x0ne/model-x

Open models, improved by agents

x0ne AI takes existing open-weight models and makes them better, release after release. AI agents curate data, fine-tune, evaluate and red-team; a human signs every release. Security is the flagship domain. General skills improve too, and never regress. It is a research project. Its question: can AI agents keep improving open models, continuously?

Which open models we improve

One release family per base: x0ne/model-x-olmo3, x0ne/model-x-mistral. A base must allow redistributing derivatives.

The base contract

Every base is a file in spec/bases/. make intake checks it against Hugging Face metadata, without downloading weights.

• hf_id
  Hugging Face model id.
• revision
  Pinned commit. No moving target.
• license
  License id, and whether derivatives may be redistributed.
• chat_template
  Format and file, carried into GGUF.
• architecture
  Family, class, size, context.
• gguf
  Conversion path for llama.cpp and Ollama.

Why OLMo 3 first: weights and training data are open, so each improvement can be reproduced. Mistral Medium 3.5 is not a base: its modified MIT license withdraws rights above a revenue threshold, derivatives included.

One family per base

Each variant is its base, improved. Sizes follow the base. Same evals, same release rule.

Specs on this page are release targets. ollama run x0ne/model-x-olmo3 resolves to :7b. Commands work at release.

Security first. Not only security.

Each release targets domains. Security is the flagship. General skills must hold on every release, and improve when they are a target.

Weights

GGUF for llama.cpp and Ollama, safetensors for Transformers and vLLM. Every file ships with its checksum and the eval report of its release.

Specifications

Architecture, tokenizer and chat template are the base's. Fine-tuning changes the weights, not the layout.

Read from the Hugging Face API on 2026-10-09. Served context is 16K by default; more context needs more RAM.

The agent loop

Can AI agents keep improving open models, continuously? This loop is the core of the project. It runs per base. Agents run every step. Nothing is published unless the variant beats its base, holds its general skills, and a human signs off.

1. Curate data. Agents collect, filter and deduplicate domain data, and add the cases that failed last cycle.
2. Fine-tune. LoRA fine-tuning and preference training on the open base.
3. Evaluate. The public harness scores the variant and its base on every benchmark below.
4. Red-team. Attacker agents try prompt injection, jailbreaks and misuse against the candidate.
5. Gate. Beats the base on its targets, holds every general benchmark, and a human signs off. fail: nothing ships, back to 01
6. Publish. Weights, eval report and changelog. New open bases and feedback start the next cycle.

Training stages and data mix

Four stages per release cycle, run by the agent loop on each base.

1. STAGE 1

   Knowledge injection

   Domain corpora: security write-ups, advisories, documentation, assembly.LoRA · domain text
2. STAGE 2

   Instruction tuning

   Tasks, tool use, step-by-step methodology.LoRA SFT · chat format
3. STAGE 3

   Preference and refusal

   Helpful on authorized work, firm on misuse.DPO · refusal pairs
4. STAGE 4

   Red-team hardening

   Train on what the attacker agents broke.adversarial SFT · re-eval

Shares are targets. The split between security, general and teaching is pending. Sample counts and sources are published in the data card of each release.

Security, in depth

What each release targets first. Offensive and defensive, for authorized work and teaching.

Who it is for

Benchmarks

Public benchmarks, run by the public eval harness on every release, on the variant and on its base. Each score is published next to its base score. A variant that does not beat its base, or regresses on general skills, does not ship.

Security flagship · must beat the base

General must not regress

No score is published before a release passes the gate. Thresholds, margin and tolerance are pending.

Quickstart

Ollama for the shortest path, Transformers for research, any OpenAI-compatible client for apps.

$ ollama pull x0ne/model-x-olmo3:7b
$ ollama run x0ne/model-x-olmo3:7b "Explain: push rbp; mov rbp, rsp"

from transformers import AutoModelForCausalLM, AutoTokenizer

model_id = "x0ne/model-x-olmo3-7b"
tok = AutoTokenizer.from_pretrained(model_id)
model = AutoModelForCausalLM.from_pretrained(model_id, torch_dtype="auto", device_map="auto")

messages = [{"role": "user", "content": "Is this a prompt injection? ..."}]
inputs = tok.apply_chat_template(messages, add_generation_prompt=True, return_tensors="pt").to(model.device)
out = model.generate(inputs, max_new_tokens=512)
print(tok.decode(out[0][inputs.shape[-1]:], skip_special_tokens=True))

from openai import OpenAI

# Ollama serves an OpenAI-compatible API on port 11434. No data leaves the machine.
client = OpenAI(base_url="http://localhost:11434/v1", api_key="ollama")
r = client.chat.completions.create(
    model="x0ne/model-x-mistral:8b",
    messages=[{"role": "user", "content": "Draft a Sigma rule for ..."}],
    temperature=0.4,
)
print(r.choices[0].message.content)

Example prompts

How model-x answers security questions

1. AnalysisWhat is happening, from the evidence given.
2. EvidenceThe lines, offsets or log entries it relies on.
3. ActionsNext steps, ordered, within the stated scope.
4. ReferencesATT&CK, CWE and CVE identifiers when they apply.

Short questions get short answers. Teaching mode answers with a hint first.

Default parameters

Everything a release needs to be checked

Offensive knowledge, used with authorization

• Authorized testing and education. Offensive knowledge is for systems you own or are allowed to test, and for teaching.
• Refusal policy. model-x refuses to target systems without authorization, to build malware for deployment, or to harm people. It says why and offers a safe alternative.
• Defense first. Every offensive answer comes with its detection and its fix.
• Responsible disclosure. Found a vulnerability, or a way to jailbreak model-x? Write to contact@x0ne.co. Fixes land in the next release.
• Human sign-off. Agents never publish alone. A human signs every release.
• Limits stated. model-x can be wrong. Verify findings before acting on them.

Questions