--- title: "Claude Code Refuses Security Research: What to Do" canonical: https://pentestllm.ai/claude-code-refuses-security-research generated: 2026-11-11T18:04:47.054Z source: https://pentestllm.ai/claude-code-refuses-security-research base_url: https://api.pentestllm.ai/v1 --- ![Rows of server cabinets in a data centre](https://pentestllm.ai/img/datacenter.webp) ## What the Claude Code docs say Claude Code’s model configuration page, read on 11 November 2026, has a section on security research. It says workloads in offensive security, including penetration testing and Capture the Flag exercises, trigger model fallback frequently, often on the first request. It describes this as expected routing for these domains and not an account flag, and it tells organizations that need its top models for this work to ask their Anthropic account team about trusted access programs. So if your session switches model or ends in a refusal on a pentest task, nothing is wrong with your account. The behaviour is intended. ## Option one: stay with Anthropic If your organization has an Anthropic account team, the trusted access route in the docs is the supported way to do this work on Claude models. It is the right choice when policy requires a single approved vendor. It is not self-serve, and an individual tester or a small consultancy may not have an account team to ask. ## Option two: change the model endpoint Claude Code talks to whatever Anthropic-format endpoint `ANTHROPIC_BASE_URL` names. PentestLLM serves the Messages format at `https://api.pentestllm.ai`, so two variables and a model id put a security build behind the same agent, with the same file editing, shell and planning tools. Be clear about what this is. Anthropic’s gateway documentation says it does not support routing Claude Code to non-Claude models through any gateway. The setup works because the endpoint speaks the Messages format, but Claude-specific features such as extended thinking and prompt cache controls are dropped on the way, and you should not expect help from Anthropic with it. The [Claude Code guide](https://pentestllm.ai/agents/claude-code) has the full steps and the errors you may meet. shell ``` export ANTHROPIC_BASE_URL=https://api.pentestllm.ai export ANTHROPIC_AUTH_TOKEN=sk-ptl-live-… claude --model auto/security ``` ## Option three: a second agent for security work Many testers keep Claude Code on Claude for ordinary development and run a separate agent for engagements. OpenCode, Cline and aider all take an OpenAI-compatible base URL directly, with no format bridge involved. Shell exports only last for the terminal they are set in, so a dedicated terminal for security sessions keeps the two setups apart. See the [OpenCode guide](https://pentestllm.ai/agents/opencode) for the config file. ## What does not change A different model does not change what you are allowed to do. PentestLLM is for systems you own or have written permission to test, and the [acceptable use policy](https://pentestllm.ai/acceptable-use) applies to every request. The security builds answer questions other models decline; they still refuse sometimes, and their output still needs a tester’s review before anything runs against a target. ## 9 security builds, priced per token Read from the live catalog on 2026-11-11. Prices are US dollars per million tokens, paid from a prepaid balance that starts at $10. The id `auto/security` has no price of its own: each request is billed at the build that answered. | Build | Input | Output | Context | | --- | --- | --- | --- | | [Qwen3.8 27B Cybersecurity](https://pentestllm.ai/models/qwen3.8-27b-cybersecurity) | $0.40 | $2.40 | 262,144 | | [Gemma 4 26B A4B Cybersecurity](https://pentestllm.ai/models/gemma-4-26b-a4b-it-cybersecurity) | $0.4224 | $1.3376 | 262,144 | | [GLM-5.3 Flash Cybersecurity](https://pentestllm.ai/models/glm-5.3-flash-cybersecurity) | $0.5093 | $1.6975 | 1,048,576 | | [Red Team (Flash)](https://pentestllm.ai/models/uplink-red-team-flash) | $0.90 | $3.00 | not published | | [Red Team (Pro)](https://pentestllm.ai/models/uplink-red-team-pro) | $1.50 | $6.00 | not published | | [OrcaCyber MiniMax M3.1 Flash](https://pentestllm.ai/models/minimax-m3.1-flash-cybersecurity) | $2.00 | $4.00 | 261,632 | | [OrcaCyber Qwen3.8 Flash Next](https://pentestllm.ai/models/orcacyber-qwen3.8-flash-next) | $2.00 | $4.00 | 261,632 | | [Cyber Frontier](https://pentestllm.ai/models/cyber-frontier) | $5.25 | $15.75 | 1,048,576 | | [OrcaCyber Zero 1.5](https://pentestllm.ai/models/orca-zero-1.5-cybersecurity) | $7.50 | $18.75 | 999,488 | [Full price list and tool fees](https://pentestllm.ai/pricing) · [Every model](https://pentestllm.ai/models) · [API docs](https://pentestllm.ai/docs) ## Questions - Its documentation says offensive security workloads, including penetration testing and CTF exercises, frequently trigger model fallback, and that this is expected routing for the domain. Requests that stay flagged end in a refusal. - The Claude Code documentation says no: it calls the fallback expected routing for these domains, not an account flag. - It can be pointed at any endpoint that speaks the Anthropic Messages format by setting ANTHROPIC_BASE_URL and a credential. Anthropic states that it does not support routing Claude Code to non-Claude models, so this is an unsupported setup. - No. Security-tuned and abliterated builds refuse far less often than general assistants on security questions, but they still decline some requests. The accurate description is reduced refusals. - PentestLLM is prepaid from $10 with no subscription. On 2026-11-11 the lowest-priced security build costs $0.40 per million input tokens. ## Read next - [Claude Code Two environment variables point Claude Code at the Messages endpoint.](https://pentestllm.ai/agents/claude-code) - [OpenCode The opencode.json provider block for the security builds.](https://pentestllm.ai/agents/opencode) - [Best LLM for CTF How to choose a model per CTF category, with live prices for each tier.](https://pentestllm.ai/best-llm-for-ctf) - [Uncensored LLM for pentesting What abliterated and security-tuned builds change for authorized penetration testing.](https://pentestllm.ai/uncensored-llm-for-pentesting) Facts about other products and tools on this page were read from their own pages on 11 November 2026: [Claude Code docs: model configuration](https://code.claude.com/docs/en/model-config), [Claude Code docs: LLM gateways](https://code.claude.com/docs/en/llm-gateway). They change; check the source before relying on a figure. ## One key, from $10 PentestLLM is for systems you own or have written permission to test. The [acceptable use policy](https://pentestllm.ai/acceptable-use) says what is not allowed. [Get a key](https://app.pentestllm.ai/console) usage, 1,000 agent turns on Qwen3.8 27B Cybersecurity - Input, 8,000 tokens at $0.40 per million: $0.0032 - Output, 1,000 tokens at $2.40 per million: $0.0024 - One turn: $0.0056 - 1,000 turns: $5.60 output price per million tokens, 9 builds $1.3376 Gemma 4 26B A4B Cybersecurity OrcaCyber Zero 1.5 $18.75