---
license: apache-2.0
language:
  - en
  - vi
  - zh
tags:
  - cybersecurity
  - security-audit
  - vulnerability-detection
  - penetration-testing
  - vision-language-model
  - qwen
base_model: Qwen/Qwen3.8-27B
pipeline_tag: image-text-to-text
---

# Con0

**Con0** is a state-of-the-art vision-language model specialized for **cyber
security**, developed by **Arcanic AI** in collaboration with **NextZero**.

Con0 is built to *think like a security auditor*. It reads code, logs,
screenshots, and infrastructure diagrams, and surfaces vulnerabilities - from
classic web-application flaws to the newest AI-agent attack surfaces - with
actionable remediation guidance.

## What Con0 audits

### Web & application security
- **SQL injection (SQLi)** - time-based, boolean-based, error-based, and blind
  variants across query builders and ORMs
- **Cross-site scripting (XSS)** - reflected, stored, and DOM-based injection
- **Cross-site request forgery (CSRF)**, **server-side request forgery (SSRF)**
- **Command injection**, **path traversal**, **XXE**, **deserialization**
- Broken authentication, broken access control, and IDOR
- OWASP Top 10 coverage, code review, and secure-configuration assessment

### AI & agent security
- Prompt injection and jailbreak surface analysis
- Tool-calling and function-dispatch misuse
- Least-privilege / permission-scope review
- Multi-step agent threat modeling

### General security
- Vulnerability triage and CVE context mapping
- Incident analysis from logs, traces, and screenshots
- Secure-code guidance and remediation planning

## Model architecture

- 27B parameters, hybrid **Gated DeltaNet** + full attention
- Native vision-language model (image + video + OCR)
- 262,144-token context window
- Flexible reasoning (thinking) control and tool calling

## Benchmarks

> Benchmark evaluation is in progress and will be published here.

| Benchmark | Con0 | Baseline (Qwen3.8-27B) |
|---|---|---|
| SQLi Detection | *pending* | *pending* |
| XSS Detection | *pending* | *pending* |
| OWASP Top 10 (aggregate) | *pending* | *pending* |
| Secure Coding | *pending* | *pending* |
| Prompt-Injection Detection | *pending* | *pending* |
| MMLU | *pending* | 84.7 |
| GSM8K | *pending* | 90.0 |

## Usage

```python
from transformers import AutoModelForMultimodalLM, AutoProcessor
import torch

model = AutoModelForMultimodalLM.from_pretrained(
    "arcanicai/Con0", torch_dtype=torch.bfloat16, device_map="auto"
)
processor = AutoProcessor.from_pretrained("arcanicai/Con0")

messages = [{"role": "user", "content": "Review this code for SQL injection vulnerabilities."}]
text = processor.apply_chat_template(messages, tokenize=False, add_generation_prompt=True)
inputs = processor(text=[text], return_tensors="pt").to(model.device)
output = model.generate(**inputs, max_new_tokens=512)
print(processor.decode(output[0], skip_special_tokens=True))
```

## About the developers

Con0 is developed by **[Arcanic AI](https://arcanic.ai)**, a research lab focused on reliable and
secure AI systems, in partnership with **[NextZero](https://nextzero.vn)**.

## License

Apache 2.0.