GitHub radar
Found a vulnerability-hunting AI model? Here's what to do
This is a Hugging Face model card for a fine-tuned version of Qwen built to find code vulnerabilities and score them with CVSS. Read it to see what the training changed — there's nothing to install.
It's a Hugging Face page describing a retrained version of the Qwen AI model, tuned to find vulnerabilities in code and write a severity-scored (CVSS) report.
When it helps
Useful if you want to see how reinforcement learning reshapes a narrow specialist model. Skip it if you need a trustworthy vulnerability score — the risk of a wrong score is too high.
Pros
- Finishes a full CVSS report 70% of the time, up from 39% before tuning
- Structured vulnerability-report output got noticeably more consistent
- General skills — code, math, language — didn't drop after retraining
- Ships as one complete checkpoint — no separate adapter to load
Cons
- Its final CVSS severity score matches the correct answer only ~4.5% of the time
- Needs a data-center NVIDIA B200 GPU — you can't run it at home
- Unofficial fan-made build, not endorsed by Alibaba or NVIDIA
How to set it up — step by step
- 1Open the model page at the link and read the "Behavior notes and limitations" section first.
- 2Note this is a server-only model tested on one NVIDIA B200 GPU — you can't install or run it yourself.
- 3Open Claude Code or another AI agent in your project folder.
- 4Send the agent the text from the block below — it'll break down the card's claims and risks in plain terms.
- 5Check the result: if you need a real CVSS score, don't trust this model — it only matches the right score about 4.5% of the time.
- 6Treat the card as a case study on fine-tuning, not as a tool to add to your project.
Text for your agent
Copy this and send it to your agent — Claude Code, Codex, any of them:
Read the Hugging Face card for Qwen3.8-Flash-Next-E384-FP4-V2: https://huggingface.co/autotrust/Qwen3.8-Flash-Next-E384-FP4-V2 — explain in plain words what the reinforcement-learning training changed, what task it was tuned for, and why the CVSS scoring is still unreliable; no need to run it.
This is a server-class model — the authors tested it on a single NVIDIA B200, a data-center card. You cannot run this at home; the best you can do here is read the card and understand what changed.
Open on Hugging Face▌ More finds