VENOMX
Exploit knowledge. Not luck.
A local security assistant for triage, recon, and reporting.
Learn MoreThe Team
Four dual CS & AI major undergrads building VenomX.
Each owns a distinct domain of the stack.
Exploit knowledge. Not luck.
A local security assistant for triage, recon, and reporting.
Learn MoreVenomX is a local AI security assistant built for offensive and defensive security work. It combines a large language model with a structured knowledge base — giving you instant access to CVE data, exploit techniques, and attack frameworks, all running privately on your own hardware.
Natural language interface to complex security knowledge.
Runs entirely on your hardware. Nothing leaves your machine.
Built specifically for triage, recon, and reporting workflows.
Four steps. Plain language in, actionable intelligence out.
Describe what you need in plain language.
The AI understands your context and intent.
Relevant CVEs, techniques, and exploits surface instantly.
Structured, actionable output ready to use.
VenomX runs on a custom-abliterated Nemotron 30B — a hybrid architecture optimized for security reasoning, served locally with no cloud dependency.
52 layers combining Mamba2 SSM, Mixture-of-Experts, and Attention with 30B parameters and only 3B active per forward pass. Allowing strong reasoning at low inference cost.
Refusal behavior removed via the heretic framework. Security research doesn't need guardrails designed for general consumers so VenomX answers what you ask.
Served via vLLM across an dual GPUs at FP8 precision allowing computation to be fully on-premises with no external API calls.
Every response is grounded in a structured security corpus with CVEs, exploits, and attack techniques retrieved and re-ranked before the model sees them.
200k+ CVEs from NVD, 50k Exploit-DB entries, and 700 MITRE ATT&CK techniques — all embedded and HNSW-indexed in PostgreSQL + pgvector.
Semantic vector search combined with SQL metadata filters allowing queries by CVSS score, severity, and affected product in a single PostgreSQL query. Pure-vector stores can't do this at scale.
pgvector surfaces 20 candidates; a cross-encoder re-ranker rescores them and passes the top 5 to the LLM. Overall the single highest-impact quality step in the pipeline.
A customized OpenWebUI frontend built for security workflows — target management interface, structured vulnerability reports, and a dark-first branded theme. No consumer patterns, no cloud relay.
A FastAPI-orchestrated agent loop that plans multi-step strategies, executes security tools, parses their output, and reasons toward actionable results — all autonomously.
A fully containerized Docker Compose stack deployed against an isolated lab network — reproducible services, controlled target VMs, and validated end-to-end test scenarios.
Four dual CS & AI major undergrads building VenomX.
Each owns a distinct domain of the stack.
Have questions or want to learn more about VenomX? We'd love to hear from you.
contact@venomxai.com