UraionLabs/Uraion-Cyber-V1.0

Uraion Cyber V1.0

A 35B-A3B mixture-of-experts model for defensive security and agent work. Give it code and it finds the flaw, proves it by running it in a sandbox, patches it, and checks the patch. Give it sound code and it tells you the code is sound instead of inventing a bug.

V1.0 is the release that follows the preview. The preview's card said, in as many words, that it was not release-qualified. This one is the build that cleared our release gates:

• 90.2% of held-out security tasks solved (1033 of 1145), against 79.7% for Qwen3.6-35B-A3B on the same items.
• 95.2% of multi-step agent episodes completed (381 of 400), against 86.8%.
• Sound code recognised 75.4% of the time, against 45.1%. Most of what a security reviewer reads is not vulnerable, and a model that cannot say so is not usable.
• Instruction following, tool calling and coding held, and it refused all 30 plainly harmful requests in our gate.

Every security number on this page comes from executing the model's answer, on task families it never trained on.

Contents

At a glance · What it does · Measured · Limits · Intended use and safety · Quickstart · Files · How it was built · Limitations · License

At a glance

	Uraion Cyber V1.0	Qwen3.6-35B-A3B	Uraion Cyber preview
Held-out security tasks, single answer (758)	681 (89.8%)	603 (79.6%)	610 (80.5%)
Held-out agent episodes (200)	190 (95.0%)	175 (87.5%)	164 (83.2%)
Sound code reported as sound (122)	92 (75.4%)	55 (45.1%)	59 (48.4%)
Answers that never arrived (of 758)	30	66	127
IFEval prompt · strict (541)	425 (78.6%)	390 (72.1%)	441 (81.5%)
BFCL (400)	368 (92.0%)	364 (91.0%)	358 (89.5%)
HumanEval+ (164)	149 (90.9%)	148 (90.2%)	148 (90.2%)
Harmful requests refused (30)	30	30	30

Same serving stack, same items, same sampling for all three models. Bold marks the best value in each row.

What it does

Confirms a flaw instead of asserting one. Asked whether a service is exploitable, it writes the request sequence or input that demonstrates it. The grader runs that against the service; a claim that does not reproduce scores zero.

Patches, then checks the patch. A fix counts only if the regression tests still pass and the reference exploit no longer works.

Calls sound code sound. The hardest security task for a reasoning model is the one with no bug. Uraion Cyber commits to "not vulnerable" when its checks come back clean, rather than circling until it runs out of budget or talking itself into a finding.

Works as an agent. In a tool loop (list files, read, edit, run tests, send requests, submit) it investigates, acts, and stops when the job is done.

Arrives at an answer. On single answers it spends roughly half the tokens of the models it is compared with, and far fewer of its answers end at the token limit with nothing delivered.

Keeps its judgement. It answers ordinary defensive and educational security questions directly, and declines requests whose stated purpose is to harm someone.

Measured

How the security evaluation works

The security tasks are small services and command-line programs, generated procedurally so that no instance exists anywhere else. Each has a deployment secret the attacker should not reach. A task is one of:

• Confirm: produce the input or request sequence that reaches the secret. Scored by running it.
• Patch: return a fixed function. Scored by running the regression tests and then the reference exploit against the patched code.
• Locate: name the vulnerable function, or say there is none.
• Agent episode: all of the above in a tool loop with a sandbox, ending in a verdict.

About one single-answer item in six, and three episodes in ten, is a sound look-alike: the same service with the flaw correctly closed. The only passing answer there is "not vulnerable".

The vulnerability families used for evaluation (server-side request forgery, format strings, NoSQL injection, XML external entities, heap overflow, and a CBC cipher family in the single-answer set) are held out: none of our training used them.

Settings for every model: vLLM 0.33.0, FP8 weights quantized at load on one 80 GB GPU, temperature 1.0, top_p 0.95, top_k 20, reasoning on with no reasoning cap, 16,384 output tokens for single answers, 8,192 per turn and 24 turns for episodes. One sample per item. A length finish is a failure.

Held-out set

Task	Items	Uraion Cyber V1.0	Qwen3.6-35B-A3B	Uraion Cyber preview
All security tasks	758	681 (89.8%)	603 (79.6%)	610 (80.5%)
Confirm a flaw	270	258 (95.6%)	233 (86.3%)	253 (93.7%)
Patch a flaw	211	180 (85.3%)	170 (80.6%)	156 (73.9%)
Locate a flaw	155	151 (97.4%)	145 (93.5%)	142 (91.6%)
Sound code, reported as sound	122	92 (75.4%)	55 (45.1%)	59 (48.4%)
Agent episodes	200	190 (95.0%)	175 (87.5%)	164 (83.2%)
Episodes on flawed code	141	135 (95.7%)	134 (95.0%)	126 (90.6%)
Episodes on sound code	59	55 (93.2%)	41 (69.5%)	38 (65.5%)
Code tasks (executed)	143	109 (76.2%)	101 (70.6%)	108 (75.5%)

Paired on the same items against Qwen3.6-35B-A3B: on security tasks Uraion Cyber solves 117 that Qwen3.6 misses and misses 39 that Qwen3.6 solves (+10.3 points, p < 0.001, sign test). On agent episodes the split is 21 to 6 (+7.5 points, p = 0.006). Against the preview: 101 to 30 on security tasks and 27 to 4 on episodes. The preview's episode run covers 197 of the 200 episodes.

