--- title: "Bug Bounty AI: Models for Triage, Recon Notes and Reports" canonical: https://pentestllm.ai/bug-bounty generated: 2026-11-11T18:42:32.885Z source: https://pentestllm.ai/bug-bounty base_url: https://api.pentestllm.ai/v1 --- ![Rows of server cabinets in a data centre](https://pentestllm.ai/img/datacenter.webp) ## The parts of hunting a model speeds up - Scope: Summarize a program policy into what is in scope, what is out, and which finding types are excluded, before you spend an evening on a duplicate class. - Recon notes: Turn a pile of your own tool output into a deduplicated inventory with the odd entries called out. - Code reading: Read open-source components or client-side JavaScript the program ships and list the places worth a closer look. - Hypotheses: Given a described behaviour, list the vulnerability classes that would explain it and how to tell them apart. - Report: Draft the write-up: summary, steps you performed, impact, and a fix, in the tone triagers respond to. - Severity: Reason through a CVSS vector and say which metrics are arguable. ## Why hunters end up on security models A stock assistant will happily explain what cross-site scripting is and then decline to look at the response you actually got back from a target in scope. Hunting is full of those specific questions. The builds here are tuned or abliterated to answer security questions other models decline, which is the difference between an assistant and a tutorial. Refusals are reduced, not gone. The second reason is money. Hunting income is uneven, and a subscription bills in the months you find nothing. A prepaid balance does not. ## Reports are where it pays first Triagers read hundreds of reports. A clear one gets reproduced faster and argued with less. Give the model your notes and evidence and ask for a report in the platform’s structure, then edit it so every claim is one you verified. The model drafts; you are the author and you answer for the content. The same goes for severity. A model can walk a CVSS vector with you and show where a triager might push back, which is cheaper than finding out after submission. ## Fits a hunter’s setup The endpoint is OpenAI-compatible at `https://api.pentestllm.ai/v1`, so it works with the OpenAI SDK, with terminal agents, and with editor agents such as Cline. `auto/security` picks a build per request: a quick classification goes to a fast build, a long code review to a stronger one. The [OpenCode guide](https://pentestllm.ai/agents/opencode) and [aider guide](https://pentestllm.ai/agents/aider) cover the two most common terminal setups, and the largest context window listed today, 1M tokens, takes a large bundle of minified JavaScript in one request. ## Stay inside the program A bounty program’s published scope is your written permission, and it is specific: named assets, banned techniques, rate limits, rules about other users’ data. Paste the policy into the system prompt so suggestions stay inside it. Anything outside scope is unauthorized testing whatever a model says, and the [acceptable use policy](https://pentestllm.ai/acceptable-use) does not allow it. ## 9 security builds, priced per token Read from the live catalog on 2026-11-11. Prices are US dollars per million tokens, paid from a prepaid balance that starts at $10. The id `auto/security` has no price of its own: each request is billed at the build that answered. | Build | Input | Output | Context | | --- | --- | --- | --- | | [Qwen3.8 27B Cybersecurity](https://pentestllm.ai/models/qwen3.8-27b-cybersecurity) | $0.40 | $2.40 | 262,144 | | [Gemma 4 26B A4B Cybersecurity](https://pentestllm.ai/models/gemma-4-26b-a4b-it-cybersecurity) | $0.4224 | $1.3376 | 262,144 | | [GLM-5.3 Flash Cybersecurity](https://pentestllm.ai/models/glm-5.3-flash-cybersecurity) | $0.5093 | $1.6975 | 1,048,576 | | [Red Team (Flash)](https://pentestllm.ai/models/uplink-red-team-flash) | $0.90 | $3.00 | not published | | [Red Team (Pro)](https://pentestllm.ai/models/uplink-red-team-pro) | $1.50 | $6.00 | not published | | [OrcaCyber MiniMax M3.1 Flash](https://pentestllm.ai/models/minimax-m3.1-flash-cybersecurity) | $2.00 | $4.00 | 261,632 | | [OrcaCyber Qwen3.8 Flash Next](https://pentestllm.ai/models/orcacyber-qwen3.8-flash-next) | $2.00 | $4.00 | 261,632 | | [Cyber Frontier](https://pentestllm.ai/models/cyber-frontier) | $5.25 | $15.75 | 1,048,576 | | [OrcaCyber Zero 1.5](https://pentestllm.ai/models/orca-zero-1.5-cybersecurity) | $7.50 | $18.75 | 999,488 | [Full price list and tool fees](https://pentestllm.ai/pricing) · [Every model](https://pentestllm.ai/models) · [API docs](https://pentestllm.ai/docs) ## Questions - It can read faster than you and suggest where to look, and agents can run your tools. Confirming a real, in-scope, non-duplicate vulnerability is still your work, and reports that were not verified get closed. - Policies differ by platform and program. Check the rules of the program you are submitting to, and never submit a finding you have not reproduced yourself. - You pay per token. On 2026-11-11 the lowest-priced security build costs $0.40 per million input tokens, and the minimum top-up is $10. There is no monthly fee. - One with a large context window and solid code understanding. Send auto/security and long code goes to the balanced tier, or pin a build from the models page. - The builds answer security questions other models decline, so questions about behaviour you observed on an in-scope asset are answered far more often. You are responsible for staying within the program’s scope. ## Read next - [Vulnerability research Models for code review, CVE and patch analysis, and advisory writing.](https://pentestllm.ai/vulnerability-research) - [CTF Models that reason through web, crypto, reversing, forensics and pwn challenge categories.](https://pentestllm.ai/ctf) - [Hacker AI Security-tuned models by API for ethical hacking and authorized testing.](https://pentestllm.ai/hacker-ai) - [Cline The OpenAI Compatible provider fields in Cline.](https://pentestllm.ai/agents/cline) ## One key, from $10 PentestLLM is for systems you own or have written permission to test. The [acceptable use policy](https://pentestllm.ai/acceptable-use) says what is not allowed. [Get a key](https://app.pentestllm.ai/console) usage, 1,000 agent turns on Qwen3.8 27B Cybersecurity - Input, 8,000 tokens at $0.40 per million: $0.0032 - Output, 1,000 tokens at $2.40 per million: $0.0024 - One turn: $0.0056 - 1,000 turns: $5.60 output price per million tokens, 9 builds $1.3376 Gemma 4 26B A4B Cybersecurity OrcaCyber Zero 1.5 $18.75