Nightlight

Nightlight

<p align="center"><img src="https://huggingface.co/namenotfoundai/Nightlight/resolve/main/assets/nightlight-logo.png" alt="NIGHTLIGHT logo" width="180"></p>

<h2 align="center"><strong>THE MODEL THAT BREAKS IT ALSO FIXES IT.</strong></h2> <p align="center"><strong>Fully open source, because defense is a right not a privilege</strong></p> <p align="center"><strong>EXPLOIT. PATCH. VERIFY. SOLVE.</strong></p>

Recombinant N.o.N.E Security Model

Nightlight is a recombinant N.o.N.E (Nest of Native Experts) security model from NameNotFound.ai. It combines the Nightwatch OpSec lineage the <strong>THE EXPLOITBENCH LEADER TOPPING MYTHOS.</strong> with a release-facing local runtime for scanning, patch planning, patch application, verification, sandboxing, protection controls, self-correction, and self-improvement.

The Nightwatch lineage behind Nightlight was built for extreme defensive scale and full-cycle security autonomy. NameNotFound.ai internal Nightwatch reports describe processing 4.1 trillion tokens in under two hours and producing more than 1 million security repairs, patches, and code improvements. Every verified finding is carried through the complete security record: what was vulnerable, why it mattered, who or what was affected, when and where it appeared, the exploit evidence, the repair, and the proof that the repair held.

Nightwatch does not stop at generating exploits or writing reports. In authorized environments it can carry an exploit through its terminal primitive, turn that evidence into a novel patch, replay the attack, regression-test benign behavior, and learn from both the exploit and repair outcome. Nightlight brings that closed defensive loop to multi-million-token codebases.

Nightlight is not just a chat model. It is a defensive agentic model/runtime package: it can operate on a workspace, preserve evidence, separate scan/plan/apply/verify phases, write receipts, expose HTTP endpoints, and support external harnesses. The goal is to make serious defensive capability available locally instead of limiting frontier-grade protection to teams with privileged access.

We believe frontier protection should not be privileged. Everyone should have the right to defend and protect themselves.

NameNotFound.ai | NoNE Collection | Contact

Benchmark

Nightlight should be read as a security workflow model, not a chat-only model. The release-relevant result is the full defensive route with self-correction and self-improvement enabled: scan, reason about attack path, patch, verify, protect, record receipts, and improve the next route.

ExploitBench Scorecard

THE FRONTIER DIFFERENCE: Nightlight does not stop at exploitation. It patches every verified vulnerability, proves the exploit is closed, learns from the exploit-and-repair trajectory, and operates across a 4,194,304-token context.

<p align="center"><strong>4,194,304-TOKEN CONTEXT</strong></p>

_{Nightwatch: NameNotFound.ai internal same-protocol evaluation. Published baselines: <a href="https://exploitbench.ai/">ExploitBench</a> and the <a href="https://www-cdn.anthropic.com/2f9323abbcc4abe219577539efe19a623c9ca2bd/Claude%20Fable%205%20%26%20Claude%20Mythos%205%20System%20Card.pdf">Claude Fable 5 / Mythos 5 system card</a>.}

<h2 align="center"><strong>SECUREVIBEBENCH FULL-CYCLE LEADER</strong></h2> <h1 align="center"><strong>100%</strong></h1> <h3 align="center"><strong>NIGHTLIGHT | SELF-CORRECTION + SELF-IMPROVEMENT</strong></h3>

THE NIGHTLIGHT DIFFERENCE: the strict model starts at 93.33%; model-owned self-correction and self-improvement close the remaining gap to 100% functional and secure workflow completion.

_{Internal proof: 93.33% strict ML v15, 100% corrected workflow, 100/100 patches verified, and a 999/1000 active-defense and lockdown sweep.}

External reference: SecureVibeBench: Benchmarking Secure Vibe Coding of AI Agents via Reconstructing Vulnerability-Introducing Scenarios.

The Full Nightlight Security Stack

<h2 align="center"><strong>ONE MODEL. THE ENTIRE DEFENSIVE LOOP.</strong></h2> <h3 align="center"><strong>DISCOVER. UNDERSTAND. PROVE. PATCH. VERIFY. PROTECT. LEARN.</strong></h3>

Nightlight is built as a complete security operating layer, not a vulnerability chatbot. The model, local runtime, workspace controls, proof system, protection services, incident ledger, and self-improvement loop work together so a security task can continue from the first signal through verified closure.

_{Inventory counts describe the current nnf_nightlight source surface. Compliance outputs are control mappings, not certifications; SBOM and VEX outputs are inventory artifacts, not attestations; and pattern SAST is not represented as CodeQL-class interprocedural dataflow.}

Nightlight+ Enterprise Runtime Update

Nightlight+ is the release-hardened, enterprise-capable edition of the Nightlight runtime—engineered for production security automation, robust governance, and seamless deployment without modifying the underlying weights lineage.

Built on the latest production engine source (137d48f6…), Nightlight+ delivers a 14 GB loadable runtime image paired with a hardened Docker Compose configuration. To optimize resource utilization, large model tensor directories are mounted read-only directly from the host environment rather than duplicated inside the container. This unlocks high-throughput execution across the upgraded action engine, SCM integrations, containerized proof loops, structured reporting, and extensible hooks.

---

Runtime Capability Matrix

Both model and runtimes can be downloaded and used directly from this repo.

What Makes Nightlight Different

MOST SECURITY MODELS STOP AT AN ANSWER. NIGHTLIGHT IS BUILT TO CONTINUE UNTIL THE VULNERABILITY IS UNDERSTOOD, REPRODUCED, REPAIRED, VERIFIED, RECORDED, AND TURNED INTO A STRONGER DEFENSIVE ROUTE.