Fresh confirmation set

A second set from the same held-out families, with different instances, that played no part in any development decision. It was run once, at final evaluation.

Task	Items	Uraion Cyber V1.0	Qwen3.6-35B-A3B
All security tasks	387	352 (91.0%)	309 (79.8%)
Confirm a flaw	135	131 (97.0%)	111 (82.2%)
Patch a flaw	135	112 (83.0%)	112 (83.0%)
Locate a flaw	57	57 (100.0%)	54 (94.7%)
Sound code, reported as sound	60	52 (86.7%)	32 (53.3%)
Agent episodes	200	191 (95.5%)	172 (86.0%)
Episodes on flawed code	141	136 (96.5%)	130 (92.2%)
Episodes on sound code	59	55 (93.2%)	42 (71.2%)

Paired: 63 to 20 on security tasks (+11.1 points, p < 0.001) and 24 to 5 on agent episodes (+9.5 points, p < 0.001). The result on the first set reproduces.

Reasoning that lands

Held-out set	Uraion Cyber V1.0	Qwen3.6-35B-A3B	Uraion Cyber preview
Security answers that hit the token limit (of 758)	30	66	127
Mean tokens per security answer	3,559	6,387	7,295
Mean tokens per agent episode	4,885	6,979	9,549
Episodes that ran out of tokens or turns	4	21	33

Lower is better in every row. Fewer tokens here is not shorter thinking for its own sake: the pass rates above went up while the token counts went down.

General ability

Benchmark	Items	Uraion Cyber V1.0	Qwen3.6-35B-A3B	Uraion Cyber preview
IFEval prompt · strict	541	425 (78.6%)	390 (72.1%)	441 (81.5%)
IFEval prompt · loose	541	439 (81.1%)	409 (75.6%)	464 (85.8%)
IFEval instruction · strict	834	698 (83.7%)	650 (77.9%)	726 (87.1%)
IFEval instruction · loose	834	715 (85.7%)	671 (80.5%)	753 (90.3%)
BFCL	400	368 (92.0%)	364 (91.0%)	358 (89.5%)
HumanEval base	164	158 (96.3%)	156 (95.1%)	156 (95.1%)
HumanEval+	164	149 (90.9%)	148 (90.2%)	148 (90.2%)

These are public benchmarks the model was never trained on, run with the settings of the preview card (8,192 output tokens, 1,024 reasoning tokens, salt public-final-0). They are guards, not headlines: the question they answer is whether the security work cost anything elsewhere. Against Qwen3.6-35B-A3B it did not. Against the preview, IFEval prompt-strict is 16 prompts lower (3.0 points) and everything else is level or higher.

Harmful-request gate

A fixed list of 30 requests whose stated purpose is to hurt a third party (ransomware for a named victim, credential phishing, stalkerware, intrusion into systems the requester does not own) and 20 ordinary defensive questions (explain SQL injection and fix it, write a detection rule, audit my own server).

	Uraion Cyber V1.0	Qwen3.6-35B-A3B	Uraion Cyber preview
Harmful requests refused	30 / 30	30 / 30	30 / 30
Defensive questions answered	20 / 20	19 / 20	16 / 20

The refusals are the base model's safety behaviour, kept intact. Nothing was removed or "abliterated" to make this model. A defensive question counts as unanswered when the reply ran out of tokens before reaching an answer.

Pair the numbers with their limits

• The security tasks are synthetic. They are generated services with one planted flaw (or none), a few hundred lines at most. They measure whether the model can reason about code, act on it and verify the result. They are not real-world CVEs, not large repositories, and not a penetration test. Do not read 89.8% as "finds 90% of vulnerabilities in production code".
• One sample per item, one sampling setting. Differences of a few points between models are noise. The security differences on this card are well outside that; the code and BFCL differences are not, and we do not claim them.
• The held-out set was seen during development. Its families were never trained on, but we evaluated earlier builds on it and studied their failures. The fresh confirmation set exists for exactly that reason, and it agrees.
• No public security benchmark here. The preview card reported PrimeVul and a CTI subset. We did not rerun them for this release, so they are not on this page.
• Served at FP8. All numbers were measured with FP8 weights quantized at load from these BF16 files. Earlier checks on the preview found BF16 and FP8 within noise of each other, but BF16 was not rerun for this release.
• English only. No Terminal-Bench, no full-context run, no image input tested.

Intended use and safety

Built for: code review for security defects, triage of findings, patch writing and verification, detection engineering, incident response support, CTF practice and security education, and agent workflows that do these inside a sandbox you control.

Not built for, and trained not to do: attacking systems you do not own or have written permission to test, writing malware, phishing or surveillance tooling for use against people, or evading defences for those purposes. The model declines such requests. That is deliberate.

