When building AI agents for cybersecurity, developers face two massive roadblocks:

Data Leakage: Cloud LLMs (OpenAI, Anthropic) require sending internal network topologies, open ports, and live exploit responses to third-party servers.
Hallucination: General-purpose LLMs struggle with deterministic tool-calling syntax, breaking automated penetration testing workflows.

To solve this, I built and open-sourced CyberAgent v3.5 — a 100% offline, autonomous AI penetration testing and security operator powered by a fine-tuned local Small Language Model (SLM).

⚡ The Architecture: Qwen 2.5 (3B) + Unsloth

Instead of using a bloated 70B model or expensive cloud APIs, I fine-tuned Qwen2.5-3B-Instruct using Unsloth on a curated 60MB+ multi-turn cybersecurity dataset.

Model Size: 1.93 GB (Quantized to GGUF Q4_K_M)
Execution: Runs 100% locally on consumer hardware via Ollama / Llama.cpp (under 4GB VRAM/RAM).
Inference Speed: Zero API latency, zero cost per token, and complete privacy.
🛡️ Key Capabilities (57 Native Tools)

CyberAgent operates on deterministic ReAct loops with strict Human-in-the-Loop (HITL) safeguards:

Phase 1: External Attack Surface Recon

Passive WHOIS & ASN geolocation intelligence
Multi-threaded service port probing & TLS cipher health
Subdomain enumeration via Certificate Transparency logs (crt.sh)
DNS security audit (SPF, DMARC, DKIM, CAA records)

Phase 2: Vulnerability Discovery

Dual-probe soft-404 baseline detection (eliminates false positives)
WAF fingerprinting (Cloudflare, AWS WAF, Akamai, Imperva)
Login brute-force resilience & timing leak detection (CWE-204)
Sensitive leak extraction (exposed .env, API keys, JWT tokens)

Phase 3: Automated Hardening & Remediation

Generates production-ready nginx_hardened.conf, cloudflare_waf_rules.json, and .htaccess
Synthesizes 3-page executive & technical PDF audit reports mapped to PCI-DSS 4.0, GDPR, and ISO 27001.
🚀 Quickstart: Running it Locally

You can run CyberAgent on your local machine in just a few commands:

  1. Pull the Fine-Tuned GGUF Model with Ollama: bash # Download from Hugging Face and create model: ollama run HFShishir/CyberAgent-3B-GGUF
  2. Clone and Run the Agent: bash git clone https://github.com/Shishir880/CyberAgent.git cd CyberAgent pip install -r requirements.txt # Launch with CLI: python cli.py # Or launch with the Cyberpunk Dark Desktop GUI: python gui_selector.py 🔗 Open-Source Repositories

Everything is open-source under the MIT License:

📦 GitHub Repository: Shishir880/CyberAgent
🧠 Hugging Face Model: CyberAgent-3B-GGUF
📊 Training Dataset: CyberAgent Cybersecurity Dataset
🌐 Web Scanner: Bizmatepro Cyber Tools

I would love to hear feedback from the Dev.to community! If you are into local LLMs, penetration testing, or autonomous agents, feel free to star the repo and share your thoughts in the comments below.