Sentinel R2.2
Collection
Sentinel-R2.2 is an offensive-security agent for authorized penetration testing.
• 2 items • Updated
You need to agree to share your contact information to access this model
This repository is publicly accessible, but you have to accept the conditions to access its files and content.
This model is the proprietary property of Glyph Software LLP. Access is granted only to authorized licensees under a signed agreement. This is an offensive-security agent intended solely for authorized penetration testing and security research. By requesting access you confirm you are an authorized user, that you will only use it against systems you are explicitly permitted to test, and that you agree to the terms in the LICENSE file.
Log in or Sign Up to review the conditions and access this model content.
Sentinel-R2.2-Max
Proprietary & Confidential. Sentinel-R2.2-Max is the exclusive property of Glyph Software LLP. It is not open source and is distributed under a proprietary, all-rights-reserved license. See the License section and the bundled
LICENSEfile.
Sentinel-R2.2-Max is an offensive-security agent for authorized penetration
testing. Given a target scope and an agent toolkit (Bash, Write, Read and
others — see Training Data),
it enumerates the
target, works out a foothold, escalates privileges as far as it can, and writes
up the full attack path — the root cause of each weakness it exploits and how to
fix it. It is a reasoning + tool-use model: it plans, issues tool calls, reasons
over the results, and iterates toward its objective.
This repository contains the full merged model weights — the LoRA adapter fused
into its base model. It loads directly with transformers and requires no separate
base download or PEFT step.
⚠️ These weights were replaced on 2026-08-09. This repository previously held a different build: 3 epochs over the 1,180-conversation
sentinel-exploit-db. It has been rewritten with the model documented below — 2 epochs over the 1,230-conversation tooled dataset with structuredtool_calls. If you pulled this repo before 2026-08-09 you have materially different weights. The prior build's benchmark results remain in this repository's commit history.
⚠️ This build has not been evaluated. No benchmark suite has been run against these weights — see Evaluation. The only quantitative signal is held-out loss on the training distribution. Treat it as unvalidated, and note that the build it replaced was benchmarked and showed a measured regression against Sentinel-R2.2 on GSM8K.
Model Details
Model Description
- Developed & curated by: Glyph Software LLP
- Model persona / identity:
Sentinel - Model type: Merged full-weight sparse-MoE causal decoder; instruction-, reasoning-, and tool-use-tuned
- Architecture:
Gemma4ForConditionalGeneration(30 layers, hidden size 2816, 128 experts, top-8 routing, sliding + full attention interleaved) - Parameters: ~25.8B total / ~4B active per token
- Base model:
unsloth/gemma-4-26B-A4B-it - Precision: bfloat16 (16-bit merged weights)
- Context length: up to 262,144 tokens (native)
- Task type:
CAUSAL_LM - Languages: English (with embedded shell commands and source code across many languages)
- Finetuning method: Supervised fine-tuning (SFT, LoRA) on curated authorized-pentest agent trajectories, then merged to 16-bit
- License: Proprietary — Glyph Proprietary License v1.0 (all rights reserved)
Multimodal towers preserved. The base is a vision + audio model. Fine-tuning targeted the language model only, and the vision/audio towers are passed through unmodified, so image and audio inputs still work exactly as in the base model. The training data is text-only, so the security behavior is not conditioned on visual input.
Model Sources
- Repository:
glyphsoftware/sentinel-r2.2-max - Previous release:
glyphsoftware/sentinel-r2.2 - Base model:
unsloth/gemma-4-26B-A4B-it
Intended Use
Primary intended uses
- Authorized penetration testing: Autonomous or human-in-the-loop enumeration, foothold discovery, and privilege escalation against systems the operator is explicitly permitted to test.
- Attack-path reporting: Producing clear write-ups of each exploited weakness, its root cause, and concrete remediation guidance.
- Red-team tooling and security research: Driving agentic workflows that use the agent toolkit in isolated lab or authorized engagement environments.
Out-of-scope and prohibited uses
- Any use against systems you are not explicitly authorized to test.
- Unauthorized access, disruption, data theft, or any use violating applicable law or the proprietary license.
