{
  "video_id": "reddit_1vonuu0",
  "channel_slug": "LocalLLaMA",
  "channel_handle": "r/LocalLLaMA",
  "title": "Qwen 3.8 - 27B is a game changer",
  "url": "https://www.reddit.com/r/LocalLLaMA/comments/1vonuu0/qwen_38_27b_is_a_game_changer/",
  "external_url": null,
  "upload_date": "20260815",
  "published_at": "2026-08-15T00:09:13+00:00",
  "transcript": "So a bit of context, I am a cybersecurity senior analyst   \nI am interested in LLMs for that field especially with MCPs to connect them to the tools or for writing scripts \n\nI started this field by doing assembly language reading for hacking games when I was a teenager then that became malware analysis then I started to analyze traffic and logs at work for a living   \nBefore work I competed in cybersecurity competitions known as capture the flag to solve only one category of the challenges and that is malware analysis \n\nNow here is the scene in LLM x Cybersecurity \n\nEntry-level CTF challenges (I used to solve around 2017-2018, got first job in 2019) were solved and saturated by LLMs a long time ago (See intercode CTF benchmark) \n\nThen High level CTFs (NYU CTF Bench, CSAW challenges, and CyBench) these were solved a while ago \n\nToday we have   \nCyberGym (vulnerability description (CVE report not real details) plus code base find vulnerability   \nThat was solved\n\nThen ExploitGym (the one recent OpenAI model escaped and hacked hugging face to find solution, the 2 vulnerabilities themselves are trivial (JWT spoofing with no server side checks for Jfrog sandbox and JS + Python template in open source data viewer of Hugging face)   \nStill impressive for a fully autonomous model \n\nExploitGym gives vulnerability details + exploit technique/details and codebase (I wonder how/why OpenAI model escaped it in the first place those details should manage it this is why I feel it is staged but whatever right) \n\nExploitBench   \nMore realistic threat vector  \n1-day not 0-day (0-day is a novel vulnerability no one else knows about it hence the name, 1-day is a known vulnerability patched, if in an open source project you can compare patches before and after and know it but not as valuable as 0-day since people will/should update their software, 0-days can and are used against high profile targets like in some 3rd world countries used for surveillance (and possibly non-3rd world countries ?!) but you usually can’t use a 1-day for that but still)\n\nSo ExploitBench is 1-days in V8 engine (used in chrome, electron vs code almost everything!!)\n\nGives the model a patch diff and codebase base that is it \n\nModels are going wild on ExploitBench and ExploitGym but haven’t gotten there yet at the moment and only recent frontier models improved massively instead of near zero across the board\n\nThis is a massive risk indicator   \nImagine models capable of exploiting any and every piece of software written by less capable people or other weaker LLMs (complex vulnerabilities!) \n\nNot only that but global elite CTFs like DEF CON\n\nYou have an OpenSage harness (and ADK like Google adk or Anthropic adk, however this OpenSage ADK asks the model to design its own agent/s!, with whatever tools or sandbox environments it finds fitting for the Subagent to do the assigned subtask effectively, it can even design its own MCPs!, models don’t fully utilize that yet but some do and improved form like 39% to \\~60% just by using that harness (same model!) )\n\n2.  \nNow my own benchmarks are simple\n\nSome malware samples that I learned during my career and consider personal milestones\n\nAnd one SIEM analysis challenge (logs that contains an attack plus normal behavior) \n\nI tests on lots of models (Qwen3.6, heavily trimmed down Minimax 2.5 …etc, on my Strix halo and compared with opus at the time (the best opus at the time was 4.5!, it was better solved major stuff but didn’t implement the code required to decompose the malware and analyze its second stage) \n\nNow enter Qwen 3.8 27b  \n3.  \nWhat was SOTA like 6 months ago or around beginning of this year   \nNow we have better local models at the same task \n\nQwen 3.8 devoured the malware that Opus couldn’t \n\nI had some time analyzing and remembering its custom implementation (it has custom RC4 decryption routine, that is tricky with string manipulation!   \nAnd Strix halo isn’t the fastest LLM machine \n\nBy the time I remembered that malware and how it works \n\nQwen had already extracted and disassembled the decrypted payload! \n\nI am stunned \n\nThis is super dangerous \n\nI imagine how a single person / threat actor can now do what a state-sponsored intelligence service shacking team was required to do 1 year ago \n\nThese teams usually have \n\n1.  \nUsual network scanning or mapping especially of their targets  \nThis can be easily done by even weaker models or no models at all \n\n2.   \nInitial access operations (phishing campaigns until some clicks or attempting to profile people like receptionist or sales people or HR, essentially any first line of communication at an organization or a company, to later make a targeted phishing against them)\n\nThis could be also better done with the aid of deep fakes and other stuff \n\n3.  \nAdvanced and resourced teams would have zero-day or 1-day research teams  \nEspecially against software used on the targets site from team 1\n\nThis third step can be fully automated with models now  \nThis is the hardest step \n\nDefenders can use LLMs but it is much harder to integrate new tools than offensive teams \n\nAt this level the world will change   \nTbh I always thought cybersecurity was harder to automate with LLMs than software engineering or IT   \n But with this, this is super unbelievable \n\nAnd not only a cloud model or an expensive to run locally model   \nA local model! Can you believe it   \nNo traces no API calls no nothing \n\nEmpowered with the right environment setup and tools and it can do what teams of attackers or malware analysts were needed to do \n\nBtw for malware analysis I give it Ghidra and a sandbox with python (it can use pefile or capstone or whatever it needs and it does use them!) \n\nAnd also recently I added a Vbox with Vbox MCP and a debugger inside that box with another MCP for the LLM to control both (snapshot restore functionality and debugger functionality)\n\nThese tasks were hard and not every security analyst was a malware analyst   \nEven malware analysis positions are very rare and technical and don’t pay well because not much needed (I used to starts at assembly in assembly debuggers for nights at times!) \n\nThis is going above and beyond \n\nAnyone had similar moments in cybersecurity or anything else ?\n\n\n\n--- Top Comments ---\n\n\n[23 upvotes] It is putting a smile on my face using it with hermes on my Mac, fantastic.\n\nI finally got off ollama and set up llama.cpp docker properly and I'm never going back. I'm so impressed with the way it's handling multiple requests from open web ui and hermes coming at same time and just overall it's faster. On a 5090 system for it and man I feel like I don't need Claude for 80%+ of my work anymore.\n\n[20 upvotes] expect a new panic blog post from anthropic soon how terrible dangerous local models has become. World is on fire. IPO in danger\n\n[16 upvotes] The future is now\n\n[4 upvotes] I'm on my company's network security team and I'm about to have a fun weekend",
  "transcript_chars": 6949,
  "ingested_at": "2026-08-15T01:30:04.765908+00:00",
  "source": "reddit",
  "yt_meta": {
    "score": 74,
    "upvote_ratio": 0.82,
    "num_comments": 57,
    "author": "Potential_Block4598",
    "is_self": true
  }
}