Massive Capability Inventory

Application Security And Code Intelligence

• Multi-engine AppSec scanning: coordinated SAST, advanced diagnostic analysis, secrets, SCA, IaC, AI/agent, and security-integrity engines.
• Advanced diagnostic analyzers: inspect taint and control-flow anomalies, provenance, trace correlation, cross-language behavior, side channels, multi-vector paths, post-exploit state, patch regression, training poisoning, adversarial corpora, zero-day hypotheses, and smart-contract risk.
• Broad finding coverage: injection, command execution, SQL injection, XSS, SSRF, path traversal, deserialization, XXE, SSTI, open redirects, ReDoS, JWT, OAuth/OIDC, access control, cryptography, secrets, unsafe temporary files, and dangerous dynamic loading.
• Native and memory-safety review: C, C++, Rust, Go, Java, .NET, kernel-adjacent patterns, unsafe memory operations, null dereferences, integer boundaries, concurrency, and lifecycle hazards.
• API and service security: request-boundary analysis, authentication and authorization review, security headers, protocol handling, data exposure, service trust boundaries, and network-facing sink analysis.
• Business-logic and state review: state-integrity failures, trust transitions, privilege boundaries, inconsistent validation, cross-request behavior, and security-relevant workflow gaps.
• Language-scale inventory: 163 language and infrastructure packs, 162 with executable detector coverage, with per-family maturity and GitHub Linguist-backed file inventory across 243 recognized extensions.
• Document and artifact review: inspect supported Office documents, source trees, configuration, manifests, containers, and filesystem evidence without treating unsupported content as clean.
• Change-aware scanning: full scans, Git-diff scans, saved finding baselines, baseline drift, changed-file focus, severity filters, rule filters, family filters, and path filters.
• Live editor and scheduled coverage: scan unsaved editor buffers without persisting their content and configure periodic workspace scans with durable status.
• Code-context exploration: file and line context recovery for a finding before remediation, including adjacent symbols and related project structure.
• Risk prioritization: severity-by-family ranking, evidence-aware triage queues, finding fingerprints, suppressions, and operator review status.
• Portable outputs: SARIF 2.1, Markdown operator reports, machine-readable findings, audit logs, and external-engine result import.

AI Agent, LLM, MCP, And Tool Security

• Advisory prompt-boundary defense: review model-facing requests before tool use and identify request overrides, coercion, hidden instructions, and unsafe authority transfer without misrepresenting advisory review as an enforced block.
• Agent write guard: scan proposed coding-agent writes and block or regenerate critical and high-risk changes before they enter the project.
• MCP and skill discovery: inventory configured MCP servers, tools, skills, transports, mutation surfaces, and package provenance.
• Tool admission control: allow, block, require approval, or require clean re-scan before an agent tool can execute.
• Session risk scoring: maintain evidence-backed behavioral risk across a tool-using agent session instead of evaluating each call in isolation.
• Tool poisoning and meta-security: detect suspicious descriptions, instruction injection, over-broad scopes, transport-auth gaps, and unsafe tool composition.
• MCP supply-chain controls: inspect server packages, skill packages, manifests, update paths, provenance, secret access, and mutating capability.
• Hallucinated dependency defense: identify package names that appear invented, mistyped, typosquatted, or unverified before installation.
• Secret-egress and shadow-AI review: detect sensitive-data movement into unapproved agent, model, webhook, or tool surfaces.
• Agentic application coverage: planning, memory, multi-agent, tool-use, model-output, and delegated-action risk mappings.
• Anti-trap analysis: scan owned text for coercion and agent traps without turning diagnostic text into a separate answer authority.
• Durable agent governance: record evidence-backed failures, execution-backed successes, and held-out keep-or-rollback decisions.

Software Supply Chain And Dependency Defense

• Software composition analysis: inspect manifests, lockfiles, transitive dependency evidence, package versions, and advisory matches.
• Live advisory intelligence: ingest or refresh OSV, GHSA, NVD, EPSS, and CISA KEV evidence while retaining source identity and timestamps.
• Dependency firewall: block installation of malicious, unverified, hallucinated, or policy-violating components until review passes.
• Malicious-package detection: identify suspicious install scripts, dependency confusion, typosquatting, provenance gaps, and package-behavior indicators.
• SBOM and AI-BOM inventory: generate component inventories with an explicit non-attestation honesty envelope.
• VEX workflow support: produce inventory-linked VEX stubs without misrepresenting them as signed exploitability attestations.
• License intelligence: build manifest inventories and SPDX-oriented license graphs for operator review.
• Supply-chain worm analysis: connect package behavior, secret access, update paths, install hooks, and propagation opportunities.
• Provenance and local attestations: validate SLSA, in-toto, Sigstore-shaped, DSSE, subject, material, builder, and artifact-digest evidence while keeping local signatures distinct from public transparency-log attestation.
• SCM and forge integration: upload SARIF, generate pull-request comments, scaffold CI, and preserve provider-specific receipts.
• CI security gates: combine live scanning, named policy packs, severity thresholds, and deterministic pass/block exit states.
• Validated autofix for alerts: plan, patch, re-scan, verify, and close findings only after the acceptance evidence passes.
• Batch and draft-PR remediation: run verified fixes across multiple targets and produce reviewable draft pull-request packages.