- Any use outside Glyph Software LLP or its authorized licensees.
- Fully unattended operation without appropriate scoping, guardrails, and human oversight.
Evaluation
No benchmark suite has been run against this build.
The figures published for Sentinel-R2.2, and those in this repository's earlier commits, were measured on different weights trained on a different dataset. They do not describe these weights and should not be quoted for them.
The only quantitative signal available is held-out loss, reported under Training Procedure. Held-out loss measures next-token agreement with the training distribution; it is not a capability measurement and says nothing about security-agent ability.
A good loss curve is not evidence of a good model here. The build this repository previously held also had a clean, monotonically falling held-out curve — and benchmarking then found a 0.78 → 0.61 GSM8K regression driven by a repetition-loop failure affecting ~20% of generations, which the loss curve gave no hint of. That failure mode was diagnosed only by inspecting generations. Until this build is benchmarked, the same class of problem cannot be ruled out.
To evaluate, run the suite below. add_bos_token=True is required — Gemma depends
on a leading <bos>, which lm-eval's HF backend does not add by default for
loglikelihood scoring, and without it this architecture scores at floor on
arc_challenge:
lm_eval --model hf \
--model_args pretrained=glyphsoftware/sentinel-r2.2-max,dtype=bfloat16,add_bos_token=True \
--tasks arc_challenge,mmlu,wmdp_cyber --num_fewshot 0 --batch_size 4 --seed 1234
Use batch 4 for loglikelihood tasks and 16 for generative ones
(gpqa_diamond_cot_zeroshot, gsm8k). --num_fewshot is global, so 5-shot GSM8K
needs its own invocation. Prompt format is task-type dependent: --apply_chat_template
helps generative tasks and measurably hurts loglikelihood MCQ on this architecture.
Record the configuration out of band — lm-eval's results_*.json writes
apply_chat_template: None even when the flag was passed.
Training Data
Fine-tuned on glyphsoftware/sentinel-exploit-tooled
("Sentinel Exploit DB (Tooled)"), revision 5b11e692. Each example is a complete
multi-turn engagement — enumeration → foothold → privilege escalation → remediation
write-up — in OpenAI chat format with structured tool_calls and tool responses.
| Property | Value |
|---|---|
| Conversations | 1,230 (1,168 train / 61 held-out after tokenization; 1 dropped) |
| Total messages | 31,961 |
| Assistant turns | 15,289, carrying 14,212 tool calls |
Turns with reasoning_content |
389 |
| Distinct tools | 19 |
| Tokens (this run) | 4,076,783 (~52.5% supervised) |
| Sequence length | max 13,209 tokens |
| Framing | Authorized engagements in isolated lab networks |
| Source | Conversations | What it is |
|---|---|---|
redteam |
350 | Full-lifecycle red-team engagements, each ATT&CK-mapped with detections and remediation |
ctf |
300 | HTB-style machine pentests, full kill chain, with authored failure→recovery episodes |
v8 |
300 | Chromium / V8 JavaScript-engine exploitation, bug primitive → code execution |
ctf-apocalypse |
100 | HackTheBox Cyber Apocalypse 2023–2025 jeopardy CTFs across all categories |
offsec |
100 | Active Directory chains, cloud (AWS/Azure/GCP/K8s), database, web, binary pwn |
ctf-synthetic |
41 | Grounded synthetic pentests built around real CVE chains |
cve |
39 | Single-CVE source review and exploit development |
This model expects an agent toolkit, not a shell
This is the most important behavioral difference from
Sentinel-R2.2 and from the build
that previously occupied this repository. Those were trained where every action went
through one execute(command) tool. This build was trained on a decomposed tool
surface and calls tools by name:
| Tool | Calls | Used for |
|---|---|---|
Bash |
11,087 | shell commands, pipelines, chains; background jobs |
Write |
1,714 | authoring PoC scripts, payloads, wordlists |
Read |
384 | reading a file |
TaskCreate / TaskUpdate |
266 / 266 | opening and closing engagement objectives |
TaskGet / TaskList |
162 / 46 | checking objective status mid-engagement |
Agent |
72 | delegating a bounded sweep or code review |
ListAgents |
63 | discovering delegates before a fan-out |
Grep |
62 | searching file contents |
Monitor |
27 | waiting on a condition |
CronCreate / CronList / CronDelete |
15 / 12 / 12 | recurring checks |
SendMessage |
9 | following up with a running agent |
Edit |
7 | single literal substitution |
Glob |
5 | finding files by name |
TaskOutput / TaskStop |
2 / 1 | reading and stopping background jobs |
Bash is the majority tool by design — roughly a fifth of source commands are genuine
pipelines for which a shell call is the faithful representation.
