Show HN: We post-trained a model that pen tests instead of refusing

Jun 20, 2026•dk189•View Original

TL;DR Highlight

A post-trained security model in a CLI scans code and, by booking, runs authorized pen tests.

Who Should Read

A backend or security developer who wants an LLM agent to audit code but is blocked by commercial models refusing offensive-security requests.

Core Mechanics

One CLI, two modes
- Security Scan is a self-serve, read-only mode that reads your code.
- Pen Test attempts real exploits against systems you authorize and is available only by booking.
They trained their own model because others refuse
- The article says off-the-shelf models refuse the work this product does.
- So it runs on a model Cosine post-trained for offensive security.
Safety lives in a Go harness outside the model
- The harness intercepts every tool call before execution.
- In Scan mode it blocks file writes and command execution regardless of what the model wants.
- In Pen Test mode it limits network egress to the authorized targets.
Findings can be reproduced to confirm them
- With Exploit Verification on, it attempts a safe reproduction after the initial report.
- Docker runs in an isolated container; Live FS runs on your checkout, which stays read-only.
Output is a local markdown report
- .argusred/scan-<date>.md lists location, severity, cause, and fix direction.
- Findings it can't ground in your code are left out.
Time and cost
- A 6-module scan of Bank of Anthos (~30k LOC) took ~10 minutes; a full Symfony (~1.5M LOC) scan took ~40 minutes.
- Install is free with 2M tokens on a new Cosine account. It's a closed binary, not open source.

Community Reactions

Community: criticism over model attribution
- A commenter said the marketing never mentions Kimi, and a site search for 'kimi' finds nothing.
- Others argued a finetune doesn't make a model lab and questioned Kimi licensing compliance.
Community: reading it as a post-trained Kimi K2.6
- One comment said an open model like Kimi K2.6 can be post-trained fairly easily to allow pen tests.
- The view was that as long as open models exist, AI-hacking defenses are only temporary blocks.
Community: alternatives and evaluation questions
- One user reported good results running shannon airgapped on AWS Bedrock, and using Claude Code tokens at effectively no extra cost.
- Others noted no standard cyber benchmarks and asked how an adversarial agent was evaluated.
Community: doubts about releasing an offensive tool
- One comment said the gated access is the same policy as Anthropic and OpenAI, just with different criteria.
- Another asked why build an offensive tool instead of a repo scanner and how to release it safely.

How to Apply

Run Security Scan on your own repo
- Install with brew, run argusred at the repo root, and enable about 5 modules.
- Keep Exploit Verification off at first and check severity and fix direction in the .argusred/ report.
Turn on Exploit Verification with Docker
- Choose Docker mode to cut false positives.
- Use Live FS only for findings that appear in a real environment.
Put a deterministic guard before agent tool calls
- In your own agent, block writes and command execution at the tool-call layer, not in the prompt.
- Enforce the network allowlist at the same layer.
Check network behavior before trusting it
- It's a closed binary, so run it behind a firewall and watch destinations with tcpdump.
- Then apply it to real code.

Try It

copy & run

# Run in a shell (macOS/Linux), from the root of the repo to audit.

brew install CosineAI/argusred/argusred
cd path/to/your/repo
argusred

# First run opens a Cosine sign-up. Pick modules, press 'a' to start.
# Check results:
ls .argusred/

# Optional traffic check: in another terminal
# sudo tcpdump -i any -n

Terminology

post-trainingExtra training applied to an already-trained model to fit a specific purpose. Like training a new hire for the security team after they join.

Pen TestAn authorized attack on a real system to see whether vulnerabilities actually can be exploited. Like actually trying the lock instead of just studying the blueprint.

harnessThe wrapper around a model that inspects and blocks tool calls. Like a guard at the door who decides what passes, whatever the model wants.

SSRFA vulnerability that makes a server send requests to an attacker-chosen address. Like sending your server on an errand into the internal network.

DASTDynamic testing that sends requests to a running app to find vulnerabilities. The article says Scan mode does not do this.

Related Resources

Show HN: We post-trained a model that pen tests instead of refusing

Jun 20, 2026•dk189•View Original

TL;DR Highlight

A post-trained security model in a CLI scans code and, by booking, runs authorized pen tests.