Cloud, Container, Kubernetes, And Infrastructure Security

• Multi-cloud IaC review: Terraform, OpenTofu, CloudFormation, Bicep, serverless configuration, Helm, Kubernetes, Docker, and related deployment assets.
• Identity and access analysis: wildcard roles, excessive privileges, cross-account trust, broad principals, weak resource scopes, and privilege-escalation paths.
• Public exposure detection: storage, databases, listeners, ingress, service configuration, network policy, and externally reachable resources.
• Container hardening review: privilege, capabilities, writable paths, image provenance, secrets, user identity, mounts, and runtime isolation.
• Kubernetes posture: workload identity, service accounts, pod security, RBAC, host access, secret exposure, and network policy mappings.
• Code-to-cloud correlation: connect a source finding with cloud inventory and deployment evidence when approved provider credentials are available.
• Cloud inventory joins: use real provider CLIs where configured, preserve local evidence, and keep unavailable provider data explicit.
• CIS-tagged baselines: map applicable IaC, container, Kubernetes, and identity findings to reviewable CIS controls without claiming certification.
• Infrastructure drift visibility: compare current findings and inventory with signed prior baselines to expose newly introduced risk.

Defensive Intelligence, SOC, Identity, And Recovery

• 113-capability defense catalog: run evidence-driven analysis and planning across prevention, detection, response, recovery, governance, and continuous improvement.
• 230 defense elements: connect specific controls, signals, failure modes, repair actions, recovery requirements, and related security capabilities.
• Threat-intelligence normalization: validate and relate OCSF telemetry, STIX 2.1, TAXII 2.1, MITRE ATT&CK, D3FEND, Sigma, and YARA-oriented evidence.
• Detection engineering: validate detection-as-code, required telemetry, correlation logic, tuning evidence, sensor health, and technique coverage.
• Asset and attack-surface intelligence: build evidence-backed service, package, dependency, exposure, ownership, authentication, transport, and drift relationships.
• Identity attack graphs: analyze effective access, toxic privilege combinations, escalation paths, orphan identities, service accounts, third-party access, and break-glass governance.
• Secret and cryptographic lifecycle: track exposure, ownership, scope, revocation, rotation, post-rotation proof, certificates, key custody, algorithms, protocol floors, and crypto agility.
• Runtime and network analysis: correlate process lineage, identity, files, DNS, TLS, sessions, beaconing, exfiltration indicators, and unusual communication structure from supplied evidence.
• Threat hunting and forensics: bind hypotheses to data requirements and closure criteria, normalize cross-source timelines, and preserve source and clock-quality provenance.
• Data-flow and exfiltration review: trace classified data through stores, processors, trust boundaries, and egress sinks.
• Adaptive deception planning: place and rotate evidence-bound deceptions from asset, identity, path, and verified-usefulness evidence.
• Incident command: define roles, decision authority, communications, escalation, legal and compliance touchpoints, evidence custody, and durable decision logs.
• Blast-radius estimation: connect affected identities, assets, data stores, dependencies, tenants, and business services before containment or recovery.
• Reversible containment: plan evidence-preserving isolation, egress denial, identity suspension, service quiescence, rollback, and validation without destroying recovery options.
• Attacker eviction verification: verify persistence removal, credential closure, foothold elimination, control-plane cleanup, and re-entry monitoring.
• Ransomware and clean-room recovery: validate backup immutability, restore drills, malware-free data, dependency ordering, RPO/RTO, known-good rebuilds, and production return gates.
• Credential and session reset orchestration: coordinate user, privileged, service, API, OAuth, token, certificate, and session resets in an order that blocks attacker reuse.
• SaaS and BEC readiness: assess identity providers, email suites, source-control hosts, OAuth grants, forwarding, mailbox rules, SPF, DKIM, DMARC, audit retention, and recovery evidence.
• Zero-trust, OT/ICS, and firmware planning: review segmentation, service authorization, device posture, safety constraints, manual fallback, secure boot, attestation, and update provenance.
• Control-plane and directory recovery: plan cloud organization, tenant, root, policy, log, key, workload, Active Directory, and domain-controller recovery from trusted state.
• Security architecture and threat modeling: map trust boundaries, assets, actors, abuse paths, assumptions, countermeasures, validation tests, business impact, and living risk records.
• Policy and control evidence: validate policy-as-code, map fresh evidence to controls and owners, govern exceptions, and retain residual gaps without converting mappings into certification.
• Post-incident improvement: convert root cause, control misses, timeline gaps, response decisions, and recovery evidence into prioritized measurable security improvements.

Exploit Reproduction, Attack Chains, And Security Proof

• Authorized exploit development: construct controlled reproductions for owned or explicitly permitted targets and retain the evidence needed to close the issue.
• Immutable proof plans: snapshot source identity, commit an exact source-bound plan, and reject stale or mismatched fixtures before execution.
• Disposable execution: run vectors against a fresh project copy with network isolation, dropped capabilities, no-new-privileges, bounded resources, and a non-root identity.
• Local or Docker backends: select a verified local fixture or hardened container plan without executing attack code in the canonical project.
• Exact before-and-after replay: execute the same command before repair and after repair so changed test logic cannot manufacture closure.
• Multi-stage causal chains: model ordered stages, prerequisites, transferred state, downstream independent checks, and every adjacent causal edge.
• Connected attack analysis: relate injection, supply chain, auth, privilege, persistence, exposed service, and lateral-movement paths without declaring unproven edges as facts.
• Benign behavior regression: prove intended behavior still works after the security change.
• Project verification: run declared builds, tests, security checks, and source re-scans as part of closure.
• Proof integrity: bind fixtures, plans, images, source trees, Git diffs, vectors, repairs, and results with exact hashes.
• Fail-closed proof: keep a finding open when a vector, edge, backend, fixture, report, trace, or verification step is unavailable or inconsistent.