Give it the tools it was trained on. Handing this model a single
executetool reintroduces exactly the mismatch the dataset was built to remove, and teaches it to cram every action into a shell string. DeclareBash,Write, andReadat minimum; declare the orchestration tools only if your harness genuinely implements them.
Tool-call arguments are JSON objects, not strings. tool_call.function.arguments
is always a mapping, e.g. {"command": "nmap -sV 10.10.10.10"}.
Known properties of this training data
Inherited from the dataset and relevant to anyone interpreting this model's behavior:
- ~8.9% of tool calls are synthesized.
TaskCreate/TaskUpdate/TaskGet/TaskList,Cron*,SendMessageandListAgentshave no precedent in the source corpus — they were added so every tool the agent holds at inference appears in training. They teach tool syntax and plausible placement, not verified strategy. - ~10.3% of calls have heuristically divided outputs. Where one source
executecall decomposed into several tool calls, its single stdout blob was split between them; a minority are attributed to the wrong command. - 65.3% of calls are exact, 15.6% emitted unchanged as a single byte-identical
Bash. - Tail tools are sparse.
Glob(5),TaskOutput(2),TaskStop(1) andEdit(7) have too few examples to teach reliable usage.
All scenarios are explicitly scoped as authorized testing against already-public CTF machines and disclosed CVEs. Flags, credentials, hostnames, and IP addresses are synthetic lab values or RFC-reserved / public CTF ranges.
Prompt Format
Uses the Gemma 4 chat template with system, user, assistant, and tool roles,
and supports tool calling. The bundled chat_template.jinja injects a default
Sentinel system prompt ahead of any caller-supplied system message, establishing the
model identity and the authorized-scope constraint even when the caller supplies none.
Tool calls are emitted in the Gemma DSL, naming the specific tool:
<|tool_call>call:Bash{command:<|"|>nmap -sC -sV -p- --min-rate 2000 10.129.106.234<|"|>}<tool_call|>
<|tool_call>call:Write{file_path:<|"|>exploit.py<|"|>,content:<|"|>import requests...<|"|>}<tool_call|>
<|tool_response> (token 50) is a declared EOS token, alongside <eos> (1)
and <turn|> (106). Generation halts at the handoff point: your harness appends the
<|tool_response>...<tool_response|> block containing real output and resumes
generation from there.
Use
enable_thinking=True. With itFalse, the chat template appends an empty<|channel>thought\n<channel|>block to the generation prompt — a pattern that never occurs in the training render. With itTruethe prompt ends at<|turn>model\n, exactly where the supervised region begins during training.
Recommended system prompt
Training system messages enumerate the agent's tool surface, so yours should too:
You are an expert penetration tester carrying out an authorized engagement in an
isolated lab, working from your attacking host. You have these tools: `Bash` to run
shell commands, `Write` to author files, `Read` to read them, `Grep` to search file
contents, and `Glob` to find files by name. Enumerate the target thoroughly, work out
a foothold, escalate your privileges as far as you can (root or Administrator/SYSTEM),
and then write up the full attack path — the root cause of each weakness you exploit
and how to fix it.
Note on the bundled template. The default system prompt injected by
chat_template.jinjais inherited from the Sentinel-R2.2 line and describes "operating an interactive shell through tool calls" — phrasing that predates this build's multi-tool surface. It still establishes identity and authorized-scope framing correctly, and your own system message is appended after it, but enumerate the real tool surface there rather than relying on the default.
