Article
Chitos: From Detection to Proof ā An Autonomous Security AI That Actually Exploits
FINAL-Bench
ā¢ ā¢ 10Jinki Jeong PRO
Anserwise
AI & ML interests
None yet
Recent Activity
upvoted an article about 2 hours ago
Chitos: From Detection to Proof ā An Autonomous Security AI That Actually Exploits reacted to SeaWolf-AI's post with š§ about 2 hours ago
šÆ Chitos ā The Security Scanner That Actually Proves It
Most security scanners hand you a suspect list and walk away. That gap between detection and proof is where attackers live ā and it's exactly the gap that Chitos was built to close.
Chitos is the successor to Mythos, a static analyzer built for quick code health checks. Mythos was good at pattern matching ā spotting dangerous sinks, mapping CWEs, producing readable reports. But static analysis has a structural ceiling. A rule that sees eval(user_input) can tell you that looks dangerous. It cannot tell you whether the input is reachable, whether sanitization three layers up covers this path, or whether there's a live exploit chain for your exact framework version. Chitos was built to answer those questions.
š Phase 1 applies 50 language-agnostic rules across Python, JavaScript, Go, Java, C/C++, Rust, PHP, YAML and more ā covering injection sinks, deserialization gadgets, credential leakage, broken crypto, and prototype pollution. Every candidate is re-verified before reaching the report. Findings that can't be substantiated are excluded, not handed to you as noise.
š¬ Phase 2 dispatches an autonomous web-search agent to hunt live CVE databases, exploit advisories, and public PoC repositories. It formulates hypotheses, verifies them, and synthesizes a structured threat narrative. This phase needs a user-supplied Claude API key ā Phases 1 and 3 run entirely free.
šÆ Phase 3 is where Chitos diverges from everything else. Against targets you own or are authorized to test, it fires real payloads ā XSS, SQLi, path traversal, command injection ā mutates on block, captures hard evidence, and connects every proven finding into a kill-chain showing which vulnerabilities to remediate first.
No installation. No account. No code sent to third-party APIs.
Article: https://huggingface.co/blog/FINAL-Bench/chitos
Try it now š https://chitos.vidraft.net
reacted to SeaWolf-AI's post with š about 2 hours ago
šÆ Chitos ā The Security Scanner That Actually Proves It
Most security scanners hand you a suspect list and walk away. That gap between detection and proof is where attackers live ā and it's exactly the gap that Chitos was built to close.
Chitos is the successor to Mythos, a static analyzer built for quick code health checks. Mythos was good at pattern matching ā spotting dangerous sinks, mapping CWEs, producing readable reports. But static analysis has a structural ceiling. A rule that sees eval(user_input) can tell you that looks dangerous. It cannot tell you whether the input is reachable, whether sanitization three layers up covers this path, or whether there's a live exploit chain for your exact framework version. Chitos was built to answer those questions.
š Phase 1 applies 50 language-agnostic rules across Python, JavaScript, Go, Java, C/C++, Rust, PHP, YAML and more ā covering injection sinks, deserialization gadgets, credential leakage, broken crypto, and prototype pollution. Every candidate is re-verified before reaching the report. Findings that can't be substantiated are excluded, not handed to you as noise.
š¬ Phase 2 dispatches an autonomous web-search agent to hunt live CVE databases, exploit advisories, and public PoC repositories. It formulates hypotheses, verifies them, and synthesizes a structured threat narrative. This phase needs a user-supplied Claude API key ā Phases 1 and 3 run entirely free.
šÆ Phase 3 is where Chitos diverges from everything else. Against targets you own or are authorized to test, it fires real payloads ā XSS, SQLi, path traversal, command injection ā mutates on block, captures hard evidence, and connects every proven finding into a kill-chain showing which vulnerabilities to remediate first.
No installation. No account. No code sent to third-party APIs.
Article: https://huggingface.co/blog/FINAL-Bench/chitos
Try it now š https://chitos.vidraft.net
Organizations
None yet
upvoted an article about 2 hours ago
reacted to SeaWolf-AI's post with š§ š about 2 hours ago
Post
246
šÆ Chitos ā The Security Scanner That Actually Proves It
Most security scanners hand you a suspect list and walk away. That gap between detection and proof is where attackers live ā and it's exactly the gap that Chitos was built to close.
Chitos is the successor to Mythos, a static analyzer built for quick code health checks. Mythos was good at pattern matching ā spotting dangerous sinks, mapping CWEs, producing readable reports. But static analysis has a structural ceiling. A rule that sees eval(user_input) can tell you that looks dangerous. It cannot tell you whether the input is reachable, whether sanitization three layers up covers this path, or whether there's a live exploit chain for your exact framework version. Chitos was built to answer those questions.
š Phase 1 applies 50 language-agnostic rules across Python, JavaScript, Go, Java, C/C++, Rust, PHP, YAML and more ā covering injection sinks, deserialization gadgets, credential leakage, broken crypto, and prototype pollution. Every candidate is re-verified before reaching the report. Findings that can't be substantiated are excluded, not handed to you as noise.
