Sentinel-R2.1

Proprietary & Confidential. Sentinel-R2.1 is the exclusive property of Glyph Software LLP. It is not open source and is distributed under a proprietary, all-rights-reserved license. See the License section and the bundled LICENSE file.

Sentinel-R2.1 is an offensive-security agent for authorized penetration testing. Given a target scope and a shell-execute tool, it enumerates the target, works out a foothold, escalates privileges as far as it can, and writes up the full attack path — the root cause of each weakness it exploits and how to fix it. It is a reasoning + tool-use model: it plans, issues tool calls, reasons over the results, and iterates toward its objective.

This repository contains the full merged model weights — the Sentinel-R2.1 LoRA adapter fused into its base model. Unlike the adapter repository, it loads directly with transformers and requires no separate base download or PEFT step.

MTP head included. These weights bundle the base's multi-token-prediction head (mtp.* tensors, mtp_num_hidden_layers: 1) for speculative decoding. transformers ignores these tensors on load (no behavior change), but runtimes that implement the Qwen3.5 MTP head — e.g. vLLM (Qwen3_5ForConditionalGeneration

speculative_config method: "mtp") — can use them as a self-speculative draft. For a ready-to-serve GGUF with the same head wired in, see glyphsoftware/sentinel-r2.1-gguf (llama-server --spec-type draft-mtp).

Model Details

Model Description

Developed & curated by: Glyph Software LLP
Model persona / identity: Sentinel-R2.1
Model type: Merged full-weight causal decoder-only transformer; instruction-, reasoning-, and tool-use-tuned
Architecture: Qwen3_5ForConditionalGeneration (hybrid linear/full-attention, 32 layers, hidden size 4096)
Base model: empero-ai/Qwythos-9B-v2
Precision: bfloat16 (16-bit merged weights)
Context length: up to 1,048,576 tokens (native)
Task type: CAUSAL_LM
Languages: English (with embedded shell commands and source code across many languages)
Finetuning method: Supervised fine-tuning (SFT, LoRA) on curated authorized-pentest agent trajectories, then merged to 16-bit
License: Proprietary — Glyph Proprietary License v1.0 (all rights reserved)

Model Sources

Repository: glyphsoftware/sentinel-r2.1 (gated)
Base model: empero-ai/Qwythos-9B-v2

Intended Use

Primary intended uses

Authorized penetration testing: Autonomous or human-in-the-loop enumeration, foothold discovery, and privilege escalation against systems the operator is explicitly permitted to test.
Attack-path reporting: Producing clear write-ups of each exploited weakness, its root cause, and concrete remediation guidance.
Red-team tooling and security research: Driving agentic workflows that use a shell/execute tool in isolated lab or authorized engagement environments.

Out-of-scope and prohibited uses

Any use against systems you are not explicitly authorized to test.
Unauthorized access, disruption, data theft, or any use violating applicable law or the proprietary license.
Any use outside Glyph Software LLP or its authorized licensees.
Fully unattended operation without appropriate scoping, guardrails, and human oversight.

Benchmarks

Re-evaluated on this build (base empero-ai/Qwythos-9B-v2, 3 epochs, merged bf16 weights). Prior published figures were measured on an earlier Sentinel-R2.1 build with a different base and are not carried over.

Task	Metric	Sentinel-R2.1 (this model)
gsm8k (5-shot)	exact_match (strict)	0.850
gsm8k (5-shot)	exact_match (flexible)	0.848
mmlu (0-shot)	acc	0.775
arc_challenge (0-shot)	acc	0.568
arc_challenge (0-shot)	acc_norm	0.587
gpqa_diamond (CoT, 0-shot)	exact_match (flexible)	0.545

Measured with EleutherAI lm-evaluation-harness v0.4.12 (transformers backend, single GB10, dtype=bfloat16): gsm8k in the default 5-shot config; mmlu and arc_challenge 0-shot (loglikelihood); gpqa_diamond_cot_zeroshot 0-shot with the chat template applied and a 4,096-token generation cap. For gpqa the flexible-extract filter is reported (the metric conventionally used for this CoT task); strict-match is ~0.04 because the model does not emit the verbatim answer template — a formatting artifact, not a capability signal.

Training Data

Sentinel-R2.1 was fine-tuned on a curated set of authorized penetration-test agent trajectories. Each example is a multi-turn conversation in which the assistant is given an isolated-lab target and a shell execute tool, and works through enumeration → foothold → privilege escalation → remediation write-up, interleaving reasoning, tool calls, and tool results.