How to Use
Access to these weights requires an authorized Hugging Face token for the gated/private repository. These are full merged weights — no adapter or base download is required.
import torch
from transformers import AutoModelForCausalLM, AutoTokenizer
model_id = "glyphsoftware/sentinel-r2.2-max"
tokenizer = AutoTokenizer.from_pretrained(model_id)
model = AutoModelForCausalLM.from_pretrained(
model_id, device_map="auto", dtype=torch.bfloat16
)
# Declare the tools this model was trained on. Bash / Write / Read are the
# high-frequency three; add Grep, Glob, Edit if your harness implements them.
def fn(name, desc, props, required):
return {"type": "function", "function": {
"name": name, "description": desc,
"parameters": {"type": "object", "properties": props, "required": required}}}
TOOLS = [
fn("Bash", "Run a shell command on the attacking host.",
{"command": {"type": "string", "description": "Shell command to run."},
"run_in_background": {"type": "boolean", "description": "Run detached."}},
["command"]),
fn("Write", "Write a file (PoC script, payload, wordlist).",
{"file_path": {"type": "string"}, "content": {"type": "string"}},
["file_path", "content"]),
fn("Read", "Read a file from disk.",
{"file_path": {"type": "string"}, "offset": {"type": "integer"},
"limit": {"type": "integer"}},
["file_path"]),
]
messages = [
{"role": "user", "content": "Assess the authorized lab host at 10.129.0.10."},
]
text = tokenizer.apply_chat_template(
messages, tools=TOOLS, tokenize=False,
add_generation_prompt=True, enable_thinking=True,
)
inputs = tokenizer(text, add_special_tokens=False, return_tensors="pt").to(model.device)
out = model.generate(**inputs, max_new_tokens=1024, temperature=0.3, top_p=0.9)
print(tokenizer.decode(out[0][inputs["input_ids"].shape[-1]:], skip_special_tokens=False))
The model emits named tool calls (Bash, Write, Read, …); your harness is
responsible for executing them only within an authorized, isolated environment
and feeding results back as tool messages with the matching tool_call_id.
Recommended generation settings
| Parameter | Value |
|---|---|
temperature |
0.2 – 0.4 |
top_p |
0.9 |
max_new_tokens |
1024+ (reasoning and tool calls consume tokens) |
enable_thinking |
True (see Prompt Format) |
repetition_penalty |
consider ~1.05–1.1 — see Limitations |
Training Procedure
| Hyperparameter | Value |
|---|---|
| Method | Supervised fine-tuning (LoRA), merged to 16-bit |
| Base model | unsloth/gemma-4-26B-A4B-it |
| LoRA rank / alpha | 32 / 64 |
| LoRA dropout | 0.05 |
| Target modules | attention q,k,v,o + dense MLP gate,up,down on the language model — 205 modules, 37,171,200 trainable params (0.14%) |
| MoE experts | frozen (see note below) |
| Epochs | 2 |
| Batch size × grad accum | 1 × 8 (effective 8) |
| Training steps | 292 (9 warmup) |
| Learning rate | 1e-4, cosine decay |
| Optimizer | adamw_torch |
| Precision | bf16 (non-4bit) |
| Loss masking | assistant tokens only (~52.5% of tokens supervised) |
| Final training loss | 0.9725 |
| Held-out eval loss | 0.8870 |
| Hardware | 1× NVIDIA DGX Spark (GB10, 128 GB unified, aarch64) |
| Wall-clock | 5h44m, 82.3 GiB peak memory |
Held-out loss over training: 0.9939 → 0.9153 → 0.8917 → 0.8870 at epochs 0.5 / 1.0 / 1.5 / 2.0. Monotonic throughout, and still improving at the end — the final interval gained 0.0047 after 0.0236 before it. The 3-epoch build this replaced had essentially flattened by its final epoch (0.0043), which is part of why this run stopped at 2.
Not comparable to other Sentinel builds. Sentinel-R2.2 reports 0.927 and the previous 3-epoch build reported 0.8506, but all three use different held-out sets (29 / 59 / 61 conversations) drawn from different datasets. A lower number here does not mean a better model.
