File size: 3,122 Bytes
3308570
 
 
 
 
 
 
 
 
cd04b05
 
3308570
 
 
 
 
 
 
 
cd04b05
 
3308570
cd04b05
b5b206b
 
cd04b05
3308570
cd04b05
3308570
cd04b05
b5b206b
cd04b05
b5b206b
cd04b05
 
 
 
3308570
cd04b05
 
 
3308570
cd04b05
 
 
 
 
 
3308570
 
 
 
 
 
 
 
 
 
 
 
 
 
cd04b05
 
 
 
3308570
 
 
 
 
 
 
 
 
 
 
 
 
 
 
cd04b05
3308570
 
 
 
 
 
 
 
27490a6
 
3308570
 
 
 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
---
license: apache-2.0
language:
  - en
  - vi
  - zh
tags:
  - cybersecurity
  - security-audit
  - vulnerability-detection
  - penetration-testing
  - vision-language-model
  - qwen
base_model: Qwen/Qwen3.8-27B
pipeline_tag: image-text-to-text
---

# Con0

**Con0** is a state-of-the-art vision-language model specialized for **cyber
security**, developed by **Arcanic AI** in collaboration with **NextZero**.

Con0 is built to *think like a security auditor*. It reads code, logs,
screenshots, and infrastructure diagrams, and surfaces vulnerabilities - from
classic web-application flaws to the newest AI-agent attack surfaces - with
actionable remediation guidance.

## What Con0 audits

### Web & application security
- **SQL injection (SQLi)** - time-based, boolean-based, error-based, and blind
  variants across query builders and ORMs
- **Cross-site scripting (XSS)** - reflected, stored, and DOM-based injection
- **Cross-site request forgery (CSRF)**, **server-side request forgery (SSRF)**
- **Command injection**, **path traversal**, **XXE**, **deserialization**
- Broken authentication, broken access control, and IDOR
- OWASP Top 10 coverage, code review, and secure-configuration assessment

### AI & agent security
- Prompt injection and jailbreak surface analysis
- Tool-calling and function-dispatch misuse
- Least-privilege / permission-scope review
- Multi-step agent threat modeling

### General security
- Vulnerability triage and CVE context mapping
- Incident analysis from logs, traces, and screenshots
- Secure-code guidance and remediation planning

## Model architecture

- 27B parameters, hybrid **Gated DeltaNet** + full attention
- Native vision-language model (image + video + OCR)
- 262,144-token context window
- Flexible reasoning (thinking) control and tool calling

## Benchmarks

> Benchmark evaluation is in progress and will be published here.

| Benchmark | Con0 | Baseline (Qwen3.8-27B) |
|---|---|---|
| SQLi Detection | *pending* | *pending* |
| XSS Detection | *pending* | *pending* |
| OWASP Top 10 (aggregate) | *pending* | *pending* |
| Secure Coding | *pending* | *pending* |
| Prompt-Injection Detection | *pending* | *pending* |
| MMLU | *pending* | 84.7 |
| GSM8K | *pending* | 90.0 |

## Usage

```python
from transformers import AutoModelForMultimodalLM, AutoProcessor
import torch

model = AutoModelForMultimodalLM.from_pretrained(
    "arcanicai/Con0", torch_dtype=torch.bfloat16, device_map="auto"
)
processor = AutoProcessor.from_pretrained("arcanicai/Con0")

messages = [{"role": "user", "content": "Review this code for SQL injection vulnerabilities."}]
text = processor.apply_chat_template(messages, tokenize=False, add_generation_prompt=True)
inputs = processor(text=[text], return_tensors="pt").to(model.device)
output = model.generate(**inputs, max_new_tokens=512)
print(processor.decode(output[0], skip_special_tokens=True))
```

## About the developers

Con0 is developed by **[Arcanic AI](https://arcanic.ai)**, a research lab focused on reliable and
secure AI systems, in partnership with **[NextZero](https://nextzero.vn)**.

## License

Apache 2.0.