Trained a model for cybersecurity · how to test it?

There is so much "AI Cybersecurity" hype out there that a lot of people are trying to build AI wrappers without knowing what they are doing, and cybersecurity professionals can spend an entire week babysitting a hallucinating chatbot, because someone from their C-suite asked them to.

I am neither, I have a background in building and training LLMs - but no cybersecurity. This is why I need your help.

Without any experience in the space, I've done something insane. I've taken all the capture the flag type of contests over the past decade or so and post-trained (SFT and RL) a model for cybersecurity.

The idea was meant to be simple: most products out there are wrappers and inherit safety guardrails from the foundation models. What if the model was trained specifically for cybersecurity i.e. to attack, rather than refuse?

Also built a harness around it where it will try to verify every vulnerability reducing false positives, to address the hallucinations issue.

After training the model, to test the product, I've pointed it to a number of open source projects (e.g. Symfony) to find vulnerabilities.

To my surprised, it has done a good job finding issues - I've done disclosures and waiting for responses, although it seems slow to get responses.

This is where my predicament lies. How to best test a model like this? And how to responsibly get the model infront of people to test?

Impact

No direct security impact or vulnerability is described. The content relates to a security tool designed to identify vulnerabilities and conduct penetration tests within authorized boundaries. The tool's design includes multiple safety measures to prevent unauthorized or harmful actions. There is no evidence of exploitation, compromise, or inherent security flaws in the tool from the provided information.

Defensive guidance

Not applicable as no vulnerability or threat is reported. The tool includes built-in safeguards such as authorization requirements, sandboxed execution, and read-only modes to mitigate risks during operation. Users should follow the vendor's guidance on authorization and scope when using the Pen Test mode. Since this is a product description and discussion rather than a vulnerability report, no specific remediation is required.

Summary

Argusred is a cybersecurity tool built around a custom-trained AI model focused on offensive security tasks. The model was post-trained on capture-the-flag contest data to enhance its capability to detect and verify vulnerabilities in code and running systems. The tool offers two modes: Security Scan (read-only code analysis) and Pen Test (active exploitation attempts on authorized targets). It includes safeguards such as a Go harness that intercepts and blocks unauthorized or mutating operations, sandboxed execution environments, and strict authorization and scope controls for penetration testing. The tool outputs detailed markdown reports with confirmed vulnerabilities and remediation guidance. The product is not open source and runs locally, allowing users to audit its behavior. The content is a discussion post seeking advice on how to test the model and responsibly expose it to testers. There is no indication of a security vulnerability or exploit associated with the tool itself.

Trained a model for cybersecurity · how to test it?

Discussion

Impact

Defensive guidance

Summary

References

Community reviews

Discussion

AI analysisMachine-generated, updated 19 Jun 2026, 14:50 UTC

Technical details

References

Community reviews