What is the best LLM for CTF challenges?

It depends on the category. Crypto and pwn reward a strong reasoning model, reversing and forensics need a large context window, and web challenges suit a balanced model with tool calling. A router that picks per request covers all of them.

Why do coding assistants refuse CTF questions?

General models are trained to be cautious around offensive security, and CTF tasks look like it. Security-tuned and abliterated builds are adjusted to answer these questions, which is reduced refusals, not zero.

How much does a CTF weekend cost on the API?

It depends on how many tokens your agent sends. Prices are per million tokens and on 2026-11-11 start at $0.40 for input on the lowest-priced security build. A $10 top-up is the minimum.

Is using an LLM in a CTF cheating?

That is for the event to decide. Many events allow it, some limit it and some forbid it, so read the rules first.

Can the model run code for me?

Yes, through the code sandbox tool on the API side, which runs Bash, JavaScript and Python in an isolated container, or through your own agent on your own machine.

Choosing an LLM for CTF work

There is no single best LLM for CTF: the right model depends on the challenge category, how much context the task needs and whether the model will engage with the subject at all. A practical setup is a router such as auto/security that sends quick questions to a fast security build and hard reasoning to a frontier one, at each build’s own price.

Get a key Prices per token

shell

curl https://api.pentestllm.ai/v1/chat/completions \
  -H "Authorization: Bearer sk-ptl-live-…" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "auto/security",
    "messages": [{"role": "user", "content": "Rank these scanner findings by severity and say what to verify first."}]
  }'

Rows of server cabinets in a data centre

What to judge a CTF model on

Willingness: A model that declines the topic is useless however capable it is. Check this first, on the kind of question you will ask.
Reasoning: Crypto and binary challenges reward step-by-step reasoning. Use a frontier-tier build or a reasoning setting for these.
Context window: Decompiler output, packet captures turned to text and large source trees need room. The largest window listed here is 1M tokens.
Tool calling: An agent that runs commands needs a build that takes tool calls. Model pages say which do.
Price per turn: Agents send long inputs repeatedly, so the input price dominates the bill.

Category by category

Web: Mostly reading source and responses and forming hypotheses. A balanced build with tool calling and a large window fits.
Crypto: Mathematical reasoning about a scheme and its misuse. Send these to the frontier tier and ask for the reasoning.
Reversing: Long decompiled listings to summarize and name. Context size matters more than raw speed.
Forensics: Sifting logs, file metadata and memory analysis output for the odd line. A fast build handles the bulk; escalate what it flags.
Pwn: Reasoning about memory layout from a binary’s protections and behaviour, paired with a sandbox to test ideas on your own copy.

These are descriptions of what each category asks of a model, not a walkthrough of any challenge. The solving is still yours.

Refusals are the hidden cost

General coding assistants often stop on CTF material. Claude Code’s own documentation, read on 11 November 2026, says offensive security workloads including CTF exercises trigger its model fallback frequently, often on the first request, and that this is expected routing for the domain. Each stop costs a retry or derails an agent run.

Security-tuned builds answer these questions far more often. They are not refusal-free, and they are not always right, but the loop keeps moving. The page on what to do when Claude Code declines security work covers the options.

A setup that keeps the bill small

Send auto/security and let the router place each request. During an event, add "auto": {"tier_max": "balanced"} for routine turns and lift the cap only for the challenge that needs deep reasoning. Use an x-session-id per challenge so one build keeps the thread. The code sandbox on the API side ($0.05 per container-hour, 1-minute minimum) runs Python or Bash without touching your machine.

The table below lists every security build with its live price, so you can also pin one id for a whole event and know the cost in advance.

Check the event rules

Many CTFs allow AI assistance, some restrict it and a few ban it. Read the rules of the event before you use a model, and keep to challenge infrastructure the organizers put in scope. PentestLLM is for authorized work, and an event’s rules are that authorization. The CTF page describes how players use the API, and the acceptable use policy applies as on every page.

9 security builds, priced per token

Read from the live catalog on 2026-11-11. Prices are US dollars per million tokens, paid from a prepaid balance that starts at $10. The id auto/security has no price of its own: each request is billed at the build that answered.

Build	Input	Output	Context
Qwen3.8 27B Cybersecurity	$0.40	$2.40	262,144
Gemma 4 26B A4B Cybersecurity	$0.4224	$1.3376	262,144
GLM-5.3 Flash Cybersecurity	$0.5093	$1.6975	1,048,576
Red Team (Flash)	$0.90	$3.00	not published
Red Team (Pro)	$1.50	$6.00	not published
OrcaCyber MiniMax M3.1 Flash	$2.00	$4.00	261,632
OrcaCyber Qwen3.8 Flash Next	$2.00	$4.00	261,632
Cyber Frontier	$5.25	$15.75	1,048,576
OrcaCyber Zero 1.5	$7.50	$18.75	999,488

Full price list and tool fees · Every model · API docs

Questions

It depends on the category. Crypto and pwn reward a strong reasoning model, reversing and forensics need a large context window, and web challenges suit a balanced model with tool calling. A router that picks per request covers all of them.
General models are trained to be cautious around offensive security, and CTF tasks look like it. Security-tuned and abliterated builds are adjusted to answer these questions, which is reduced refusals, not zero.
It depends on how many tokens your agent sends. Prices are per million tokens and on 2026-11-11 start at $0.40 for input on the lowest-priced security build. A $10 top-up is the minimum.
That is for the event to decide. Many events allow it, some limit it and some forbid it, so read the rules first.
Yes, through the code sandbox tool on the API side, which runs Bash, JavaScript and Python in an isolated container, or through your own agent on your own machine.

One key, from $10

PentestLLM is for systems you own or have written permission to test. The acceptable use policy says what is not allowed.

Get a key

usage, 1,000 agent turns on Qwen3.8 27B Cybersecurity

Input, 8,000 tokens at $0.40 per million: $0.0032
Output, 1,000 tokens at $2.40 per million: $0.0024
One turn: $0.0056
1,000 turns: $5.60

output price per million tokens, 9 builds

$1.3376 Gemma 4 26B A4B CybersecurityOrcaCyber Zero 1.5 $18.75