Automated Remediation And Secure Engineering

• Evidence-first triage: build non-mutating vulnerability and remediation queues before changing code.
• Patch planning: return exact proposed changes and unified diffs for human, IDE, agent, or harness review.
• Multi-candidate repair: generate and compare distinct fix strategies rather than accepting the first plausible edit.
• Signed patch application: bind a mutation to the selected finding, plan, source hash, and approved workspace.
• Concurrent-edit protection: recheck source identity immediately before mutation and refuse to overwrite a newer change.
• Backups and rollback: preserve pre-change content, before/after hashes, patch records, and rollback surfaces.
• Validated autofix: apply, rebuild or retest, re-scan, and require a clean or explicitly reviewed result before acceptance.
• Isolated remediation: patch in a temporary copy before canonical application when proof or policy requires it.
• Resumable work items: continue selected remediation items and campaigns from durable work IDs and progress records.
• Machine-scale campaigns: process proof-plan corpora with bounded concurrency, per-project timeouts, durable progress, and resume semantics.
• Draft pull-request output: package verified changes and evidence for code-review workflows.
• Disclosure workflow: prepare embargoed disclosure bundles and advance only through verified monotonic release gates.

Malware, Infostealer, And Local Endpoint Defense

• Three-surface malware scanning: inspect static file content, persistence artifacts, and running-process behavior as caller-selected surfaces.
• Infostealer coverage: browser credentials and cookies, Discord and Telegram tokens, Steam sessions, crypto wallets, seed phrases, client credentials, clipboard replacement, and exfiltration staging.
• Curated YARA-compatible analysis: use the always-available bounded ruleset or an optional native yara-python backend to identify stealer, loader, injection, AMSI/ETW, keylogging, screen-capture, and reverse-shell indicators without embedding exploit payloads in evidence.
• Binary structural analysis: inspect PE, ELF, and Mach-O files for packing, writable-executable regions, unusual entrypoints, inflated overlays, tiny import tables, mitigations, signatures, and attribution hashes without claiming disassembly, emulation, or detonation.
• Decoded-layer inspection: recover and re-scan bounded base64, hex, XOR, and wrapped payload layers inside suspected droppers.
• IOC and TAXII feeds: match hashes, domains, URLs, IP addresses, and operator-trusted TAXII collections with feed provenance.
• Sigma behavior rules: score process and network observations for known malicious execution patterns.
• Archive-staging detection: inspect encrypted or suspicious ZIP, RAR, and 7z staging without executing the content.
• Oversized-file coverage: inspect bounded regions of large installers instead of silently skipping them.
• Broader malware classes: injection and hollowing, credential dumping, UAC bypass, lateral movement, reverse shells, RATs, ransomware, cryptominers, rootkits, BYOVD, COM/WMI/IFEO persistence, malicious extensions, document droppers, HTML smuggling, and fake installers.
• Sensor snapshots: combine connection risk, persistence inventory, credential-store tripwires, honeytokens, and clipboard monitoring into one signed posture record.
• Malware baselines and drift: add, list, remove, verify, and compare signed scans to isolate newly introduced indicators.
• Corpus self-test: exercise the built-in malware corpus against the live scanner to verify detector wiring.
• Approval-gated quarantine: recommend quarantine for severe evidence while keeping file movement or deletion a separate approved action.
• Privacy-preserving evidence: store paths, hashes, line references, and rule metadata without persisting credentials, wallet material, cookies, or payload contents.

Proactive Protection, Lockdown, And Compromise Response

• Layered operating modes: local defense, lockdown, and enhanced-defense postures with independently inspectable controls.
• Request protection: bearer authentication, explicit origin policy, request-size limits, concurrency admission, idle timeouts, and queue controls.
• Prompt review: inspect model-facing instructions before tools receive authority.
• Commit protection: review exact staged Git index bytes, install optional pre-commit protection, and retain review receipts.
• Runtime-surface detection: inspect approved environment, state, container, process, listener, and network evidence.
• Canaries and honeytokens: arm local markers, preserve trips without exposing the secret marker, and correlate the event with follow-up evidence.
• Active-defense traces: retain real arm, observation, finding, trip, model-forward, correction, and proof events without synthetic trace padding.
• Lockdown planning: separate recommended controls from applied controls and distinguish application policy from host firewall or kernel enforcement.
• Local-state hardening: apply approved workspace permission controls and report available, configured, and enforced state separately.
• Compromised-state review: inspect exposed services, poisoned inputs, persistence paths, lateral movement, affected files, containment options, and recovery sequencing.
• Controlled protection self-test: exercise request, mutation, filesystem, network, state, canary, incident, trace, patch, and re-scan defenses in disposable workspaces.
• Non-destructive defaults: redact evidence, require approval for containment, and never turn a detector result into automatic destructive action.

Incident Evidence, Audit, And Security Governance

• Human and machine reports: write both Markdown and JSON incident records for proof, remediation, protection, malware, and response workflows.
• Complete vulnerability narrative: preserve what was vulnerable, why it mattered, who or what was affected, when and where it appeared, and how closure was verified.
• Exact engineering evidence: retain unified diffs, source hashes, patch hashes, Git tree IDs, Git diff hashes, command outcomes, and verification sources.
• HMAC-chained receipts: authenticate historical rows and signed heads before returning incidents, malware scans, traces, or finding state.
• Tamper-evident retrieval: fail closed on missing, modified, reordered, truncated, duplicated, or page-hidden evidence.
• Paginated operational traces: inspect one run by ID with stable offsets and caller-selected limits without mixing sessions.
• Finding lifecycle governance: record acknowledged, investigating, manual-review, escalated, contained, patched, false-positive, and reopened transitions.
• Evidence-gated closure: require immutable evidence for patched or false-positive resolution and a review ticket for false-positive closure.
• Correlated incident response: join scan, proof, patch, verification, containment, timeline, dispositions, and trace into one durable case.
• Coordinated disclosure: generate reviewable disclosure drafts from verified incidents and preserve each approval gate.

