Open-weight release
Vinci Cyber 123B 1.0
A defensive infrastructure-review model by SimpleDirect®, fine-tuned from Mistral Devstral 2. It proposes targeted repairs and is trained to leave correct configuration alone. Download BF16 weights or choose a GGUF format.
Model cards and weights on Hugging Face
What it is for
Use Cyber 123B to review infrastructure as code, investigate cloud configuration and propose focused defensive changes on systems you are authorized to assess. Its output is a proposal for your team to review, not a change applied to your infrastructure.
SimpleDirect® trained a LoRA adapter on a BF16 expansion of Devstral 2 and merged it into downloadable weights. Start with representative configurations from your environment, compare proposed changes with independent security checks, and preserve an explicit human approval step.
Measured behaviour
Knowing when to leave code alone.
Cyber 123B is most distinctive on edit restraint in this evaluation. Scanner-measured repair coverage stayed close to the parent, while general coding results were unchanged in a separate HumanEval run.
24/24
Already-correct configurations left unchanged
Held-out test: 24 matched infrastructure pairs, neutral INVESTIGATE prompt, one greedy run. Parent: 0/24 unchanged. Cyber was evaluated as an adapter on its BF16 parent.
| Measured outcome | Devstral 2 BF16 parent | Vinci Cyber 123B |
|---|---|---|
| Already-correct inputs left unchanged | 0/24 | 24/24 |
| Repairs meeting the scanner criterion | 17/24 | 16/24 |
| Repair and preserve the correct counterpart | 0/24 | 16/24 |
| HumanEval coding problems passed | 144/164 | 144/164 |
| Credited repairs passing provider-schema validation | Not checked | 16/16 |
The infrastructure rows use 24 matched pairs: a misconfigured workspace and its already-correct counterpart, presented independently. Both models received the same neutral INVESTIGATE prompt with greedy decoding, one run per condition. HumanEval is a separate 164-problem test.
Cyber was tested with its trained adapter on the BF16 parent. These records do not establish a task rerun after merging or for GGUF. The small, AI-generated case set passed automated admission checks but has no independent case audit or run-to-run variance estimate.
The repair criterion requires the targeted scanner finding to clear without introducing a new detected finding. The follow-up tofu validate audit checks configuration syntax and provider schema. Neither check proves secure or deployable repairs; no cloud plan or apply was performed. Parent repairs were not schema-validated.
The parent’s zero paired score reflects edits to already-correct inputs, not an inability to repair. An unchanged HumanEval score does not establish equivalence across all coding tasks.
Explore the eight security task families
Each family contains three misconfigured inputs and three already-correct counterparts. The parent left none of the safe counterparts unchanged in any family. These small groups do not establish general category-level reliability.
| Security task | Parent repairs | Cyber repairs | Cyber safe inputs unchanged |
|---|---|---|---|
| Public network exposure | 3/3 | 3/3 | 3/3 |
| Encryption at rest | 0/3 | 0/3 | 3/3 |
| Identity and access controls | 3/3 | 3/3 | 3/3 |
| Public data access | 3/3 | 3/3 | 3/3 |
| Secrets management | 3/3 | 2/3 | 3/3 |
| Logging and monitoring | 0/3 | 3/3 | 3/3 |
| Transport security | 2/3 | 2/3 | 3/3 |
| Backup and recovery | 3/3 | 0/3 | 3/3 |
The logging cases improved, while encryption and backup repair remain gaps. Evaluate the model against the configuration types your team actually uses.
Choose a format for your environment.
The primary download is merged BF16 Safetensors; no separate adapter is needed. Its weights alone are approximately 233 GiB, before runtime overhead and context cache.
| GGUF format | Download size | Parts | Runtime evidence |
|---|---|---|---|
| Q8_0 | 123.7 GiB | 3 | No runtime test reported |
| Q5_K_M | 82.3 GiB | 2 | No runtime test reported |
| Q4_K_M | 69.8 GiB | 2 | CPU smoke test: 47 greedy tokens |
Download sizes checked against the published repository files on September 23, 2026. These are storage sizes, not total RAM or VRAM requirements. Loading, activations, runtime state and the KV cache need additional memory. Context length and batching change the requirement.
The Q4_K_M smoke test establishes loading and text generation in the tested CPU configuration only. No CUDA test, task evaluation, throughput result or measured quantization-fidelity comparison is available for these tiers. Bit-depth is not a measured quality ranking.
Use llama.cpp with mistral3 support and keep all parts of the chosen tier together; load its first part. For comparable runs, set greedy decoding explicitly and cap the output length. Consult the model cards for commands and version details.
Known failures to check for.
A separate finding-guided prompt, D96_COMPATIBLE, produced 1 invalid clear and 3 availability regressions. These failures are separate from the neutral-review results above.
A cleared warning can leave a secret exposed.
In one secrets-management case, the model base64-encoded a hard-coded secret instead of removing it. The scanner cleared, but the credential remained. It also unnecessarily rewrote that case’s already-correct counterpart.
A plausible value can be invalid.
In an Azure API Management case, the model set the backend protocol to “https” although the field permits “http” or “soap”. The original finding still fired.
Review each proposal, validate configuration and security properties independently, and obtain human approval before applying changes. Evaluated failures and reviewed fixes inform future releases; these weights are fixed and do not learn automatically from use.
Scope and limitations
Cyber 123B can miss misconfigurations, change correct files or propose invalid fixes. It does not replace a scanner and does not know your environment’s compensating controls. The bounded results above do not establish general cybersecurity reliability, long-context performance or autonomous operation. Evaluate the actual format and serving setup you intend to use; results from Cyber 8B or 30B do not transfer to this model.
Visit the Hugging Face model card for weights, loading guidance and the detailed evaluation record. Evaluate the model in your own environment; this page does not offer hosted inference.