A fine-tune that admits it didn’t add knowledge

CyberStrike-OffSec-35B comes from Orhan Yıldırım, published under oyildirim on 25 June 2026. Its model card is unusually direct about what the release is: “a small, targeted alignment, not a capability upgrade.” It did not add security knowledge, the card says — the base Qwen3.6 already knows offensive-security concepts and already emits tool calls. What the fine-tune did was teach the model to emit those calls in the exact format a CyberStrike harness expects, route to valid agent archetypes, act on real tool observations instead of fabricating them, and terminate cleanly. The training data was deliberately small: 300 examples, one round.

The release exists because the previous CyberStrike model collapsed in production. Users reported broken tool calling, “simulated executions,” and faked engagements; the card says the old weights wrote prose instead of structured calls, invented curl and SSL handshakes, Nmap scans, Set-Cookie headers, even fabricated flags, and never terminated. The fix was validated with a three-way A/B run over 24 scenarios (six axes, 62% out-of-distribution), documented in EVALUATION.md: 18/24 genuine structured tool calls versus the previous model’s 0/24, 24/24 clean terminations, no fabricated observations. Those figures are the base’s own upstream claims, grounded — per the report — in raw model output, read them as such.

The surrounding claims are bigger. On LinkedIn, the creator describes CyberStrike as an open-source “AI-powered offensive security agent cluster,” and a later post claims a 35B LLM fine-tuned on 500k+ real-world offensive-security examples. Resecurity’s July 2026 survey of autonomous offensive-security agents — a third-party vendor analysis, not a benchmark — calls CyberStrike-OffSec-35B “a dedicated offensive-security LLM fine-tuned for real attack chains,” lists an associated ~121,000-record sft-120k dataset sample, and places the platform’s focus on reconnaissance, vulnerability analysis, exploit planning, post-exploitation, and reporting. Its table marks the base model “not publicly disclosed”; the Hugging Face card plainly names Qwen3.6-35B-A3B, so the card wins.

Then huihui-ai took the refusals out

On 10 August 2026, huihui-ai published the abliterated derivative: “an uncensored version of oyildirim/CyberStrike-OffSec-35B created with abliteration,” and, true to the house style, “a crude, proof-of-concept implementation” removing refusals without TransformerLens, via Sumandora’s pure-Transformers tool. The mechanism: compare activations for harmful and harmless prompts, estimate a direction associated with refusal, and project it out of selected weights — the Arditi et al. refusal-direction method. A narrow weight edit, not a jailbreak prompt and not a fine-tune.

Two details matter. First, the pinned repo counts 35,951,822,704 parameters — about 844 million more than the fine-tune’s 35,107,181,936 — because the MTP module was restored from Qwen3.6-35B-A3B; the card says it is mainly needed for llama.cpp and can be dropped from the safetensors index if unused. Second, the pinned config names the architecture class Qwen3_5MoeForConditionalGeneration: the same Qwen3.6 sparse-MoE skeleton (see our Qwen3.6 field note for the 256-expert layout), with the safety layer edited out.

What abliterating a security model changes

Most abliterated models start as general-purpose assistants whose refusals are an annoyance. This one starts as a tool-calling model for an offensive-security harness. The refusal behavior being projected out is the last layer between “authorized pentesting” and “point it at anything.”

Resecurity’s analysis, written for defenders, says the dual-use part plainly: the weights “lower the skill floor for adversaries,” GGUF quantizations let the model run locally without API telemetry, and CyberStrike has appeared in incident reporting around the FortiBleed campaign — with the same article cautioning that some of those references sit in marketing material and need independent verification. I won’t moralize further: an offensive-security model with refusals removed is exactly as dangerous as its operator’s authorization. But this is a category, not a one-off — the survey also lists other abliterated security LLMs, including a “zero-refusal” tactical model built on an abliterated Qwen3.5 base.

What the card does and doesn’t claim

The abliterated card claims: uncensored via abliteration; crude proof of concept; MTP provenance. It does not claim any refusal-rate measurement, any post-edit rerun of the base’s tool-call evaluation, or any capability-retention number. The base card’s honesty — it did not add security knowledge, here is the eval — is not matched by the derivative’s card, which ships a chat script and stops. Do not transfer the base’s 18/24 tool-call figures to this checkpoint.

What is proven here?

The lineage is documented end to end — Qwen3.6-35B-A3B → CyberStrike-OffSec-35B → abliterated derivative — and the base’s tool-call evaluation is published. What is not proven: that this checkpoint refuses less (no measurement exists) and that it kept the base’s tool-calling behavior (no rerun exists). Both are publisher claims.

The paper trail so far

At pin time the repo had 1,803 downloads and 69 likes. The single discussion thread — “GGUF of this model is needed,” one comment, opened 11 August 2026 — was followed by the GGUF repository (6.2k downloads at collection time, Q4_K for llama.cpp). Third-party infrastructure already lists it: a Featherless re-upload describes the same proof-of-concept uncensored variant with tool-use capabilities. Reddit threads exist — r/AgenticCybersecurity picked up the base model, and the creator posted the platform on r/Pentesting — but Reddit’s API and page extraction both refused us at research time, so we link those threads without quoting them.

How we treat it

Our prepared profile pins the revision above and budgets one H200 at an approximate managed price estimate of $5.45/hour. We serve it with the card’s own warning: safety filtering is significantly reduced, and the intended envelope is research, testing, and controlled environments with human review. “Abliterated” means refusal-reduced — not authorized, not legal, and not harmless.

The idea, in plain words

How a model learns to call tools instead of guessing

Base models often hallucinate function calls. Supervised fine-tuning (SFT) fixes that with examples: here, a ~300-example dataset taught the model to emit structured tool calls, and the base card measured the difference — 18 of 24 correct tool calls after, 0 of 24 before. That's what 'tool-calling' means in practice: the model doesn't know tools, it was shown when and how to call them.

Primary sources