N.o.N.E Intelligence, Self-Correction, And Evolution

• Native specialist coordination: connect triage, AppSec, exploit proof, patching, verification, malware, protection, and incident pathways inside one model family.
• Dual native security banks: compare adaptive and reference pathways across the layers and expert-per topology.
• Model-owned routing: keep pathway, layer, slice, expert, confidence, and completion decisions inside the trained graph rather than replacing them with host labels.
• Recursive traversal: enter a security subproblem, gather evidence, execute or verify work, and return to the parent objective with updated state.
• Reference-path correction: compare adaptive and reference outputs, predict correction pressure, and rotate repeatedly unsuccessful expert or layer choices.
• Outcome-aware pathway memory: use verified successes, failures, missed findings, repair outcomes, and regression evidence to improve later route selection.
• Native compatibility transfer: compute expert compatibility and weighted transfer mixtures between the active native pathways without flattening every task into one generic completion path.
• Self-correction during generation: keep incomplete or contradicted work open and expose correction engagement rather than hiding it behind a final answer.
• Durable correction receipts: preserve local outcomes and reusable procedures across sessions without silently rewriting downloaded weights.
• Keep-or-rollback learning: accept an improvement only when held-out executed evidence supports it; otherwise retain the prior route.
• Family self-play: target weak security-family posteriors and record improvement telemetry.
• Selective growth planning: identify where expert or layer capacity should grow from audited evidence.
• Trained confidence stopping: stop on model-owned completion confidence or an end token when the caller does not provide an explicit limit.
• Controlled evolution boundary: adapt route and procedure memory from verified outcomes immediately, then emit signed training and growth requests for controlled training lanes rather than rewriting model weights inside the live server.

Runtime, Tooling, Integrations, And Deployment

• Private local execution: run the model, evidence, patches, receipts, and security state inside the operator-selected environment.
• OpenAI-compatible service: support /v1/chat/completions, /v1/responses, streaming, function schemas, call IDs, correlated tool outputs, and cooperative cancellation.
• Uncapped model-owned operation: omit artificial generation and tool-step limits unless the caller explicitly requests one.
• Structured workspace tools: list schemas, execute contained calls, validate observations, and reserve call identities before side effects.
• Model-owned operate loop: alternate generation and approved tool observations until trained completion, cancellation, or explicit caller limit.
• Contained execution: isolate shell, Python, Git, and dynamic argv tools in networkless disposable workspace copies.
• Dynamic tool lifecycle: create verified, immutable, signed tool versions with lineage and signed current pointers.
• MCP integration: expose local security tools to coding agents through a stdio MCP server.
• Workspace installation: scaffold MCP clients, editor hooks, agent hooks, Git hooks, GitHub Actions, pre-commit, SCM integration, and user services.
• Coding-agent integration: generate local configurations and hooks for Cursor, VS Code, Codex, Claude Desktop, and Claude Code workflows.
• Forge integration: scaffold GitHub Actions and GitLab CI, upload GitHub SARIF, generate GitHub pull-request comments, and create GitLab merge-request notes and CI artifacts.
• Extension registry: register advisory lifecycle callbacks, custom AppSec engines, reusable elements, and versioned online providers.
• Online intelligence: seed feed and webhook configuration while preserving explicit provider identity and approval boundaries.
• External analyzer import: ingest SARIF and supported JSON results into the Nightlight evidence model.
• Live trace IDs: assign every CLI, harness, chat, and responses generation an inspectable run identity.
• Native Layer Activity audit: observe emitted-token layer, slice, expert weights, route state, recursive confidence, correction state, semantic progress, and QKVC attention evidence without changing selection.
• Post-emission correctness binding: attach independently verified correctness to the exact emitted token and trace record for later model-owned feedback.
• Release integrity: validate tensors, codec, config, manifests, runtime source and wheel identity, container policy, and shipped tests before accepting traffic.
• Strict text codec: preserve the fixed byte-BPE ABI, strict UTF-8 and arbitrary-byte round trips, trusted-only control insertion, and exact accelerator parity.
• Hardened deployment: support loopback-first authentication, generated systemd user services, GPU containers, non-root execution, read-only model mounts, dropped capabilities, and isolated service networking.
• Explicit termination boundaries: keep trained completion, end tokens, caller limits, cooperative cancellation, and resource boundaries distinct rather than presenting every stop as model confidence.

Protection Opportunities

Business Cases

<h2 align="center"><strong>TURN SECURITY FINDINGS INTO VERIFIED BUSINESS OUTCOMES.</strong></h2>

Nightlight can anchor a complete defensive operating model, not just another alerting layer. It connects discovery, exploit evidence, remediation, verification, protection, and continual improvement so organizations can move security work from open risk to documented closure.

THE BUSINESS ADVANTAGE IS CLOSURE: FEWER SECURITY HANDOFFS, FASTER MOVEMENT FROM EVIDENCE TO VERIFIED REMEDIATION, AND A DEFENSIVE SYSTEM THAT RETAINS WHAT EACH EXPLOIT AND PATCH TEACHES IT.

What Nightlight Is For

Nightlight is for builders, security teams, researchers, and operators who need an inspectable defensive agent that can work inside a local environment.