Property	Value
Training examples	142
Format	Multi-turn `messages` (system / user / assistant / tool) with tool calls
Tooling	Single `execute` shell tool
Framing	Authorized engagements in isolated lab networks

All scenarios are explicitly scoped as authorized testing against lab targets.

Prompt Format

Sentinel-R2.1 uses a chat template with system, user, assistant, and tool roles, and supports tool calling. The system message establishes the pentester persona and the engagement rules; the model responds with reasoning and execute tool calls, consumes the tool results, and continues until it reaches its objective and produces a write-up.

Recommended system prompt

You are an expert penetration tester carrying out an authorized engagement in
an isolated lab. You have an execute tool to run shell commands from your
attacking host. Enumerate the target thoroughly, work out a foothold, escalate
your privileges as far as you can (root or Administrator/SYSTEM), and then write
up the full attack path — the root cause of each weakness you exploit and how to
fix it.

How to Use

Access to these weights requires an authorized Hugging Face token for the gated/private repository. These are full merged weights — no adapter or base download is required.

import torch
from transformers import AutoModelForCausalLM, AutoTokenizer

model_id = "glyphsoftware/sentinel-r2.1"

tokenizer = AutoTokenizer.from_pretrained(model_id)
model = AutoModelForCausalLM.from_pretrained(
    model_id, device_map="auto", torch_dtype="auto"
)

system = (
    "You are an expert penetration tester carrying out an authorized engagement "
    "in an isolated lab. You have an execute tool to run shell commands from your "
    "attacking host. Enumerate the target thoroughly, work out a foothold, escalate "
    "your privileges as far as you can, and then write up the full attack path — "
    "the root cause of each weakness you exploit and how to fix it."
)

messages = [
    {"role": "system", "content": system},
    {"role": "user", "content": "Assess the authorized lab host at 10.129.0.10."},
]

inputs = tokenizer.apply_chat_template(
    messages, add_generation_prompt=True, return_tensors="pt"
).to(model.device)

out = model.generate(inputs, max_new_tokens=1024, temperature=0.3, top_p=0.9)
print(tokenizer.decode(out[0][inputs.shape[-1]:], skip_special_tokens=True))

The model emits execute tool calls; your harness is responsible for running those commands only within an authorized, isolated environment and feeding the results back as tool messages.

Recommended generation settings

Parameter	Value
`temperature`	0.2 – 0.4
`top_p`	0.9
`max_new_tokens`	1024+ (reasoning and tool calls consume tokens)

Training Procedure

Hyperparameter	Value
Method	Supervised fine-tuning (LoRA), merged to 16-bit
Base model	`empero-ai/Qwythos-9B-v2`
LoRA rank / alpha	16 / 16
LoRA dropout	0.0
Target modules	attention + MLP projections (`q,k,v,o,gate,up,down`)
Max sequence length	16,384
Epochs	3
Batch size × grad accum	2 × 4 (effective 8)
Training steps	54
Learning rate	2e-4
Optimizer	`adamw_torch_fused`
Precision	bf16 (non-4bit)
Final training loss	~0.595

Trained with Unsloth, TRL, and PEFT, then the adapter was merged into the base weights and exported in bf16.

Limitations and Risks

Not a substitute for a skilled operator. Outputs may be incorrect, incomplete, or unsafe to run. Every command must be reviewed before execution.
Powerful dual-use capability. This model is designed to compromise systems. It must only ever be pointed at targets you are explicitly authorized to test, in isolated environments, with human oversight.
Small training set. The model was trained on a modest number of trajectories; coverage of tools, platforms, and techniques is limited and biased toward the scenarios in the training data.
Reasoning is not ground truth. The model's plans and explanations are aids, not verified proofs; validate all findings independently.
Harness responsibility. Command execution, scoping, network isolation, and guardrails are the responsibility of the operator and the surrounding harness, not the model.

License

Sentinel-R2.1, including these merged weights, its configuration, tokenizer, and all associated artifacts, is the confidential and proprietary property of Glyph Software LLP. It is not released under any open-source license and is governed by the Glyph Proprietary License v1.0 in the bundled LICENSE file.

No part of this model may be copied, distributed, published, sublicensed, merged into another model, distilled, or used to train or evaluate any other model, except by Glyph Software LLP or parties holding explicit prior written permission. Access does not grant any ownership or license rights beyond those expressly granted in writing.

Citation

@misc{glyphsoftware_sentinel_r2.1,
  title  = {Sentinel-R2.1: An Authorized Penetration-Testing Agent},
  author = {Glyph Software LLP},
  year   = {2026},
  note   = {Proprietary model. All rights reserved.}
}

Contact

For licensing, access requests, or security inquiries, contact Glyph Software LLP.