Small language models for XSS exploitation: are your controls keeping up?

TL;DR: Fine-tuned 27B open-weight models can reach about 80% of frontier exploit-validation performance at roughly 40% of the cost, while smaller base models lag sharply on XSS tasks, according to Novee research. The result shows that offensive AI capability is moving into cheaper, deployable models, so governance now has to account for scale, persistence, and misuse risk rather than model size alone.

NHIMG editorial — based on content published by Novee: Small Language Models (SLMs) for offensive security

By the numbers:

• The fine-tuned 27B model achieved about 80% of the frontier’s exploit rate at about 40% of the cost.

Questions worth separating out

Q: How should security teams govern AI agents used for offensive testing?

A: Treat offensive AI agents as distinct workloads with explicit ownership, scoped tools, and logged approvals.

Q: Why do small language models still matter for offensive AI risk?

A: Because risk is not driven only by model size.

Q: What do security teams get wrong about governing AI agents?

A: They often treat agents like another automation layer instead of governed non-human actors with their own access paths.

Practitioner guidance

• Inventory offensive AI workflows separately from general AI use Classify any model or agent used for exploit validation, fuzzing, or proof-of-concept generation as a distinct governed workload.
• Scope tool permissions for AI testing agents Limit each agent to the minimum exploit tools, target environments, and response channels needed for the task.
• Control retries, context, and parallelism Set explicit ceilings on retry budgets, context length, and concurrent attempts so that one model cannot amplify a marginal exploit hypothesis into a high-volume validation loop.

What's in the full article

Novee's full post covers the operational detail this analysis intentionally leaves for the source:

• Model-by-model exploit-rate charts across Gemma-4 and Qwen-3.5 variants for the 100-target benchmark
• The fine-tuning recipe using rejection-sampled traces and LoRA parameter-efficient adaptation
• Cost and token-efficiency comparisons showing how context length and retry budgets affect outcome
• The vendor's own deployment assumptions for on-prem use and constrained GPU environments

👉 Read Novee's analysis of small language models for offensive security →

Small language models for XSS exploitation: are your controls keeping up?

Explore further

View Full Forum →  |  NHI Foundation Course →