Home » blog » REDCELL OSINT Model: A Local AI for Cyber Threat Intelligence and Investigations

REDCELL OSINT Model: A Local AI for Cyber Threat Intelligence and Investigations

Tram cong nghe AI blog

The REDCELL OSINT model is a new open model built for open-source intelligence (OSINT), cyber threat intelligence (CTI) and investigative work, and you can run it on your own machine. It was shared publicly on Hugging Face on September 29, 2026. It is a Mixture-of-Experts model with 26 billion parameters in total but only 4 billion active at a time, a 262K-token context window, and fine-tuning on about 6,500 OSINT/CTI instructions.

Key Takeaways

• Released: shared on X and Hugging Face on September 29, 2026, as terrorswift/REDCELL-26B-A4B-OSINT-Cyber-APEX-GGUF.
• Base model: a supervised fine-tune of Google’s Gemma 4 26B-A4B.
• Size: 26B total parameters, 4B active per token, 262K context.
• Training data: about 6,500 custom examples across 4 axes and 33 subcategories.
• Price: free to download, released under the Apache-2.0 license.
• Caveat: no formal benchmarks yet. The author calls it an experimental, early release.

What Is the REDCELL OSINT Model?

REDCELL is a specialized language model for analysts, researchers and investigative journalists. OSINT means gathering intelligence from publicly available sources. CTI, or cyber threat intelligence, means tracking who is attacking systems, and how.

According to the X post that introduced it, the model is trained for:

• Threat-actor attribution: linking an attack to the group likely behind it.
• IoC pivoting: starting from an indicator of compromise (IoC), such as a suspicious domain or file hash, and following it to related evidence.
• Geolocation: working out where something happened or where a photo was taken.
• Admiralty source grading: rating how reliable a source is and how credible its information is, a common method in intelligence work.

The Hugging Face model card says REDCELL was trained “to produce senior-analyst tradecraft instead of reflexive hedging on legitimate investigative work.” In plain terms, it is meant to answer real investigative questions directly instead of refusing or adding vague disclaimers.

This matters because, as the X post puts it, many “security models” are just a general model with a system prompt. REDCELL is an actual fine-tune: the training data itself changes how the model behaves.

How it was trained

The model card describes these choices:

• Corpus-based domain adaptation. The author did not use “abliteration,” a technique that strips refusal behavior from a model’s weights. They started from the standard Gemma 4 26B-A4B instruction model and let the training data shape its behavior. The card says the model “retains its own judgment about genuine attack uplift,” so it is not a fully uncensored model.
• Grounded data. Every training record was checked against authoritative references, such as OSINT frameworks, verification handbooks and MITRE for the cyber side, rather than generated from another model’s memory.
• Light training. It is a 2-epoch LoRA fine-tune. The author reports that eval loss declined steadily with no rebound, which they read as no harmful overfitting.
• Vision included. REDCELL inherits Gemma 4’s image understanding in the BF16 and F16 weights, but there was no vision-specific fine-tuning.

REDCELL OSINT Model Specs and Benchmarks

There are no formal benchmarks yet. The model card says capability and refusal-behavior benchmarks “may be added in a future revision.” Under the X post, one user asked directly: “Any evals? How do you SFT a reasoning model without degradation?”

Here is what is known, based on the author’s reported figures:

Why “4B active” matters

In a Mixture-of-Experts model, only some parts of the network (the “experts”) are used for each token. REDCELL has 26B parameters on disk, but only about 4B do the work at any moment. That is what makes it practical to run locally.

REDCELL Pricing

REDCELL itself is free.

Your real cost is hardware. The source does not list exact memory requirements for each file, so check the file sizes on the Hugging Face page against your own GPU or RAM before downloading.

Which REDCELL File Should You Download?

All quantized versions are in one Hugging Face repository in GGUF format. GGUF is a file format for compressed (“quantized”) models used by local runtimes built on llama.cpp.

• Start with I-Balanced. The model card names it the recommended default.
• “I-” versions have the same size and tensor types as the non-I versions. The difference is that they were quantized with an importance matrix, which helps keep quality during compression. That matrix was weighted about 70% on REDCELL’s own training data and 30% on a general calibration set.
• APEX tiers (such as Balanced and Quality) use a MoE-aware method that compresses the routed experts most and keeps attention, the shared expert and the first layers at higher precision.
• 8-bit and 16-bit weights are also listed for people with more memory. The 16-bit weights include the vision capability.

One technical note from the card: some Gemma 4 expert tensors do not fit certain quant formats, so the real precision in a file can differ a bit from the tier’s nominal target. The table on the Hugging Face page shows the actual types.

How to Run REDCELL Locally

1. Open the Hugging Face repository terrorswift/REDCELL-26B-A4B-OSINT-Cyber-APEX-GGUF.
2. Download the I-Balanced GGUF file, or another tier that fits your hardware.
3. Load it in a GGUF-compatible local runtime.
4. Use the operational system prompt published on the model card. The author says using the prompt REDCELL was trained with “reinforces the model’s intended identity and behavior.”
5. Treat every answer as a lead, not a conclusion. The author writes that you “should verify all of this for yourself, exactly as you would any other OSINT lead.”

Because everything runs on your machine, your case data does not need to be sent to a cloud AI service.

Is the REDCELL OSINT Model Worth Trying?

Pros

• Built for real OSINT and CTI tasks, not just a general model with a security prompt.
• Runs locally, which suits sensitive investigations.
• Long 262K context for large reports and log dumps.
• Training data grounded in references like MITRE and verification handbooks.
• Free under Apache-2.0.

Cons

• No formal benchmarks, so its accuracy is unproven.
• Experimental, early release. Behavior may change.
• Only about 6,500 training examples, a small dataset.
• Open questions from the community about quality loss after fine-tuning.

Verdict: REDCELL is worth testing if you already do OSINT or threat intel work and want a private, local assistant. Keep it as a helper, not a source of truth, until independent evaluations appear.

REDCELL OSINT Model FAQ

What is the REDCELL OSINT model?
REDCELL is a fine-tune of Google’s Gemma 4 26B-A4B for OSINT, cyber threat intelligence and investigative journalism. It runs locally and is published on Hugging Face.

Is REDCELL free?
Yes. It is released under the Apache-2.0 license, and the weights are free to download.

Which REDCELL GGUF file should I download?
The model card recommends I-Balanced as the default choice.

Is REDCELL an uncensored model?
No. The author says it is not fully abliterated. It drops reflexive hedging on legitimate analysis but keeps its own judgment about real attack uplift.

Does REDCELL have benchmarks?
Not yet. The author says formal benchmarks may be added in a future revision.

Sources

• Md Ismail Šojal on X: https://twitter.com/0x0SojalSec/status/2104736980768866439
• Hugging Face model card: https://huggingface.co/terrorswift/REDCELL-26B-A4B-OSINT-Cyber-APEX-GGUF

Last updated: October 13, 2026