README.md

---
license: mit
language:
- en
base_model: []
tags:
- red_teaming
- cybersecurity
- CTF
---
<div align="center">
  <img src="assets/talon_logo.jpeg" alt="Talon Logo"/>

  <h1>Talon-Preview</h1>
  <p><em>A sneak peek at what's being built — not what it will become.</em></p>

  ![Model](https://img.shields.io/badge/Model-Talon--Preview-blue)
  ![Params](https://img.shields.io/badge/Params-5.1B%20total%20%7C%202B%20active-lightgrey)
  ![Ollama](https://img.shields.io/badge/Ollama-Compatible-green)
  ![Status](https://img.shields.io/badge/Status-Demo%20Release-orange)

</div>

---

## Read This First

This is not a hacking assistant. It will not one-shot OSCP machines or
automatically pop shells on VulnLab boxes. If that is what you are looking
for, this is not it , and anything in this weight class that claims otherwise
is lying to you.

Talon-Preview is a **demo release**. It exists to demonstrate a training
pipeline and give a first look at the direction the Talon project is heading.
It is not an alpha. It is not a beta. It is a proof of concept , a deliberate
early release so that the development process is visible and the project is
accountable to a real audience from the start.

Expect rough edges. Set expectations accordingly.

---

## What Is Talon-Preview?

Talon-Preview is an early-access security reasoning assistant fine-tuned for
authorized penetration testing methodology, red team planning, and offensive
security education. It is built on a 5.1B parameter base model with 2B
parameters active during inference.

At this stage, Talon-Preview is strongest at:

- Structuring penetration testing methodology and engagement plans
- Explaining how attacks work at a conceptual and mechanical level
- Walking through enumeration phases in a structured way
- Explaining the legal and authorization framework for security work
- Reasoning about attack paths and helping operators think through options
- Security report writing and executive summary drafting

It is weakest at:

- Generating precise CLI syntax for tools , **hallucinations on specific
  flags, arguments, and tool interfaces are a known and significant issue
  at this model size**
- Complex multi-step reasoning chains that require holding a lot of
  technical state simultaneously
- Sophisticated low-level prompts involving binary exploitation, shellcode
  mechanics, or kernel internals , these will frequently produce
  plausible-sounding/looking but incorrect output

**The rule of thumb:** use Talon-Preview to think and plan. Do not use it
to generate commands you intend to run without verifying them manually first.

---

## Known Limitations — Do Not Skip This Section

This section is not a disclaimer. It is operational guidance.

**Hallucinations on tool syntax are frequent and confident.**
When asked about specific CLI tools , their flags, subcommands, and
behavior , Talon-Preview will sometimes output commands that look correct
but are not (Hallucinations). This is a known consequence of the model size (Talon-Preview only has a total of 5.1 Billion Parameters) and training
dataset at this stage. Always verify commands against official documentation
or `man` pages before running them in an engagement.

**Avoid highly sophisticated or extremely low-level prompts.**
Prompts that require precise kernel internals, exact exploit mechanics,
or complex multi-stage reasoning chains will push the model past its reliable
capability boundary. The output may be coherent but technically wrong in
ways that are not immediately obvious.

**This model cannot replace human judgment in a live engagement.**
Talon-Preview is a reasoning aid, not an autonomous operator. Treat its
output the way you would treat a junior analyst's first draft — useful
starting point, requires review.

**2B active parameters is a real constraint.**
Long or complex conversations may see quality degrade as the context grows.
If reasoning quality drops, start a fresh session with a focused prompt.

---

## Intended Use

Talon-Preview is built for:

- **Authorized penetration testing** with documented scope and rules of engagement
- **CTF competitions** and training lab environments
- **Security research and education** in authorized contexts
- **Engagement planning** : structuring methodology, scoping, and approach
- **Security report writing** and finding documentation

Using this model against systems you do not have explicit written authorization
to test is outside its intended use and is your legal responsibility, not this
project's.

---

## Quickstart — Ollama

```bash
# Run directly from HuggingFace via Ollama
ollama run hf.co/cbrooklyn/talon-preview

# Recommended quantization for most hardware
# Q4_K_M is the default , good balance of quality and speed
ollama run hf.co/cbrooklyn/talon-preview:Q4_K_M

# Higher quality if your machine can handle it
ollama run hf.co/cbrooklyn/talon-preview:Q8_0
```

**Example interaction that plays to the model's actual strengths:**

```
User:
I have a target with SMB open, a readable public share,
and two usernames recovered from null session enumeration.
How should I structure the next phase of the assessment?

Talon-Preview:
[Plans the enumeration methodology, explains what to look for
in the share, structures the credential attack approach, and
explains the detection surface]
```

---

## Model Details

| Attribute | Value |
| :--- | :--- |
| Release type | Demo / Proof of Concept |
| Total parameters | 5.1B |
| Active parameters during inference | 2B |
| Inference compatibility | Ollama |
| Recommended quantization | Q4_K_M |
| Available quantizations | Q4_K_M · Q6_K · Q8_0 |
| Language | English |
| Domain | Cybersecurity / Offensive Security |
| Context window | 128,000 tokens |

---

## How Talon Handles Uncertainty

When Talon-Preview hits the edge of its knowledge on tool syntax or CVE
specifics, it is trained to invoke its web search tool rather than guess.
In practice at this model size this behavior is not perfectly reliable —
another known limitation of the preview stage. When you see it search before
answering, that is the intended behavior. When you see it output commands
confidently without searching, verify those commands before trusting them.

---

## What Is Coming Next

Talon-Preview validates that the training pipeline works end-to-end. The next
phase involves a significantly larger base model, a rebuilt training dataset
that prioritizes verified tool usage over conceptual descriptions, and an
RL environment where Talon can execute commands in an isolated sandbox and
receive corrective signal when syntax is wrong or a tool does not exist.
That feedback loop is how the hallucination problem gets solved at its root —
not by telling the model to be careful, but by giving it an environment where
being wrong has a cost.

The preview is the first step. It is not the destination.

---

<div align="center">
  <sub>Talon is an independent project building specialized AI security
  tooling designed for practitioners who need a thinking partner, not a
  chatbot with a security skin.</sub>
</div>