Hayula World Model — Persistent Memory Agent

Hayula World Model — Autonomous Security Research Agent with Persistent Memory

The Problem

Every security researcher knows the pain: you probe a target, find something interesting, but six months later you can't remember exactly what technique worked or which endpoint was vulnerable. You start over from zero.

We built Hayula World Model to solve this: an AI agent with true persistent memory that treats every probe, every experiment, every finding as a permanent asset. The more it works, the smarter it gets.

What Inspired Us

We're bug bounty researchers. Between us, we've spent thousands of hours huntering across Meta, Apple, Shopify, DoorDash, GitLab, and Adobe. We noticed a pattern: 80% of the value comes from cross-target insights — a technique that works on one CDN probably works on another.

The Qwen Cloud MemoryAgent track was a perfect fit. We already had fine-tuned Qwen2.5-7B models (Averroes-Q-Instruct for Arabic/English security analysis, SAIF-v2-Pro with 10 specialists). What we needed was the memory layer to tie everything together.

How We Built It

Models:

• Averroes-Q-Instruct — Qwen2.5-7B fine-tuned on bilingual Arabic/English security analysis data using MLX on Apple Silicon. 1,130+ downloads on HuggingFace.
• SAIF-v2-Pro — 10-specialist ensemble (SSRF expert, CORS expert, XSS expert, WAF expert, etc.) routing through a unified gateway.

Memory Layer:

• SQLite with FTS5 full-text search for fast retrieval
• Every experiment auto-saved with: type, title, content, tags, target, outcome, timestamp
• Auto-pattern analyzer running as a cron job every 6 hours
• Cross-target deduplication to prevent spam

Pipeline:

1. Hunter probes a target → records experiment to World Model
2. Auto-analyzer groups experiments by technique
3. If same technique works on 2+ targets → LAW recorded automatically
4. Scheduler queries coverage → prioritizes unprobed targets

Infrastructure:

• All inference on Mac Studio M2 Ultra (192GB) and M3 Ultra (512GB) via MLX
• FastAPI gateway with auth + Cloudflare Tunnel for HTTPS
• CI/CD via self-hosted Gitea + PM2

Challenges We Faced

1. Balancing memory vs. speed — SQLite FTS5 gave us fast retrieval without the complexity of a vector database. Good enough for thousands of artifacts.

2. Pattern extraction noise — Early versions produced false positives (tagging "bypass" as "auth"). Fixed with priority-based keyword matching.

3. Duplicate prevention — Without dedup, the same pattern gets re-inferred every 6 hours. Added title + content hash comparison.

4. Disk space — Hit 99% mid-hunt. Cleaned 22GB of cache, moved model files to secondary storage.

Accomplishments

• 8 auto-inferred security patterns from just 22 experiments
• Real finding: GitLab GraphQL introspection open — discovered by the system
• Live API at saif.hayula.xyz serving real security research
• 5 open-source models on HuggingFace with 2,000+ total downloads
• Self-improving pipeline — more experiments = better laws = smarter hunts

What's Next

• Integrate with Qwen Cloud API for cloud-scale inference
• Multi-agent collaboration (specialist agents sharing one world model)
• Interactive knowledge graph of technique × target relationships
• Release anonymized experiment corpus for the security community

Built With

Qwen2.5/QwenCloud • Python • FastAPI • SQLite • MLX (Apple) • HuggingFace • Git

Built With

• agent
• api
• apple-silicon
• artificial-intelligence
• autonomous-agent
• bug-bounty
• fastapi
• fine-tuning
• git
• hugging-face
• mac-studio
• machine-learning
• memory-agent
• mlx
• open
• python
• qwen-cloud
• qwen2.5
• security
• sqlite