NEOS is a language model fine-tuned for offensive security. It generates exploits, tests them against a live target, and retries — without a human in the loop.
Built on Qwen2.5-32B (Apache 2.0). Trained on 20,000+ real cybersecurity examples. Stack overflows, ROP chains, format strings, binary reversing.
Not a chatbot. A pipeline.
NEOS started as a question: can a model trained cheaply on real exploit data close the gap with human CTF players? The answer, so far, is yes.
The autonomous loop works like this — given a binary or challenge, NEOS generates candidate exploit code, runs it against the target inside a sandbox, reads the crash output, and refines. It does this up to four times before giving up. On stack overflow targets it currently wins more than half the time.
v7 introduces 21,000 examples covering wider vulnerability classes. Early evals suggest a jump to 75–85% success rate on the same benchmark set. All training runs under $40.