Inspiration
We thought Fable had good cyber capabilities, but with fine tuning open source models such as Kimi K3 could reach the same level. We use Qwen 3.5 9B, a significantly less capable model, to show how fine tuning with SFT and GRPO can increase performance on a set of held-out browser exploit tasks.
What it does
Heewon AI is a fine-tuned Qwen3.5-9B (LoRA) that reads a patched V8 (Chrome's JavaScript engine) bug, writes a JS/WASM proof-of-concept, runs it against the real vulnerable build, reads the crash output, and iterates. Crucially, it's trained against the same execution-graded reward the benchmark uses — so it hill-climbs the real objective ("did this actually crash the engine?"), not a proxy. Everything is on N-day bugs that are already fixed upstream; the goal is measuring exploit-writing capability, not finding anything new.
Challenges we ran into
OOM and context window problems, as well as a lack of training data.
Accomplishments that we're proud of
We increased performance of the Qwen 9B Parameter model on browser exploits by 2.3x
Built With
- fastapi
- freesolo-flash
- huggingface
- javascript
- modal
- python
- pytorch
- qwen
- v8
- vllm
- webassembly
Log in or sign up for Devpost to join the conversation.