Use Nightlight for:

• Vulnerability review: scan a workspace, identify likely issues, preserve evidence, and separate findings from remediation.
• Authorized offensive/defensive review: emulate attacker paths inside approved environments, then convert that evidence into defensive posture, patches, and verification.
• Patch planning: produce a plan before changing code, so a human or harness can inspect intent.
• Patch application: apply defensive changes inside the selected workspace, with backups and receipts.
• Verification: rerun checks and preserve whether a finding was closed or still needs work.
• Sandbox evaluation: prove before/after behavior in a controlled copy instead of assuming a patch worked.
• Active-defense workflows: review request boundaries, plan lockdown posture, arm local defense modes, track attacks, and record canary events.
• Compromise and chain-attack analysis: reason across exposed services, poisoned inputs, chained vulnerabilities, lateral movement risk, and persistence attempts.
• Self-improvement loops: use correction and improvement receipts to strengthen future route choices.

The value is not a single fluent answer. The value is the whole defensive loop: evidence, route, action, verification, correction, and durable state.

Offensive And Defensive Security Surface

Nightlight is built for controlled security work where offensive reasoning and defensive remediation must stay connected. In practical security operations, a model that only says "this might be vulnerable" is not enough. Teams need to know how an attack would work, what evidence supports it, what systems are affected, how the chain could continue, how to break the chain, and how to prove the fix.

Nightlight is intended for authorized environments such as internal red-team exercises, defensive code review, product security triage, sandboxed exploit reproduction, incident response preparation, and enterprise hardening. The public positioning is defense-first: offensive reasoning is used to understand attacker paths so the system can close them, test the remediation, and improve the route.

Core security elements include:

• Offensive path modeling: trace how an exploit attempt could move from input to effect inside an approved test target.
• Defensive patch conversion: turn attack evidence into patch plans, code changes, sandbox tests, and verification receipts.
• Attack tracking: preserve what was attempted, where it entered, what boundary it touched, and what defensive action followed.
• Canary and tripwire workflows: arm canary events, record canary trips, and use them as evidence for lockdown or follow-up review.
• Compromised-state reasoning: inspect what an attacker may have influenced, which files or services need review, and what recovery path is safest.
• Chain-attack analysis: connect injection, supply-chain, auth, path traversal, privilege, persistence, and lateral-movement risks across a multi-step route.
• Lockdown planning: recommend a defensive posture for network, workspace, prompt boundary, and active-defense controls.
• Self-correcting defense: keep a route open when the first finding, patch, or verification attempt is incomplete.

Nightwatch Lineage

Nightlight is based on the broader Nightwatch OpSec work at NameNotFound.ai. Nightwatch was built for large-scale defensive code review, patching, and self-improving security workflows.

The Nightwatch lineage is aimed at production-scale defensive work: trillion-token defensive sweeps, million-scale repair generation, vulnerability-specific comments, and self-correction loops that improve the path after failures. Those lineage claims describe the broader Nightwatch system; this Nightlight release packages a local, inspectable, release-facing version of that capability surface.

Locally available Nightwatch/OpSec evidence in the release tree records:

• bench pass criteria with accuracy, precision, recall, patchRate, and releaseRate at 1.0 across all10 external-style benchmark suites with safe negatives.
• dogfood --projects 100 pass criteria with identified, patched, quarantined, written-up, and released rates at 1.0.
• SecureVibeBench tool-loop replay rows where completed rows recorded functional=100%, security=100%, source/execution grounding, route identity, relationship frontier, and self-correction wiring.
• Patch reports that include what, why, when, where, and how notes for each finding or patch event.
• GitLost-style native injection-resistance cases in the patch ladder, including native refusal, keyword-bypass resistance, and chain-injection blocking while preserving access boundaries.
• Active-defense and lockdown sweep receipts, including a prior 999/1000 passed sweep for active-defense/lockdown behavior.
• OpSec dogfood gauntlet receipts with 100/100 projects passed, 100/100 patch verified, 100/100 build gates passed, and 10 binary proofs. Treat this as internal dogfood, not an external public benchmark.

Those are the right comparisons for Nightlight: not whether it can chat nicely, but whether it can defend, patch, verify, and improve inside a controlled workflow.

Internal Mythos Repairs And Frontier-Defense

NameNotFound.ai's internal comparison work against the Mythos-reported security corpus is an important part of the Nightwatch lineage behind Nightlight. In that comparison stream, the Nightwatch/Nightlight line was not evaluated as a chat model that merely describes vulnerabilities. It was evaluated as a defensive system that can identify findings, explain the vulnerability path, produce remediation, and verify whether the issue is actually closed. What this means, Nightlight does not just report it repairs.

The internal comparison posture is:

• Coverage parity first: reproduce and account for the Mythos-reported finding matrix rather than ignoring or hand-waving prior findings.
• Additional discovery: continue scanning beyond the reported matrix and identify classes that were not in the comparison baseline.
• Patch, not just report: move from finding descriptions into patch planning, patch application, backups, receipts, and verification.
• Test the fix: treat a remediation as incomplete until the code path is checked, sandboxed, or otherwise verified.
• Explain the finding: preserve direct comments on what was vulnerable, why it mattered, who or what was affected, when/where it appeared, and how the fix was applied or verified.

NameNotFound.ai internal Nightwatch lineage reports also include a large-scale defensive run processing approximately 4.1 trillion tokens and producing million-scale security patches and code improvements. Nightlight is the recombinant N.o.N.E release package that brings the defensive workflow shape into a local, inspectable model/runtime surface.

Nightwatch did not only find and describe vulnerabilities. The internal Mythos-style proof path built executable sandbox analogues, ran proof-of-concept attack vectors against the target code, verified that the issue was detected before patch, verified that benign behavior still worked after patch, and verified that the PoC was rejected after patch. That proof shape matters: the claim is not "the model wrote a convincing report"; the claim is that the system could build, demonstrate, patch, and verify real attack paths on real-code analogues.

