The instinct when building a cyber copilot is to reach for the biggest model available. The 2026 data says otherwise, and the cleanest numbers come from our closest rival. Novee's "Small Language Models for Offensive Security" (Jul 31, 2026) SFT→RLVR-tuned open models on real web apps and measured exploit rates with re-execution grading:
| Base | XSS pass@3, before | after | multiple |
|---|---|---|---|
| Qwen-3.5 27B | 55% | 82% | 1.5x |
| Qwen-3.5 9B | 10% | 56% | 5.6x |
| Qwen-3.5 4B | 2% | 51% | 25x |
Their tuned 27B delivers ~80% of the frontier model's exploit rate for ~15% of the cost (about $16 vs ~$105 per 100-target run), and their fine-tunes went on to close four genuine zero-days. A 4B model that goes from nearly useless to half-solved in one training loop is the whole argument in one row.
Look at the marginal return per RL dollar implied by that table. The weaker the base, the more a verified-reward environment gives back: 25x for the 4B, 5.6x for the 9B, 1.5x for the 27B. Frontier models sit at the far end of that curve — they're already benchmark-maxed, so additional training buys single-digit points while the model itself costs $105 per 100 targets to run. RLVR doesn't make small models close to specialists; it makes them specialists in a way raw scale can't buy cheaply.
Meanwhile the cost side is worse for giants than it looks. Simbian's Cyber Defense Benchmark (arXiv 2604.19533; 32 models, 1,418 runs) found blue-side cost-quality is "a cliff," not a slope: the best model (Opus 5) found only 45.1% of evidence and 0/32 passed the bar — paying frontier prices bought the most expensive 45% in the study. And on the red side, frontier APIs are a hostile channel: offensive payloads trip refusals and rate limits, and the capable variants (GPT-5.5-Cyber) are gated. Every NDA'd bounty program and client codebase is also, practically, un-uploadable. Local weights aren't a preference; they're the only legal-and-sane deployment for this domain.
A benchmark-maxed giant is a snapshot. Our threat model isn't:
This doctrine only works if generation is nearly free, and that's what the M5 Max 128GB is for:
A Tuesday, one refresh cycle. Monday night the M5 Max ran 400 fleet rollouts at ~150 tok/s with τ=0.9 compaction; ~30% verified → ~120 new trajectories, ~6M tokens, at the cost of ~10 kWh. Tuesday, the weekly job LoRA-calibrates the MTP head (minutes, local — acceptance held at 0.71), runs the rented-GPU SFT over the accumulated corpus, then re-runs the held-out evals and the MTP acceptance suite. Wednesday morning: a new GGUF/MLX build, delta-logged in RESULTS.md. Total marginal spend: a few $k of GPU time amortized across the week, no API bill, no data leaving the machine. The equivalent frontier-API week is five figures and two of the targets would have been refused outright.
Novee proved small-model offensive RL is economics, not a compromise — and then kept it closed. We take the same math (open 27–35B bases, verified rollouts, weekly cadence), add the blue side and open weights, and run the whole loop on hardware that fits on a desk. The moat isn't the model; it's that the loop runs every week without a bill that argues back.
[[mtp-speculative-decoding]] · [[context-compaction-tau]] · [[landscape-2026]] · [[cyberfactory-openaegis]]