Con0

Con0 is a state-of-the-art vision-language model specialized for cyber security, developed by Arcanic AI in collaboration with NextZero.

Con0 is built to think like a security auditor. It reads code, logs, screenshots, and infrastructure diagrams, and surfaces vulnerabilities - from classic web-application flaws to the newest AI-agent attack surfaces - with actionable remediation guidance.

What Con0 audits

Web & application security

• SQL injection (SQLi) - time-based, boolean-based, error-based, and blind variants across query builders and ORMs
• Cross-site scripting (XSS) - reflected, stored, and DOM-based injection
• Cross-site request forgery (CSRF), server-side request forgery (SSRF)
• Command injection, path traversal, XXE, deserialization
• Broken authentication, broken access control, and IDOR
• OWASP Top 10 coverage, code review, and secure-configuration assessment

AI & agent security

• Prompt injection and jailbreak surface analysis
• Tool-calling and function-dispatch misuse
• Least-privilege / permission-scope review
• Multi-step agent threat modeling

General security

• Vulnerability triage and CVE context mapping
• Incident analysis from logs, traces, and screenshots
• Secure-code guidance and remediation planning

Model architecture

• 27B parameters, hybrid Gated DeltaNet + full attention
• Native vision-language model (image + video + OCR)
• 262,144-token context window
• Flexible reasoning (thinking) control and tool calling

Benchmarks

Benchmark evaluation is in progress and will be published here.

Benchmark	Con0	Baseline (Qwen3.8-27B)
SQLi Detection	pending	pending
XSS Detection	pending	pending
OWASP Top 10 (aggregate)	pending	pending
Secure Coding	pending	pending
Prompt-Injection Detection	pending	pending
MMLU	pending	84.7
GSM8K	pending	90.0

Usage

from transformers import AutoModelForMultimodalLM, AutoProcessor
import torch

model = AutoModelForMultimodalLM.from_pretrained(
    "arcanicai/Con0", torch_dtype=torch.bfloat16, device_map="auto"
)
processor = AutoProcessor.from_pretrained("arcanicai/Con0")

messages = [{"role": "user", "content": "Review this code for SQL injection vulnerabilities."}]
text = processor.apply_chat_template(messages, tokenize=False, add_generation_prompt=True)
inputs = processor(text=[text], return_tensors="pt").to(model.device)
output = model.generate(**inputs, max_new_tokens=512)
print(processor.decode(output[0], skip_special_tokens=True))

About the developers

Con0 is developed by Arcanic AI, a research lab focused on reliable and secure AI systems, in partnership with NextZero.

License

Apache 2.0.