š¬ Phase 2 dispatches an autonomous web-search agent to hunt live CVE databases, exploit advisories, and public PoC repositories. It formulates hypotheses, verifies them, and synthesizes a structured threat narrative. This phase needs a user-supplied Claude API key ā Phases 1 and 3 run entirely free.
šÆ Phase 3 is where Chitos diverges from everything else. Against targets you own or are authorized to test, it fires real payloads ā XSS, SQLi, path traversal, command injection ā mutates on block, captures hard evidence, and connects every proven finding into a kill-chain showing which vulnerabilities to remediate first.
No installation. No account. No code sent to third-party APIs.
Article: https://huggingface.co/blog/FINAL-Bench/chitos
Try it now š https://chitos.vidraft.net
Most security scanners hand you a suspect list and walk away. That gap between detection and proof is where attackers live ā and it's exactly the gap that Chitos was built to close.
Chitos is the successor to Mythos, a static analyzer built for quick code health checks. Mythos was good at pattern matching ā spotting dangerous sinks, mapping CWEs, producing readable reports. But static analysis has a structural ceiling. A rule that sees eval(user_input) can tell you that looks dangerous. It cannot tell you whether the input is reachable, whether sanitization three layers up covers this path, or whether there's a live exploit chain for your exact framework version. Chitos was built to answer those questions.
š Phase 1 applies 50 language-agnostic rules across Python, JavaScript, Go, Java, C/C++, Rust, PHP, YAML and more ā covering injection sinks, deserialization gadgets, credential leakage, broken crypto, and prototype pollution. Every candidate is re-verified before reaching the report. Findings that can't be substantiated are excluded, not handed to you as noise.
š¬ Phase 2 dispatches an autonomous web-search agent to hunt live CVE databases, exploit advisories, and public PoC repositories. It formulates hypotheses, verifies them, and synthesizes a structured threat narrative. This phase needs a user-supplied Claude API key ā Phases 1 and 3 run entirely free.
šÆ Phase 3 is where Chitos diverges from everything else. Against targets you own or are authorized to test, it fires real payloads ā XSS, SQLi, path traversal, command injection ā mutates on block, captures hard evidence, and connects every proven finding into a kill-chain showing which vulnerabilities to remediate first.
No installation. No account. No code sent to third-party APIs.
Article: https://huggingface.co/blog/FINAL-Bench/chitos
Try it now š https://chitos.vidraft.net
liked a
Space 8 days ago
reacted to SeaWolf-AI's post with š„ā¤ļøš 14 days ago
Post
4890
Darwin V9 ā GPQA Diamond 90.9%, #1 on the leaderboard, with pure greedy decoding
Darwin-398B-JGOS reaches 90.9% (180/198) on GPQA Diamond, the PhD-level scientific reasoning benchmark, ranking #1 on the Hugging Face GPQA Diamond leaderboard. No self-consistency, no test-time compute scaling ā this was achieved with a single greedy decode (temperature 0, single sample, max 16,384 tokens). The full eval config is published in the model card, so anyone can reproduce it. Raw reasoning, no score inflation.
The result comes from Darwin V9, a patented evolutionary model-development platform. Its core idea: it never trains a model from scratch.
Why Darwin V9 beats training from scratch
Cost & speed: no trillion-token pretraining run, no months of compute ā a purpose-built, high-performance model is produced in a fraction of the time.
Reuse of proven intelligence: instead of re-learning every capability from a blank slate, it selects and combines only the strengths of already-trained, already-validated models, so results are stable and predictable.
Surgical transplantation: it identifies which neural region of which model holds which capability ā at the FFN (Feed Forward Network) layer level ā and grafts in only the segments that contribute to the target skill.
How it works: a large model (Qwen 3.5 397B) serves as the mother model (the substrate); several father models specialized in reasoning, coding, and language are analyzed layer-by-layer across their FFN regions; the segments that contribute to the target performance are extracted and transplanted into the mother model to produce a new child model. The result is a ~400B MoE that activates only ~17B parameters per token at inference ā large-model capacity with efficient inference.
If training from scratch means rebuilding everything from a blank page, Darwin V9 means precisely recombining intelligence that has already been proven. GPQA Diamond #1 is the proof.
Model: FINAL-Bench/Darwin-398B-JGOS
Darwin-398B-JGOS reaches 90.9% (180/198) on GPQA Diamond, the PhD-level scientific reasoning benchmark, ranking #1 on the Hugging Face GPQA Diamond leaderboard. No self-consistency, no test-time compute scaling ā this was achieved with a single greedy decode (temperature 0, single sample, max 16,384 tokens). The full eval config is published in the model card, so anyone can reproduce it. Raw reasoning, no score inflation.
The result comes from Darwin V9, a patented evolutionary model-development platform. Its core idea: it never trains a model from scratch.
Why Darwin V9 beats training from scratch
Cost & speed: no trillion-token pretraining run, no months of compute ā a purpose-built, high-performance model is produced in a fraction of the time.
Reuse of proven intelligence: instead of re-learning every capability from a blank slate, it selects and combines only the strengths of already-trained, already-validated models, so results are stable and predictable.