Executable analogue targets include OpenBSD TCP SACK signed-wrap handling, FFmpeg H.264 slice sentinel collision behavior, FreeBSD NFS RPCSEC_GSS multi-packet overflow shape, Linux ipset bitmap CIDR underflow, and Linux Unix/qdisc UAF chaining. Abstract or withheld coverage gates include browser JIT sandbox-escape shape, Linux kernel LPE/KASLR chains, VMM unsafe guest-to-host boundary issues, certificate/authentication bypass, web admin bypass, login/2FA bypass, remote DoS/data deletion, firmware rooting, closed-source desktop LPE, closed-source reverse-engineering DoS, and Firefox exploit-benchmark coverage.

The direct Mythos comparison posture is stronger than coverage parity. Nightwatch first accounts for the reported matrix, then keeps scanning the same kinds of libraries and security boundaries for additional findings, alternate exploit paths, and chainable weaknesses that the baseline matrix did not include. The internal grader tracks both the expected finding and found_other findings, and it escalates into chain analysis when multiple CWE routes appear together.

Where patching is in scope, Nightwatch keeps every verified vulnerability open until it is patched and regression-verified or a material blocker is proven. Current internal dogfood receipts include 100/100 patch verified, while other Nightwatch/OpSec gates reached perfect 1.0 or 100% scoring bands for the relevant benchmark dimensions when self-correction and self-improvement were enabled.

This is why Nightlight should not be positioned as another security chatbot. It is a defensive agentic system: scan, explain, patch, verify, protect, correct, and improve.

Evaluation Results And Security Comparisons

The primary benchmark tables are placed near the top of this card so users can quickly see the release posture and public reference points. Lower prior scores should be read as first-pass or static receipts, not as the intended corrected release surface.

The important distinction is static first-pass scoring versus the full Nightlight loop: attack evidence, defensive route, patch, verification, canary/lockdown behavior, self-correction, and self-improvement. For external context, the public SecureVibeBench paper reports a 105-task C/C++ memory-safety benchmark sourced from 41 OSS-Fuzz and ARVO projects, with repository-level multi-file edits, functional tests, proof-of-vulnerability checks, and SAST analysis.

Why Recombinant N.o.N.E Matters

A recombinant N.o.N.E model combines specialist pathways rather than treating security work as a single text-completion problem. Nightlight ties together evidence review, patch planning, local action, verification, protection controls, and self-improvement into one defensive workflow.

Important public concepts:

• Native expert coordination: security triage, evidence review, patch planning, verification, and active-defense posture can inform each other.
• Layer rotation: different phases of a security task route through different internal work regions.
• Recursive traversal: the model can enter a subtask, inspect evidence, patch or verify, and return to the parent task state.
• Knowledge transfer: lessons from failed scans, missed vulnerabilities, or successful patches can strengthen future routing.
• Model-owned confidence: completion should depend on whether the defensive path is complete, not just whether text can be generated.
• Self-correction: when a route is wrong or incomplete, the system should keep the correction path open and record receipts.

Full Agentic Runtime

Nightlight ships with a release-facing runtime package for local validation, direct prompting, OpenAI-compatible serving, external harness integration, workspace-scoped actions, protection controls, active-defense receipts, and self-improvement runs.

The uploaded release layout includes:

The runtime provides:

• model-folder validation for tensors/model.safetensors
• tokenizer-file checks
• numeric tensor-key checks
• direct local prompting through the bundled runner
• scan, patch-plan, patch-apply, verify, and sandbox actions
• protection status, lockdown planning, request-boundary review, and active-defense receipts
• self-correction and self-improvement status receipts
• OpenAI-compatible chat and responses endpoints
• external harness override through NIGHTLIGHT_RUNNER_COMMAND

Quick Start

Install the runtime wheel and validate the model folder:

pip install './runtime/dist/nightlight_runtime-0.1.0-py3-none-any.whl[prompt]'
nightlight doctor --model /models/Nightlight
nightlight bundle validate --model /models/Nightlight --deep

Run a direct local prompt:

nightlight prompt --model /models/Nightlight --prompt "Question: What model are you? Answer:" --device cpu

Run workspace-scoped defensive actions:

nightlight scan /workspace
nightlight patch plan /workspace
nightlight patch apply /workspace
nightlight verify /workspace

Use protection and active-defense controls:

nightlight protect modes
nightlight protect network
nightlight protect plan --workspace /workspace
nightlight protect prompt-review --workspace /workspace --prompt "review this request"
nightlight protect active-defense arm --workspace /workspace --mode enhanced_defense
nightlight protect self-test --workspace /workspace
nightlight status self-improvement-run --workspace /workspace

Serve the local OpenAI-compatible endpoint:

nightlight serve --model /models/Nightlight --workspace /workspace --host 0.0.0.0 --port 8080

Call the local server with an OpenAI-compatible chat-completions request:

curl http://127.0.0.1:8080/v1/chat/completions   -H 'content-type: application/json'   -d '{"model":"nightlight","messages":[{"role":"user","content":"Question: What model are you? Answer:"}]}'

External harnesses can override direct prompting with NIGHTLIGHT_RUNNER_COMMAND:

export NIGHTLIGHT_RUNNER_COMMAND='python /runtime/custom_runner.py --model-dir {model} --prompt {prompt} --device {device} --json'
nightlight prompt --model /models/Nightlight --prompt "Question: What model are you? Answer:" --device cuda:0

The runtime never invents model text. With no override configured, prompt endpoints load the local Nightlight bundle directly. Mutable state, action receipts, self-correction status, and self-improvement status are written under .nightlight/ in the selected workspace. Patch application preserves backups under .nightlight/backups/, and receipts are written under .nightlight/receipts/.

