Researcher Says Local Uncensored Qwen Model Helped LSASS Dumper Evade Two EDR Products

A Project Black researcher says a locally run, uncensored Qwen3.8-27B derivative modified a Windows LSASS credential-dumping utility until it produced no detections across two lab EDR products. The September 24 test points to a practical risk for defenders: local open-weight models with stripped-down refusals can speed up iteration on offensive tooling, although the tested EDR vendors were not named and the result has not been independently reproduced.