Jailbreak prompt or abliterated build
A jailbreak is text added to a request to talk a stock model out of its refusal training, and it works some of the time until the model is updated. An abliterated or security-tuned build has the change in its weights, so for authorized testing it is the steadier choice and you do not need a jailbreak at all.
curl https://api.pentestllm.ai/v1/chat/completions \
-H "Authorization: Bearer sk-ptl-live-…" \
-H "Content-Type: application/json" \
-d '{
"model": "auto/security",
"messages": [{"role": "user", "content": "Rank these scanner findings by severity and say what to verify first."}]
}'
This page contains no jailbreak prompts
If you arrived looking for prompt text, there is none here, and the argument of the page is that a tester does not need any. A jailbreak tries to change a model’s behaviour from the outside, through its input. The alternative is to use a model whose behaviour was changed on the inside, by its builder, and sold that way.
Security teams already know jailbreaking from the other side of the table. The OWASP list of risks for LLM applications files it under prompt injection, as an attack to defend against. Depending on that same attack to get daily work done means building on something the model’s provider is working to break.
Where each approach keeps the change
- Location
- A jailbreak lives in the prompt you send. An abliterated build carries the change in its weights.
- What you send
- With a jailbreak, your request plus extra text on every turn. With a build, your request.
- Model updates
- A hosted model is retrained against known jailbreaks without notice. A build is a fixed set of weights under its own id.
- Call to call
- A jailbreak shifts the odds, so the same request passes once and fails the next time. A build’s refusal behaviour does not hang on the wording around the request.
- Terms
- Hosted assistants forbid bypassing their safeguards. A build with reduced refusals is used as sold, under its own acceptable use policy.
- Cost
- Jailbreak text is billed as input tokens on every request. A build has nothing extra to carry.
Why instability hurts most in an agent
A person in a chat window can notice a refusal and try again. An agent cannot do that gracefully. It sends dozens or hundreds of requests in a run, each with fresh tool output in it, and the refusal training is still present in a jailbroken model on every one of them. One decline in the middle and the agent stalls, loops or reports failure, with the tokens already spent.
Long sessions make it worse, because a model that was talked out of refusing tends to drift back as the conversation grows. A tester running an overnight job wants the last request handled like the first. Fixed weights give that, and a prompt does not.
The compliance problem with jailbreaks
Consultancies answer questions about their tooling: which services see client data, under what terms, with what risk of interruption. A workflow that depends on defeating a provider’s safeguards fails that review twice. It breaches the provider’s terms, so the account can be closed mid-engagement, and it cannot be written into a methodology without admitting the breach.
A model that is sold for security work has no such gap. The terms say what it is for, and your use matches them.
What a build does not fix
An abliterated or security-tuned build is steadier, not absolute. A few refusals survive the edit, so the accurate claim is reduced refusals, not zero. The model is no more accurate than its base and still needs checking. And the build changes nothing about authorization: the service is for lawful work on systems you own or have written permission to test.
Making the switch
Remove the workaround text from your prompts, point the client at https://api.pentestllm.ai/v1, and write the request as you would put it to a colleague. Use auto/security for the security builds, or pick an abliterated build from the table below. What is abliteration explains the weight edit, and unrestricted AI sets out which limits remain.
33 abliterated builds, priced per token
Read from the live catalog on 2026-11-12. Prices are US dollars per million tokens, paid from a prepaid balance that starts at $10. The id auto/security has no price of its own: each request is billed at the build that answered.
Questions
Input text meant to make a model ignore its refusal training. The model itself is unchanged, so the effect is unreliable and ends when the provider updates the model.
No. The refusal direction was removed from the weights, so there is nothing for a prompt to work around. Send the request plainly.
Generally yes. Hosted assistants forbid bypassing their safeguards, and an account used that way can be closed. Read the terms of any service you rely on for client work.
Yes for refusal behaviour, because the change is in fixed weights and does not depend on the wording of each request. Its answers still vary in the normal way and still need checking.
No. PentestLLM does not publish jailbreak prompts. It serves builds with reduced refusals for authorized security work, which removes the need for one.
Occasionally. Refusals are reduced, not removed, and any build can still decline a request.
Read next
- What is abliterationHow the refusal direction is removed from a model’s weights, and what that changes in practice.
- Abliterated modelsHosted abliterated builds by API, with no weights to download or GPU to rent.
- Unrestricted AIWhat unrestricted AI means for security testers, and where its limits still are.
- Claude Code and security researchWhat to do when a coding agent declines authorized security work: change the model endpoint.
One key, from $10
PentestLLM is for systems you own or have written permission to test. The acceptable use policy says what is not allowed.
- Input, 8,000 tokens at $0.40 per million
- $0.0032
- Output, 1,000 tokens at $2.40 per million
- $0.0024
- One turn
- $0.0056
- 1,000 turns
- $5.60