Surgical transplantation: it identifies which neural region of which model holds which capability ā at the FFN (Feed Forward Network) layer level ā and grafts in only the segments that contribute to the target skill.
How it works: a large model (Qwen 3.5 397B) serves as the mother model (the substrate); several father models specialized in reasoning, coding, and language are analyzed layer-by-layer across their FFN regions; the segments that contribute to the target performance are extracted and transplanted into the mother model to produce a new child model. The result is a ~400B MoE that activates only ~17B parameters per token at inference ā large-model capacity with efficient inference.
If training from scratch means rebuilding everything from a blank page, Darwin V9 means precisely recombining intelligence that has already been proven. GPQA Diamond #1 is the proof.
Model: FINAL-Bench/Darwin-398B-JGOS
liked a
model 14 days ago
upvoted an article 15 days ago
Article
FINAL-Bench Quantum: An Open, Neutral Benchmark for Quantum-Computing Methods
FINAL-Bench
ā¢ ā¢ 17 liked a
Space 15 days ago
reacted to SeaWolf-AI's post with š„ 15 days ago
Post
6776
š Introducing FINAL-Bench Quantum ā an open, neutral benchmark that finally puts quantum-computing methods on one fair yardstick.
Quantum results are notoriously hard to compare. The same "logical error rate" or "query fidelity" means very different things depending on the code, noise model, hardware, and shot count. FINAL-Bench Quantum fixes that: five events judged under identical, published protocols, where every number is labeled as either measured here or quoted from a source.
Five events: ā QEC Decoder ā” Optimization (Max-Cut) ā¢ VQE ā£ QRAM ā¤ Quantum Simulation
The rules are simple and strict:
ā Track A (measured here, with 95% confidence intervals) is kept separate from Track B (quoted from papers, not directly comparable).
š¬ Simulation and real hardware are clearly distinguished, and no quantum-advantage claims are made.
š Methods from Google, IBM, NVIDIA, USTC, Riverlane and more sit side by side, with origin flags and author credits.
š¤ Anyone can submit their own method via the Submit tab for review and listing.
Already on the board: real IBM Heron r2 measurements (repetition-code distance boundary, 29ā175Ć error reduction from d3 to d5), a real-chip QRAM query fidelity of 0.92, and Hā VQE at chemical accuracy ā always labeled honestly as simulation vs hardware.
A leaderboard is only useful if you can trust it, so neutrality is the whole point: strong competitors stay in even when they beat the host, sources are quoted faithfully, and a simulation is never rounded up into a hardware claim.
Leaderboard: FINAL-Bench/quantum-bench-leaderboard
Article: https://huggingface.co/blog/FINAL-Bench/quantum-leaderboard
#quantum #QEC #QuantumComputing #benchmark
Quantum results are notoriously hard to compare. The same "logical error rate" or "query fidelity" means very different things depending on the code, noise model, hardware, and shot count. FINAL-Bench Quantum fixes that: five events judged under identical, published protocols, where every number is labeled as either measured here or quoted from a source.
Five events: ā QEC Decoder ā” Optimization (Max-Cut) ā¢ VQE ā£ QRAM ā¤ Quantum Simulation
The rules are simple and strict:
ā Track A (measured here, with 95% confidence intervals) is kept separate from Track B (quoted from papers, not directly comparable).
š¬ Simulation and real hardware are clearly distinguished, and no quantum-advantage claims are made.
š Methods from Google, IBM, NVIDIA, USTC, Riverlane and more sit side by side, with origin flags and author credits.
š¤ Anyone can submit their own method via the Submit tab for review and listing.
Already on the board: real IBM Heron r2 measurements (repetition-code distance boundary, 29ā175Ć error reduction from d3 to d5), a real-chip QRAM query fidelity of 0.92, and Hā VQE at chemical accuracy ā always labeled honestly as simulation vs hardware.
A leaderboard is only useful if you can trust it, so neutrality is the whole point: strong competitors stay in even when they beat the host, sources are quoted faithfully, and a simulation is never rounded up into a hardware claim.
Leaderboard: FINAL-Bench/quantum-bench-leaderboard
Article: https://huggingface.co/blog/FINAL-Bench/quantum-leaderboard
#quantum #QEC #QuantumComputing #benchmark
- 2 replies
liked a
model 16 days ago
updated 2
models 21 days ago
liked a
model 22 days ago
updated a
model 25 days ago
liked 4
models 29 days ago
haffner/Darwin-4B-Genesis-heretic-GGUF
7B ā¢ Updated ā¢ 1.63k ā¢ 9
zeropointnine/Darwin-TTS-1.7B-Cross-Qwen3Tokenizer
Text-to-Speech ā¢ 2B ā¢ Updated ā¢ 103 ā¢ 5
tomasmcm/Darwin-4B-Genesis-mlx-4Bit
Text Generation ā¢ 1B ā¢ Updated ā¢ 123 ā¢ 5
k0valik/Darwin-28B-Coder-IQ4_XS12.9GiB-GGUF
Text Generation ā¢ 27B ā¢ Updated ā¢ 372 ā¢ 6