File size: 3,122 Bytes
3308570 cd04b05 3308570 cd04b05 3308570 cd04b05 b5b206b cd04b05 3308570 cd04b05 3308570 cd04b05 b5b206b cd04b05 b5b206b cd04b05 3308570 cd04b05 3308570 cd04b05 3308570 cd04b05 3308570 cd04b05 3308570 27490a6 3308570 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 | ---
license: apache-2.0
language:
- en
- vi
- zh
tags:
- cybersecurity
- security-audit
- vulnerability-detection
- penetration-testing
- vision-language-model
- qwen
base_model: Qwen/Qwen3.8-27B
pipeline_tag: image-text-to-text
---
# Con0
**Con0** is a state-of-the-art vision-language model specialized for **cyber
security**, developed by **Arcanic AI** in collaboration with **NextZero**.
Con0 is built to *think like a security auditor*. It reads code, logs,
screenshots, and infrastructure diagrams, and surfaces vulnerabilities - from
classic web-application flaws to the newest AI-agent attack surfaces - with
actionable remediation guidance.
## What Con0 audits
### Web & application security
- **SQL injection (SQLi)** - time-based, boolean-based, error-based, and blind
variants across query builders and ORMs
- **Cross-site scripting (XSS)** - reflected, stored, and DOM-based injection
- **Cross-site request forgery (CSRF)**, **server-side request forgery (SSRF)**
- **Command injection**, **path traversal**, **XXE**, **deserialization**
- Broken authentication, broken access control, and IDOR
- OWASP Top 10 coverage, code review, and secure-configuration assessment
### AI & agent security
- Prompt injection and jailbreak surface analysis
- Tool-calling and function-dispatch misuse
- Least-privilege / permission-scope review
- Multi-step agent threat modeling
### General security
- Vulnerability triage and CVE context mapping
- Incident analysis from logs, traces, and screenshots
- Secure-code guidance and remediation planning
## Model architecture
- 27B parameters, hybrid **Gated DeltaNet** + full attention
- Native vision-language model (image + video + OCR)
- 262,144-token context window
- Flexible reasoning (thinking) control and tool calling
## Benchmarks
> Benchmark evaluation is in progress and will be published here.
| Benchmark | Con0 | Baseline (Qwen3.8-27B) |
|---|---|---|
| SQLi Detection | *pending* | *pending* |
| XSS Detection | *pending* | *pending* |
| OWASP Top 10 (aggregate) | *pending* | *pending* |
| Secure Coding | *pending* | *pending* |
| Prompt-Injection Detection | *pending* | *pending* |
| MMLU | *pending* | 84.7 |
| GSM8K | *pending* | 90.0 |
## Usage
```python
from transformers import AutoModelForMultimodalLM, AutoProcessor
import torch
model = AutoModelForMultimodalLM.from_pretrained(
"arcanicai/Con0", torch_dtype=torch.bfloat16, device_map="auto"
)
processor = AutoProcessor.from_pretrained("arcanicai/Con0")
messages = [{"role": "user", "content": "Review this code for SQL injection vulnerabilities."}]
text = processor.apply_chat_template(messages, tokenize=False, add_generation_prompt=True)
inputs = processor(text=[text], return_tensors="pt").to(model.device)
output = model.generate(**inputs, max_new_tokens=512)
print(processor.decode(output[0], skip_special_tokens=True))
```
## About the developers
Con0 is developed by **[Arcanic AI](https://arcanic.ai)**, a research lab focused on reliable and
secure AI systems, in partnership with **[NextZero](https://nextzero.vn)**.
## License
Apache 2.0.
|