Who Should Read

A backend or security developer who wants an LLM agent to audit code but is blocked by commercial models refusing offensive-security requests.

Core Mechanics

One CLI, two modes
- Security Scan is a self-serve, read-only mode that reads your code.
- Pen Test attempts real exploits against systems you authorize and is available only by booking.
They trained their own model because others refuse
- The article says off-the-shelf models refuse the work this product does.
- So it runs on a model Cosine post-trained for offensive security.
Safety lives in a Go harness outside the model
- The harness intercepts every tool call before execution.
- In Scan mode it blocks file writes and command execution regardless of what the model wants.
- In Pen Test mode it limits network egress to the authorized targets.
Findings can be reproduced to confirm them
- With Exploit Verification on, it attempts a safe reproduction after the initial report.
- Docker runs in an isolated container; Live FS runs on your checkout, which stays read-only.
Output is a local markdown report
- .argusred/scan-<date>.md lists location, severity, cause, and fix direction.
- Findings it can't ground in your code are left out.
Time and cost
- A 6-module scan of Bank of Anthos (~30k LOC) took ~10 minutes; a full Symfony (~1.5M LOC) scan took ~40 minutes.
- Install is free with 2M tokens on a new Cosine account. It's a closed binary, not open source.

Community Reactions

Community: criticism over model attribution
- A commenter said the marketing never mentions Kimi, and a site search for 'kimi' finds nothing.
- Others argued a finetune doesn't make a model lab and questioned Kimi licensing compliance.
Community: reading it as a post-trained Kimi K2.6
- One comment said an open model like Kimi K2.6 can be post-trained fairly easily to allow pen tests.
- The view was that as long as open models exist, AI-hacking defenses are only temporary blocks.
Community: alternatives and evaluation questions
- One user reported good results running shannon airgapped on AWS Bedrock, and using Claude Code tokens at effectively no extra cost.
- Others noted no standard cyber benchmarks and asked how an adversarial agent was evaluated.
Community: doubts about releasing an offensive tool
- One comment said the gated access is the same policy as Anthropic and OpenAI, just with different criteria.
- Another asked why build an offensive tool instead of a repo scanner and how to release it safely.

How to Apply

Run Security Scan on your own repo
- Install with brew, run argusred at the repo root, and enable about 5 modules.
- Keep Exploit Verification off at first and check severity and fix direction in the .argusred/ report.
Turn on Exploit Verification with Docker
- Choose Docker mode to cut false positives.
- Use Live FS only for findings that appear in a real environment.
Put a deterministic guard before agent tool calls
- In your own agent, block writes and command execution at the tool-call layer, not in the prompt.
- Enforce the network allowlist at the same layer.
Check network behavior before trusting it
- It's a closed binary, so run it behind a firewall and watch destinations with tcpdump.
- Then apply it to real code.

Try It

copy & run

# Run in a shell (macOS/Linux), from the root of the repo to audit.

brew install CosineAI/argusred/argusred
cd path/to/your/repo
argusred

# First run opens a Cosine sign-up. Pick modules, press 'a' to start.
# Check results:
ls .argusred/

# Optional traffic check: in another terminal
# sudo tcpdump -i any -n

Terminology

post-trainingExtra training applied to an already-trained model to fit a specific purpose. Like training a new hire for the security team after they join.

Pen TestAn authorized attack on a real system to see whether vulnerabilities actually can be exploited. Like actually trying the lock instead of just studying the blueprint.

harnessThe wrapper around a model that inspects and blocks tool calls. Like a guard at the door who decides what passes, whatever the model wants.

SSRFA vulnerability that makes a server send requests to an attacker-chosen address. Like sending your server on an errand into the internal network.

DASTDynamic testing that sends requests to a running app to find vulnerabilities. The article says Scan mode does not do this.

Show HN: We post-trained a model that pen tests instead of refusing

TL;DR Highlight

Who Should Read

Core Mechanics

Community Reactions

How to Apply

Try It

Terminology

Related Papers

Related Resources

Show HN: We post-trained a model that pen tests instead of refusing

TL;DR Highlight

Who Should Read

Core Mechanics

Community Reactions

How to Apply

Try It

Terminology

Related Papers

Related Resources