Trained with TRL and PEFT on transformers, then the adapter was merged into the
base weights and exported in bf16.
Notes for anyone re-adapting this model
Two structural properties of the Gemma 4 MoE base constrain where LoRA can attach:
- The expert weights are stored as fused 3D tensors
(
layers.N.experts.gate_up_proj,layers.N.experts.down_proj, with no.weightsuffix). They are notnn.Linear, so PEFT cannot attach adapters to them. The experts are frozen; adaptation is on attention plus the per-layer dense MLP. attention_k_eq_v: truemeans 5 of the 30 layers share K and V, sov_projexists in only 25 layers. Target modules must be matched against the real module graph rather than an assumed uniform name list.
Loss was computed on assistant-generated tokens only — model reasoning,
<|tool_call> blocks, and turn terminators — with the system prompt, the user's
engagement request, and every <|tool_response> block masked out.
Limitations and Risks
- Unevaluated. No benchmark has been run against these weights. Nothing establishes that this build is better than, or as good as, Sentinel-R2.2 or the build it replaced. See Evaluation.
- Repetition-loop risk is unmeasured but plausible. The 3-epoch build this replaced degenerated into repeated clauses on ~20% of GSM8K generations. Two epochs and a still-improving loss curve make over-fitting less likely here, but this has not been tested. Use a repetition penalty and explicit stop conditions in your harness until it has been.
- Not a substitute for a skilled operator. Outputs may be incorrect, incomplete, or unsafe to run. Every command must be reviewed before execution.
- Powerful dual-use capability. This model is designed to compromise systems. It must only ever be pointed at targets you are explicitly authorized to test, in isolated environments, with human oversight.
- Specialized training set. 1,168 training conversations is a specialized behavioral slice, not a broad capability upgrade; coverage of tools, platforms, and techniques is limited and biased toward the scenarios in the training data.
- Distribution skew. Weighted toward
redteam(350),v8(300) andctf(300) of 1,230, so ATT&CK-mapped red-team engagements, V8 exploitation, and CTF-style machines are over-represented relative tocve(39) andctf-synthetic(41). - Orchestration-tool behavior is invented, not observed. The task-list, cron and multi-agent tools were synthesized into the training data with no precedent in the source corpus (~8.9% of all calls). Do not treat this model's use of them as evidence-based strategy; it learned their syntax and plausible placement only.
- Tool-surface mismatch is a real failure mode. Supplying a single
executetool instead of the named toolkit puts the model off-distribution. See Training Data. - Not evaluated on live task success. No measurement of end-to-end engagement success against real targets has been performed.
- Reasoning is not ground truth. The model's plans and explanations are aids, not verified proofs; validate all findings independently.
- Harness responsibility. Command execution, scoping, network isolation, and guardrails are the responsibility of the operator and the surrounding harness, not the model.
License
Proprietary — All Rights Reserved.
Sentinel-R2.2-Max, including these merged weights, its configuration, tokenizer, and
all associated artifacts, is the confidential and proprietary property of
Glyph Software LLP. It is not released under any open-source license and
is governed by the Glyph Proprietary License v1.0 in the bundled
LICENSE file.
No part of this model may be copied, distributed, published, sublicensed, merged into another model, distilled, or used to train or evaluate any other model, except by Glyph Software LLP or parties holding explicit prior written permission. Access does not grant any ownership or license rights beyond those expressly granted in writing.
© 2026 Glyph Software LLP. All rights reserved.
Citation
@misc{glyphsoftware_sentinel_r2.2_max,
title = {Sentinel-R2.2-Max: An Authorized Penetration-Testing Agent},
author = {Glyph Software LLP},
year = {2026},
note = {Proprietary model. All rights reserved.}
}
Contact
For licensing, access requests, or security inquiries, contact Glyph Software LLP.
- Downloads last month
- -
Model tree for glyphsoftware/sentinel-r2.2-max
Base model
google/gemma-4-26B-A4B Finetuned
google/gemma-4-26B-A4B-it Finetuned
unsloth/gemma-4-26B-A4B-it