AI models for CTF players
CTF AI is a language model used as a teammate in capture-the-flag events: it reads challenge files, explains unfamiliar formats and reasons through a category with you. PentestLLM offers 9 security-tuned builds by API, which engage with CTF material that general coding assistants often decline.
curl https://api.pentestllm.ai/v1/chat/completions \
-H "Authorization: Bearer sk-ptl-live-…" \
-H "Content-Type: application/json" \
-d '{
"model": "auto/security",
"messages": [{"role": "user", "content": "Rank these scanner findings by severity and say what to verify first."}]
}'
What a model does for a CTF team
- Orientation
- Describe what a challenge file is, what tools read it, and what the author is probably testing.
- Reading
- Summarize long decompiler output, a packet capture rendered as text, or a sprawling source tree.
- Reasoning
- Work through the mathematics of a crypto scheme or the logic of a state machine step by step.
- Scripting
- Write the parsing and glue code around your idea, and run it in a sandbox.
- Notes
- Keep a shared log of what the team tried, so nobody repeats a dead end at 3 a.m.
- Write-ups
- Turn the log into a clean write-up after the event.
The guide to choosing an LLM for CTF goes category by category.
The refusal problem, specifically
CTF tasks look like attacks because they are practice attacks. A general assistant cannot see that the target is a container the organizers built to be broken, so it declines, or it answers the first question and stops at the second. Players on agent tools see this as runs that halt partway.
The builds here are tuned or abliterated to answer security questions other models decline. They refuse far less often; they do not refuse never. They also make mistakes with confidence, as every model does, so check a claimed solution before you trust it.
Speed and price during an event
An event is a burst: many short questions, a few very long ones. auto/security handles that shape by sending short questions to a fast build and reasoning-heavy ones to a frontier build, each at its own price. An x-session-id per challenge keeps one build on the thread. If the team shares a balance, "auto": {"tier_max": "balanced"} in the request keeps routine turns off the most expensive tier.
The code sandbox on the API side runs Bash, JavaScript and Python ($0.05 per container-hour, 1-minute minimum), which is handy on a laptop you would sooner keep clean.
Learning, not only winning
Most people play CTFs to learn. A model is a patient explainer: ask why a technique works, what the defence is, and how the same flaw shows up in real software. After the event, feed it your notes and the official write-up and ask what you missed. Used that way it is closer to a tutor than a solver, and the skills stay with you.
Rules and scope
Read the event rules before using a model: many CTFs allow AI help, some limit it and some forbid it. Keep to the challenge infrastructure the organizers put in scope and leave the scoreboard and other teams alone. PentestLLM is for authorized work, and a CTF’s rules are the authorization; the acceptable use policy spells it out. Setup takes a few minutes with the OpenCode guide.
9 security builds, priced per token
Read from the live catalog on 2026-11-11. Prices are US dollars per million tokens, paid from a prepaid balance that starts at $10. The id auto/security has no price of its own: each request is billed at the build that answered.
| Build | Input | Output | Context |
|---|---|---|---|
| Qwen3.8 27B Cybersecurity | $0.40 | $2.40 | 262,144 |
| Gemma 4 26B A4B Cybersecurity | $0.4224 | $1.3376 | 262,144 |
| GLM-5.3 Flash Cybersecurity | $0.5093 | $1.6975 | 1,048,576 |
| Red Team (Flash) | $0.90 | $3.00 | not published |
| Red Team (Pro) | $1.50 | $6.00 | not published |
| OrcaCyber MiniMax M3.1 Flash | $2.00 | $4.00 | 261,632 |
| OrcaCyber Qwen3.8 Flash Next | $2.00 | $4.00 | 261,632 |
| Cyber Frontier | $5.25 | $15.75 | 1,048,576 |
| OrcaCyber Zero 1.5 | $7.50 | $18.75 | 999,488 |
Questions
It solves some easy ones outright and helps a great deal with reading, scripting and reasoning on harder ones. It also gets things confidently wrong, so a player still has to verify each step.
General models are trained to be cautious about offensive security and cannot tell a practice target from a real one. Security-tuned builds are adjusted to answer these questions, which reduces refusals without removing them.
Reversing and forensics, where the work is reading large outputs, and web, where it is reading source and responses. Crypto and pwn benefit from a frontier-tier build that reasons step by step.
That depends on the event. Read the rules; many allow AI assistance, some restrict it and some ban it.
Billing is per token from a prepaid balance with a $10 minimum top-up. On 2026-11-11 input prices for security builds start at $0.40 per million tokens.
Read next
- Best LLM for CTFHow to choose a model per CTF category, with live prices for each tier.
- Bug bountyModels for scope reading, recon notes, code review and report drafting on programs you are enrolled in.
- Vulnerability researchModels for code review, CVE and patch analysis, and advisory writing.
- OpenCodeThe opencode.json provider block for the security builds.
One key, from $10
PentestLLM is for systems you own or have written permission to test. The acceptable use policy says what is not allowed.
- Input, 8,000 tokens at $0.40 per million
- $0.0032
- Output, 1,000 tokens at $2.40 per million
- $0.0024
- One turn
- $0.0056
- 1,000 turns
- $5.60