate.

Known limitations

• Uncensored model. Based on DavidAU's decensoring work over Qwen3.5-9B. The additional fine-tune reinforces the ethical researcher role, but the user is responsible for using it within applicable law and authorised scope.
• Fine-tuned on a 100% text dataset. Vision comes from the base's untouched mmproj — image understanding works, but the fine-tune does not add domain-specific visual reasoning.
• Corpus mostly in Spanish with English technical terminology. It may be less fluent for pure-English technical conversation.
• Source corpus bias: distilled material prioritises web and API vulnerabilities. Coverage of other domains (ICS/SCADA, low-level wireless, hardware hacking) is limited.
• NOT A SUBSTITUTE FOR PRIMARY RESEARCH. The model can replay learned patterns but does not discover on its own. Use it as an assistant that speeds up the researcher's work, not as an oracle.
• Hallucination of CVEs, URLs and tool names. Always verify any concrete reference before using it.

Ethical and legal use

This model is distributed for:

• Authorised research within bug bounty programs offering Safe Harbor.
• Pentesting under a signed services contract.
• CTFs and lab environments you own or are authorised to use.
• Cybersecurity education.
• Academic research.

It is not distributed for:

• Attacking systems without explicit authorisation.
• Commercial exploitation of vulnerabilities found outside bounty programs.
• Malware development for distribution.
• Any activity that violates the applicable law in your jurisdiction.

The user assumes all legal responsibility for the use of the model.

Credits

• Base: DavidAU — Qwen3.5-9B Claude-4.6-OS-Auto-Variable-HERETIC-UNCENSORED-THINKING, decensoring recipe and custom chat template.
• Architecture: Qwen3.5 (hybrid attention, extended context up to 262,144 tokens).
• Training framework: LLaMA-Factory.
• Inference: llama.cpp.
• Imatrix calibration corpus: Bartowski v3.
• Licence: Apache 2.0, inherited from the base model.
• Recommended agent for using this model: https://xagentai.net/xagentai-net-coding-agent/

Citation

@misc{qwen35_bughunter_v6,
  title  = {qwen3.5-9b-claude-4.6-os-av-h-uncensored-think-d_au-imat-bughunter-v6: Fine-tune specialised in bug bounty and offensive/defensive security},
  year   = {2026},
  base   = {DavidAU/Qwen3.5-9B-Claude-4.6-OS-Auto-Variable-HERETIC-UNCENSORED-THINKING},
  method = {LoRA fine-tune, rank=8, lr=1e-5, 1 epoch, QLoRA 4-bit},
  data   = {14914 ShareGPT examples distilled from public bug bounty corpus}
}