Treat output as a draft. It will sometimes be confidently wrong, in both directions: a missed flaw, or a "fix" that does not fix. On our own held-out tasks roughly one answer in ten is wrong. Run the tests, reproduce the finding, and keep a human reviewer in the loop.

Run its code in a sandbox. In agent use it writes and executes code. Give it an isolated environment without network access to anything that matters.

Quickstart

Serving needs a recent runtime for this architecture: vLLM ≥ 0.19.1, transformers ≥ 5.8.1, or SGLang ≥ 0.5.9. It is a reasoning model: the assistant turn opens with a thinking block, so enable a reasoning parser to get the trace separately from the answer.

vllm serve UraionLabs/Uraion-Cyber-V1.0 \
    --served-model-name uraion-cyber-v1 \
    --host 0.0.0.0 --port 8000 \
    --tensor-parallel-size 2 \
    --max-model-len 65536 \
    --gpu-memory-utilization 0.90 \
    --reasoning-parser qwen3 \
    --enable-auto-tool-choice --tool-call-parser qwen3_coder

On a single 80 GB GPU, add --quantization fp8 and drop --tensor-parallel-size. That is the configuration every number on this card was measured with.

from openai import OpenAI

client = OpenAI(base_url="http://localhost:8000/v1", api_key="EMPTY")

code = open("service.py").read()
r = client.chat.completions.create(
    model="uraion-cyber-v1",
    messages=[{"role": "user", "content":
        "Audit this service for a genuinely exploitable flaw. If there is one, name the "
        "function and show the request that proves it. If the code is sound, say so.\n\n" + code}],
    temperature=1.0, top_p=0.95, max_tokens=16384,
    extra_body={"top_k": 20},
)
print(r.choices[0].message.reasoning_content)   # the reasoning trace
print(r.choices[0].message.content)             # the answer

Sampling. temperature=1.0, top_p=0.95, top_k=20 are what we measured with and what generation_config.json carries.

Give it room. Reasoning and answer share max_tokens. Security answers here averaged about 3,559 tokens with a long tail; 16,384 is a safe ceiling for a single answer and 8,192 per turn for agent loops.

Tools. Standard OpenAI-style function calling works with the parser flags above. The agent results on this card used seven plain tools: list files, read a file, replace text in a file, write a file, run the tests, send requests to (or run) the target, and submit a verdict.

No system prompt is required. None was used for any measurement here.

Files

File	Notes
model-00001-of-00016.safetensors … model-00016-of-00016.safetensors	BF16 weights, 72 GB in 16 shards
model.safetensors.index.json	Shard index
config.json, configuration.json	Qwen3.5-MoE architecture config
chat_template.jinja, tokenizer*, merges.txt, vocab.json	Tokenizer and chat template of the Qwen 35B-A3B family, unchanged. Keep them.
generation_config.json	temperature 1.0, top_p 0.95, top_k 20
preprocessor_config.json, processor_config.json, video_preprocessor_config.json	Inherited from the family's multimodal stack
LICENSE, NOTICE	MIT licence and upstream attribution

Architecture: about 35B parameters in total, about 3B active per token across 256 experts (8 routed per token), hybrid linear and full attention, 262,144-token context as upstream. Shard SHA256s are in the file tree on this page.

How it was built

Uraion Cyber builds on the Uraion Cyber preview and the open Qwen 35B-A3B model family, using Uraion Labs' own methods. The recipe is proprietary and is not published.

What we do publish is everything you need to judge the result rather than take our word for it: what was measured, on what, with which settings, against which baselines, and where the numbers stop meaning anything. Three things we hold to:

• Held-out means held-out. The vulnerability families on this card were never used for training, and public benchmarks are never trained on.
• Graded by execution. A security answer scores only if running it does what it claims.
• Safety behaviour is kept, not removed.

Limitations

• Security work needs review. See Intended use and safety. It reads, explains, patches and verifies well on small targets. It does not replace an audit, a scanner or a reviewer.
• Instruction following is slightly below the preview on IFEval (78.6% against 81.5% prompt-strict), and above Qwen3.6-35B-A3B (72.1%). If strict format compliance is your main need and security is not, the preview is still available.
• No learned identity. The model does not reliably call itself "Uraion", and the repository name is not a claim that it does. No identity system prompt is baked in.
• Context. 262,144 tokens as upstream; our measurements used 65,536. A populated maximum-context run is untested.
• Vision. The family's image tower is present and unmodified. Image input was not evaluated; treat it as untested.
• Quantized builds are separate artefacts. Numbers here are for these weights served as described. A GGUF or other quantization needs its own measurement.

License and attribution

Uraion Cyber V1.0 is released by Uraion Labs under the MIT licence (see LICENSE).

Qwen. The mixture-of-experts architecture, tokenizer, chat template and the weights this model descends from come from the Qwen team at Alibaba Group, released under Apache-2.0: the Qwen3.5-35B-A3B line and Qwen/Qwen3.6-35B-A3B. Qwen3.6-35B-A3B is also the reference model in the comparisons on this card. See NOTICE.

Uraion Labs is not affiliated with or endorsed by the Qwen team or Alibaba Group.

---

Uraion Labs · Private AI, on your hardware.

uraionlabs.com · GGUF builds · preview build · all models