I fine-tuned Qwen 2.5 (3B) with Unsloth to build CyberAgent: An offline AI security agent with 57 tools

Shishir Rahman — Wed, 11 Nov 2026 17:38:10 +0000

When building AI agents for cybersecurity, developers face two massive roadblocks:

Data Leakage: Cloud LLMs (OpenAI, Anthropic) require sending internal network topologies, open ports, and live exploit responses to third-party servers.
Hallucination: General-purpose LLMs struggle with deterministic tool-calling syntax, breaking automated penetration testing workflows.

To solve this, I built and open-sourced CyberAgent v3.5 — a 100% offline, autonomous AI penetration testing and security operator powered by a fine-tuned local Small Language Model (SLM).

⚡ The Architecture: Qwen 2.5 (3B) + Unsloth

Instead of using a bloated 70B model or expensive cloud APIs, I fine-tuned Qwen2.5-3B-Instruct using Unsloth on a curated 60MB+ multi-turn cybersecurity dataset.

Model Size: 1.93 GB (Quantized to GGUF Q4_K_M)
Execution: Runs 100% locally on consumer hardware via Ollama / Llama.cpp (under 4GB VRAM/RAM).
Inference Speed: Zero API latency, zero cost per token, and complete privacy.
🛡️ Key Capabilities (57 Native Tools)

CyberAgent operates on deterministic ReAct loops with strict Human-in-the-Loop (HITL) safeguards:

Phase 1: External Attack Surface Recon

Passive WHOIS & ASN geolocation intelligence
Multi-threaded service port probing & TLS cipher health
Subdomain enumeration via Certificate Transparency logs (crt.sh)
DNS security audit (SPF, DMARC, DKIM, CAA records)

Phase 2: Vulnerability Discovery

Dual-probe soft-404 baseline detection (eliminates false positives)
WAF fingerprinting (Cloudflare, AWS WAF, Akamai, Imperva)
Login brute-force resilience & timing leak detection (CWE-204)
Sensitive leak extraction (exposed .env, API keys, JWT tokens)

Phase 3: Automated Hardening & Remediation

Generates production-ready nginx_hardened.conf, cloudflare_waf_rules.json, and .htaccess
Synthesizes 3-page executive & technical PDF audit reports mapped to PCI-DSS 4.0, GDPR, and ISO 27001.
🚀 Quickstart: Running it Locally

You can run CyberAgent on your local machine in just a few commands:

Pull the Fine-Tuned GGUF Model with Ollama: bash # Download from Hugging Face and create model: ollama run HFShishir/CyberAgent-3B-GGUF
Clone and Run the Agent: bash git clone https://github.com/Shishir880/CyberAgent.git cd CyberAgent pip install -r requirements.txt # Launch with CLI: python cli.py # Or launch with the Cyberpunk Dark Desktop GUI: python gui_selector.py 🔗 Open-Source Repositories

Everything is open-source under the MIT License:

📦 GitHub Repository: Shishir880/CyberAgent
🧠 Hugging Face Model: CyberAgent-3B-GGUF
📊 Training Dataset: CyberAgent Cybersecurity Dataset
🌐 Web Scanner: Bizmatepro Cyber Tools

I would love to hear feedback from the Dev.to community! If you are into local LLMs, penetration testing, or autonomous agents, feel free to star the repo and share your thoughts in the comments below.

I built 100+ free client-side developer tools — here's what I learned after 2 weeks

Shishir Rahman — Fri, 29 May 2026 23:46:48 +0000

The Problem

Every time I needed to decode a JWT or generate a bcrypt hash,
I had to use ad-heavy websites that might be logging my input.

I couldn't find a single clean, trustworthy, all-in-one toolkit.
So I built one.

What I Built

Bizmatepro (https://www.bizmatepro.xyz/) is a free,
privacy-first toolkit with 100+ utilities for developers,
marketers, and security professionals.

The Core Rule

Everything runs client-side. No exceptions for sensitive tools.

Open DevTools → Network tab while using the JWT decoder
or password generator. Zero outbound requests.

Tech Stack

Plain HTML/CSS/JS (no heavy frameworks)
Cloudflare for edge caching and security
Render for hosting
Google APIs for DNS/IP lookups
No database whatsoever

What's Inside

Security tools

Password generator (offline)
JWT decoder (offline)
Bcrypt/HMAC/hash generators
CC validator (Luhn algorithm)

Developer utilities

JSON/XML formatter and validator
Regex tester
SQL formatter
Base64, URL encoder, hex tools

Network & SEO

DNS lookup
SSL checker
Meta tag analyzer
SERP simulator

Business tools

Invoice generator → PDF
Quote builder → PDF
Receipt maker → PDF

100+ tools total across 10 categories.

Business Model

No ads. No VC money. Donations only.

Controversial? Maybe. But I wanted to prove that
a useful product doesn't need to monetize its users.

2 Weeks In — Honest Numbers

56 total users
1.7K events
Traffic from: USA, Indonesia, Germany, Bangladesh, UK
Donations: $0 so far 😅

What I Learned

Building is the easy part. Distribution is everything.
"Privacy-first" is a feature, not just a tagline.
The developer community is incredibly skeptical (rightfully so) about client-side claims.
Reddit and HN are brutal but honest.

What's Next

Open sourcing the codebase
Adding more AI-powered tools
Building a proper API for developers

Feedback Welcome

What tools are you missing?
What's broken?
What would make you actually bookmark this?

Try it: https://www.bizmatepro.xyz/

DEV Community: Shishir Rahman