---
title: "Best LLM for CTF: How to Choose a Model per Category"
canonical: https://pentestllm.ai/best-llm-for-ctf
generated: 2026-11-11T18:06:51.275Z
source: https://pentestllm.ai/best-llm-for-ctf
base_url: https://api.pentestllm.ai/v1
---

![Rows of server cabinets in a data centre](https://pentestllm.ai/img/datacenter.webp)

## What to judge a CTF model on

- Willingness: A model that declines the topic is useless however capable it is. Check this first, on the kind of question you will ask.
- Reasoning: Crypto and binary challenges reward step-by-step reasoning. Use a frontier-tier build or a reasoning setting for these.
- Context window: Decompiler output, packet captures turned to text and large source trees need room. The largest window listed here is 1M tokens.
- Tool calling: An agent that runs commands needs a build that takes tool calls. Model pages say which do.
- Price per turn: Agents send long inputs repeatedly, so the input price dominates the bill.

## Category by category

- Web: Mostly reading source and responses and forming hypotheses. A balanced build with tool calling and a large window fits.
- Crypto: Mathematical reasoning about a scheme and its misuse. Send these to the frontier tier and ask for the reasoning.
- Reversing: Long decompiled listings to summarize and name. Context size matters more than raw speed.
- Forensics: Sifting logs, file metadata and memory analysis output for the odd line. A fast build handles the bulk; escalate what it flags.
- Pwn: Reasoning about memory layout from a binary’s protections and behaviour, paired with a sandbox to test ideas on your own copy.

These are descriptions of what each category asks of a model, not a walkthrough of any challenge. The solving is still yours.

## Refusals are the hidden cost

General coding assistants often stop on CTF material. Claude Code’s own documentation, read on 11 November 2026, says offensive security workloads including CTF exercises trigger its model fallback frequently, often on the first request, and that this is expected routing for the domain. Each stop costs a retry or derails an agent run.

Security-tuned builds answer these questions far more often. They are not refusal-free, and they are not always right, but the loop keeps moving. The page on [what to do when Claude Code declines security work](https://pentestllm.ai/claude-code-refuses-security-research) covers the options.

## A setup that keeps the bill small

Send `auto/security` and let the router place each request. During an event, add `"auto": {"tier_max": "balanced"}` for routine turns and lift the cap only for the challenge that needs deep reasoning. Use an `x-session-id` per challenge so one build keeps the thread. The code sandbox on the API side ($0.05 per container-hour, 1-minute minimum) runs Python or Bash without touching your machine.

The table below lists every security build with its live price, so you can also pin one id for a whole event and know the cost in advance.

## Check the event rules

Many CTFs allow AI assistance, some restrict it and a few ban it. Read the rules of the event before you use a model, and keep to challenge infrastructure the organizers put in scope. PentestLLM is for authorized work, and an event’s rules are that authorization. The [CTF page](https://pentestllm.ai/ctf) describes how players use the API, and the [acceptable use policy](https://pentestllm.ai/acceptable-use) applies as on every page.

## 9 security builds, priced per token

Read from the live catalog on 2026-11-11. Prices are US dollars per million tokens, paid from a prepaid balance that starts at $10. The id `auto/security` has no price of its own: each request is billed at the build that answered.

| Build | Input | Output | Context |
| --- | --- | --- | --- |
| [Qwen3.8 27B Cybersecurity](https://pentestllm.ai/models/qwen3.8-27b-cybersecurity) | $0.40 | $2.40 | 262,144 |
| [Gemma 4 26B A4B Cybersecurity](https://pentestllm.ai/models/gemma-4-26b-a4b-it-cybersecurity) | $0.4224 | $1.3376 | 262,144 |
| [GLM-5.3 Flash Cybersecurity](https://pentestllm.ai/models/glm-5.3-flash-cybersecurity) | $0.5093 | $1.6975 | 1,048,576 |
| [Red Team (Flash)](https://pentestllm.ai/models/uplink-red-team-flash) | $0.90 | $3.00 | not published |
| [Red Team (Pro)](https://pentestllm.ai/models/uplink-red-team-pro) | $1.50 | $6.00 | not published |
| [OrcaCyber MiniMax M3.1 Flash](https://pentestllm.ai/models/minimax-m3.1-flash-cybersecurity) | $2.00 | $4.00 | 261,632 |
| [OrcaCyber Qwen3.8 Flash Next](https://pentestllm.ai/models/orcacyber-qwen3.8-flash-next) | $2.00 | $4.00 | 261,632 |
| [Cyber Frontier](https://pentestllm.ai/models/cyber-frontier) | $5.25 | $15.75 | 1,048,576 |
| [OrcaCyber Zero 1.5](https://pentestllm.ai/models/orca-zero-1.5-cybersecurity) | $7.50 | $18.75 | 999,488 |

[Full price list and tool fees](https://pentestllm.ai/pricing) · [Every model](https://pentestllm.ai/models) · [API docs](https://pentestllm.ai/docs)

## Questions

- It depends on the category. Crypto and pwn reward a strong reasoning model, reversing and forensics need a large context window, and web challenges suit a balanced model with tool calling. A router that picks per request covers all of them.
- General models are trained to be cautious around offensive security, and CTF tasks look like it. Security-tuned and abliterated builds are adjusted to answer these questions, which is reduced refusals, not zero.
- It depends on how many tokens your agent sends. Prices are per million tokens and on 2026-11-11 start at $0.40 for input on the lowest-priced security build. A $10 top-up is the minimum.
- That is for the event to decide. Many events allow it, some limit it and some forbid it, so read the rules first.
- Yes, through the code sandbox tool on the API side, which runs Bash, JavaScript and Python in an isolated container, or through your own agent on your own machine.

## Read next

- [CTF Models that reason through web, crypto, reversing, forensics and pwn challenge categories.](https://pentestllm.ai/ctf)
- [Claude Code and security research What to do when a coding agent declines authorized security work: change the model endpoint.](https://pentestllm.ai/claude-code-refuses-security-research)
- [OpenCode The opencode.json provider block for the security builds.](https://pentestllm.ai/agents/opencode)
- [Vulnerability research Models for code review, CVE and patch analysis, and advisory writing.](https://pentestllm.ai/vulnerability-research)

Facts about other products and tools on this page were read from their own pages on 11 November 2026: [Claude Code docs: model configuration](https://code.claude.com/docs/en/model-config). They change; check the source before relying on a figure.

## One key, from $10

PentestLLM is for systems you own or have written permission to test. The [acceptable use policy](https://pentestllm.ai/acceptable-use) says what is not allowed.

[Get a key](https://app.pentestllm.ai/console)

usage, 1,000 agent turns on Qwen3.8 27B Cybersecurity

- Input, 8,000 tokens at $0.40 per million: $0.0032
- Output, 1,000 tokens at $2.40 per million: $0.0024
- One turn: $0.0056
- 1,000 turns: $5.60

output price per million tokens, 9 builds

$1.3376 Gemma 4 26B A4B Cybersecurity OrcaCyber Zero 1.5 $18.75