rappidAI research
All models

Quantum Sentinel 1Alpha · In Development

Quantum Sentinel-Alpha

Specialized AI for secure software.

A specialized AI model being trained to find, understand and fix vulnerabilities in source code.

Explore the research planView roadmap
sentinel · report.jsonJSON / SARIF

// Planned report format

finding {

location
<file>:<line range>
cwe
CWE-<id>// when evidence is sufficient
evidence
data flow · trust boundary
remediation
concrete mitigation
patch
minimal, security-focused// optional
verification
tests · re-analysis

}

Evidence-backed findingRejectedAbstained
Illustration of the planned output structure, derived from the training objectives. Not model output; no Sentinel weights are available yet.
Status
Alpha · In Development
Alpha target
October 2026
Primary foundation candidate
Qwen3.5-9BFinal selection after the internal 4B / 9B security bake-off.
Primary languages
Python · JavaScript / TypeScript · Go
  • Cybersecurity-focused
  • Local-first
  • Open weights planned

Quantum Sentinel 1 / Alpha

Source-code security. With evidence.

Quantum Sentinel-Alpha is the first substantial security fine-tuning milestone of the Quantum Sentinel 1 model line. It is designed as a specialized second security reviewer for developers, open-source maintainers, small engineering teams, security researchers and coding-agent builders.

Status
Alpha · In Development
Alpha target
October 2026
Primary foundation candidate
Qwen3.5-9B

Security training objectives

From a potential risk to a reasoned finding.

Training objectives for Alpha. Performance has not yet been published. When evidence is insufficient, the model should express uncertainty or abstain.

  1. Detection

    Find potential vulnerabilities in source code while distinguishing unsafe patterns from benign lookalikes.

  2. Localization

    Identify affected files and relevant code spans, rather than returning only generic warnings.

  3. CWE Classification

    Map findings to appropriate CWE categories when sufficient evidence exists.

  4. Evidence

    Provide concise technical evidence around data flow, trust boundaries and why a pattern may be unsafe.

  5. Remediation

    Explain concrete ways to remove or mitigate a vulnerability.

  6. Patch Generation

    Propose minimal security-focused patches designed to preserve existing functionality.

  7. False-Positive Rejection

    Recognize similar-looking, safe code as benign. Abstain instead of inventing a vulnerability.

  8. Secure Review

    Review repositories, pull requests and diffs as a specialized second security reviewer.

Planned architecture

A specialized model. A verifiable system.

The model evaluates semantic risks. The Sentinel Engine supplies repository context and deterministic tools, then checks candidate findings. The planned model remains independently downloadable and locally usable.

  1. Repository / Pull Request

    Source code or a proposed change

    Sentinel Engine

  2. Repository Indexer

    Reduce the search space

    Sentinel Engine

  3. Static Signals + Context

    Select relevant code and tool signals

    Sentinel Engine

  4. Quantum Sentinel

    Evaluate semantic security risks

    Quantum Sentinel

  5. Candidate Findings

    Claims awaiting verification

    Quantum Sentinel

  6. Verifier / Tests / Re-analysis

    Check evidence; reject unsupported candidates

    Sentinel Engine

  7. Evidence-backed Finding

    Optional minimal patch, checked for function and security

    Sentinel Engine

  8. JSON / SARIF / Human Report

    Structured output or a readable review

    Sentinel Engine

Standalone model

Quantum Sentinel Model

  • Security analysis
  • Localization
  • CWE classification
  • Evidence
  • Patch proposals
  • Abstention

Context + deterministic tools

Sentinel Engine

  • Repository indexing
  • Context selection
  • Static signals
  • Tool orchestration
  • Verification
  • Tests
  • Re-analysis
  • JSON / SARIF

Deterministic work belongs in tools: indexing narrows the search, static analysis adds signals, verification checks model claims and tests help establish whether a patch still works and is safer. Specialization plus verification matters more than model size alone.

Foundation

A candidate, before a freeze.

Quantum Sentinel-Alpha is currently being developed with Qwen3.5-9B as the primary foundation candidate. Final foundation selection follows an internal security bake-off between Qwen3.5-9B and Qwen3.5-4B. The foundation is not frozen.

First-generation language focus: Python, JavaScript / TypeScript and Go. Other languages may follow through additional data and evaluation.

Training approach

Security post-training, focused on evidence.

The plan builds on an existing open-weight foundation rather than pretraining from scratch. QLoRA / LoRA supervised fine-tuning is the core, using curated vulnerability examples, fixed/vulnerable code pairs, hard negatives, patch tasks, localization, CWE classification, evidence and false-positive rejection. Preference training or domain adaptation will be added only if evaluations show measurable value.

Local-first / Planned release

Your code. Local analysis.

Local-first inference is planned so code can be reviewed without requiring upload to an external cloud service. An open-weight release on Hugging Face and quantized local variants are planned; no Sentinel weights are available yet.

  • Merged model weightsPlanned
  • Model CardPlanned
  • Evaluation CardPlanned
  • Optional 8-bit / 4-bit variantsPlanned
  • Possible GGUF variantsPlanned
  • Sentinel Scanner / CLIPlanned

The primary candidate is in the approximately 9B class. Quantization is intended to make consumer-hardware inference possible. RAM and VRAM requirements will be published after measurement of the final variants.

Development plan

Alpha first. A stable release later.

Alpha is the first real security-SFT milestone, before Beta, Release Candidate and the later stable Quantum Sentinel 1.0. The early Lean plan aims for an initial Alpha fine-tune; the sequence below is a development plan, not a record of completed phases.

Alpha target

October 2026

An Alpha development target, not a guaranteed release date. Quantum Sentinel 1.0 follows later.

  1. Foundation

    Planned

  2. Baseline

    Planned

  3. Dataset / Garden

    Planned

  4. Calibration

    Planned

  5. SFT Alpha

    Current focus

  6. Data Iteration + Beta

    Planned

  7. Optional Hardening

    Planned

  8. Release Candidate

    Planned

  9. Quantum Sentinel 1.0

    Planned

Research status

In development. Open questions remain.

Alpha is in development. Capabilities, architecture and release artifacts described here are planned and may change with evaluation. No benchmark results or validated hardware requirements are announced.

Defensive source-code security, not a general chatbot, autonomous penetration-testing agent or internet-scanning system. Malware building, credential theft and ransomware assistance are outside the scope. Sentinel complements human security review, SAST and dependency scanning; it does not replace them.

All models