THE WORLD IS NOT STANDING STILL.RSS
BIG CHANGE.
BIG CHANGE, one tap away
BIG CHANGE, one tap away

Make room for the big picture.

Add BIG CHANGE to your home screen or desktop. It opens in its own window, with the latest stories when you’re online.

iPhone & iPad
Open bigchange.ai in Safari. Tap Share, then Add to Home Screen. Turn on Open as Web App if shown, then tap Add.
Android
Open bigchange.ai in Chrome. In the browser menu, choose Install app or Add to Home screen.
Desktop
In Chrome or Edge, use the install icon in the address bar or the browser’s app menu. In Safari on Mac, choose File → Add to Dock.

Markdown edition

# BotPsy brings tool calling to a small local model

> Tether releases tool-calling weights.

By BIGCHANGE.AI Editorial

Published: 2026-11-13T09:39:38.112Z
Updated: 2026-11-13T09:39:38.112Z
Canonical: https://bigchange.ai/blog/botpsy-small-local-tool-calling-model

![Illustration of a person reviewing an alarm on a phone.](https://bigchange.ai/api/media/file/alarm-v1.png)
AI-generated illustration for BIG CHANGE.

[Tether AI Research released BotPsy](https://huggingface.co/blog/qvac/botpsy) on November 11, publishing Apache 2.0 weights for a 0.8-billion-parameter tool-calling model based on Qwen3.5-0.8B.

A tool call is a structured request to software. The model selects a function and supplies its arguments; the application decides whether to execute it. Generating that request and successfully carrying out the action are different steps.

## The big change

- BotPsy targets on-device research and education, with English recommended. Its weights are available, but the release does not include training code or data.
- Tether reports improved tool-use scores under controlled conditions. Those company-run tests do not establish how quickly the model responds on a particular phone or how much battery it uses.
- Tool access creates a separate security decision. Limiting an application's permissions can reduce the damage from malicious instructions, even when a model fails to recognize them.

## What the comparison means

Tether reports BFCL v4 scores of 44.0 versus its base model’s 23.4: a weighted composite averaged over three runs. Both used thinking mode; BotPsy ran BF16 weights through vLLM.

The [Berkeley benchmark](https://gorilla.cs.berkeley.edu/leaderboard.html) evaluates accurate function calling. Its [multi-turn methodology](https://gorilla.cs.berkeley.edu/blogs/13_bfcl_v3_multi_turn.html) distinguishes a conversation with follow-up requests from a task requiring several internal tool calls. That distinction matters because choosing one function correctly is only part of a longer workflow.

For example, the benchmark deliberately leaves required information out of some requests. The expected response is to ask for clarification rather than invent the missing argument. Other cases initially omit a necessary function, testing whether the model recognizes that it cannot yet fulfill the request. These are documented benchmark scenarios, not demonstrations of a particular consumer application.

The evaluators also check the resulting system state, such as files or bookings, after functions run. A correctly shaped request alone therefore does not tell the whole story. This explains why developers need to test the complete sequence of interaction and execution, rather than inspect only the first generated call.

## Intended use and application controls

The [model card](https://huggingface.co/qvac/BotPsy-0.8B) excludes high-stakes decisions and applications involving personal information, money or health, despite including a calendar example. These are stated intended-use limits, not proof of safe deployment.

[OWASP](https://genai.owasp.org/glossary/prompt-injection/) describes how instructions hidden in retrieved pages, documents or emails can redirect an agent. The risk depends on the tools connected to it: reading information and sending or deleting it confer different powers.

Its guidance recommends minimizing privileges, treating model output as untrusted and requiring human confirmation for consequential actions. For an illustrative application, that means a request to send a message can be held for review instead of immediately being passed to a sending function. Confirmation is a checkpoint, not a guarantee that every malicious instruction will be caught.

Local inference describes where model computation happens. It does not, by itself, specify where a connected service sends data or authorize a tool to act. Before connecting an assistant to real accounts, a developer still needs an explicit account of the permissions, data destinations and failure handling.

## Sources

- [BotPsy model card](https://huggingface.co/qvac/BotPsy-0.8B) — Weights, example and stated limits.
- [Technical report](https://huggingface.co/blog/qvac/botpsy) — Company benchmark conditions and results.
- [Berkeley multi-turn](https://gorilla.cs.berkeley.edu/blogs/13_bfcl_v3_multi_turn.html) — Multi-turn evaluation design.
- [Berkeley benchmark](https://gorilla.cs.berkeley.edu/leaderboard.html) — Function-calling evaluation context.
- [OWASP prompt injection](https://genai.owasp.org/glossary/prompt-injection/) — Agent security context.