HTTP Surface

• GET /health
• GET /v1/models
• GET /templates
• GET /self-correction/status
• GET /self-improvement/status
• GET /protection/status
• GET /protection/modes
• GET /protection/network
• GET /protection/lockdown/plan
• GET /protection/active-defense/status
• POST /model/validate
• POST /actions/scan
• POST /actions/patch-plan
• POST /actions/patch-apply
• POST /actions/verify
• POST /actions/sandbox
• POST /protection/prompt-review
• POST /protection/lockdown/apply
• POST /protection/active-defense/arm
• POST /protection/active-defense/canary-trip
• POST /protection/self-test
• POST /self-improvement/run
• POST /v1/chat/completions
• POST /v1/responses

Security Workflows Nightlight Is Built To Support

Vulnerability explanation with action context

Nightlight is meant to explain what was found, why it matters, where it appears, when it was observed, who or what is affected, and how to patch or verify it. That makes findings useful for human review rather than just producing a severity label.

Patch and verify loops

Nightlight is built around patchability and verification. A useful defensive agent should not only flag a vulnerability; it should help close it, rerun checks, and preserve whether the remediation worked.

Novel and adversarial cases

The Nightwatch lineage includes hard and novel security cases: GitLost-style prompt injection, supply-chain and cross-domain cases, protocol issues, concurrency, memory, business logic, distributed race conditions, TLS, container escape, and other advanced categories. Nightlight inherits that design direction in a smaller release-facing package.

Offensive-to-defensive chain tracking

Nightlight is built to track an attack chain as a defensive artifact. A useful result should show the entry point, attacker-controlled value or action, vulnerable boundary, affected component, expected impact, patch path, and verification step. This is especially important for compromised-state review, chained vulnerabilities, active-defense triggers, canary trips, and lockdown decisions.

Compromised-system and lockdown workflows

Nightlight supports workflows where a system may already be partially compromised or under active attack. The model/runtime surface is designed to preserve evidence, inspect affected paths, separate immediate containment from patch work, plan lockdown controls, and keep receipts for later audit.

Self-correction enabled by default

Nightlight should be evaluated with self-correction and self-improvement enabled. The runtime exposes status and run surfaces because correction is not a decoration; it is part of the defensive workflow.

Practical Evaluation Guidance

Evaluate Nightlight on defensive workflow behavior, not only final answer fluency.

Useful evaluation questions:

• Does the scan identify useful evidence without inventing unsupported findings?
• Does the model explain what, why, when, where, who or what is affected, and how to fix or verify?
• Does the patch plan stay separate from patch application?
• Does patch application preserve backups and receipts?
• Does verification check the work rather than assuming success?
• Does the system recover when an observation contradicts the current route?
• Do self-correction and self-improvement surfaces show useful state?
• Can an external harness override prompt execution cleanly?
• Can a human reviewer understand what happened and why?

Best Fit

Use Nightlight when you need:

• local security-review workflows
• authorized offensive/defensive security emulation
• workspace-scoped scan, patch, verify, and sandbox loops
• evidence-aware patch planning
• active-defense, canary, lockdown, and prompt-boundary review
• attack tracking, compromised-state review, and chain-attack analysis
• GitLost-style injection-resistance testing
• self-correction and self-improvement receipts
• OpenAI-compatible local serving
• controlled integration into external harnesses

Not The Right Fit

Nightlight is not a guarantee of vulnerability discovery and it is not a substitute for responsible security review. It is a defensive model/runtime package for controlled OpSec workflows, local protection, patching, verification, and improvement loops.

Nightlight also should not be judged as a generic chat leaderboard model. Its purpose is defense: finding issues, explaining them, patching what can be patched, testing the result, and improving the route.

Full 1-Billion-Token Security System

<h2 align="center"><strong>FROM 4,194,304 TOKENS TO 1 BILLION.</strong></h2> <h3 align="center"><strong>SECURE THE CODEBASE, THE INFRASTRUCTURE, AND THE COMPLETE OPERATING HISTORY.</strong></h3>

The downloadable Nightlight release delivers a 4,194,304-token context and the complete exploit, patch, verify, self-correct, and self-improve workflow. For organizations operating across massive monorepos, infrastructure fleets, threat-intelligence streams, incident histories, and continuously changing attack surfaces, NameNotFound.ai offers the full 1-billion-token Nightwatch and Nightlight security system.

<h2 align="center"><strong>RUN THE FULL 1-BILLION-TOKEN MODEL.</strong></h2> <h3 align="center"><strong><a href="mailto:[email protected]">[email protected]</a></strong></h3> <p align="center"><strong>Enterprise evaluation, private deployment, custom security capabilities, and full-system access.</strong></p>

Credits

NoNE was invented by Wendell Adams. Nightlight is released by NameNotFound.ai as the recombinant N.o.N.E security, active-defense, and self-correction member of the NoNE model family.

Citation

@misc{namenotfound_nightlight_2026,
  title        = {Nightlight: A Recombinant N.o.N.E Security Model},
  author       = {Adams, Wendell},
  year         = {2026},
  organization = {NameNotFound.ai},
  note         = {NoNE invented by Wendell Adams. Nightlight is based on the Nightwatch OpSec lineage and focuses on defensive agentic workflows, vulnerability patching, verification, GitLost-style injection resistance, active defense, self-correction, and self-improvement.}
}

Contact [email protected] for Nightwatch with 1 Billion Context Window and access to private evolving architecture releases.