Qwen abliterated builds, by API
Qwen abliterated builds are modified versions of Alibaba’s open-weights Qwen models with the refusal behaviour removed, and PentestLLM serves them by API beside uncensored and cybersecurity-tuned Qwen builds. They run on one prepaid key from $10, billed per token, for authorized security testing only.
from openai import OpenAI
client = OpenAI(base_url="https://api.pentestllm.ai/v1", api_key="sk-ptl-live-…")
reply = client.chat.completions.create(
model="auto/security",
messages=[{"role": "user", "content": "Explain this advisory and list what to check on an affected host."}],
)
print(reply.model) # the build that answered
print(reply.choices[0].message.content)
The Qwen builds in the catalog
- Abliterated
- The refusal direction removed from the weights of a Qwen 2.5 or Qwen 3.8 model, with no retraining.
- Derestricted
- Community tunes on Qwen 3.5, abliterated with a later method that aims to leave the model’s other behaviour closer to the original.
- Cybersecurity
- Qwen 3.8 builds fine-tuned on security material. These carry the security label on the models page.
- Uncensored
- A looser label on builds across the family, from mid-size models to the Coder, vision and Max lines, including fast and thinking variants.
That is the picture as of November 2026, and Qwen is the widest family here. All of these are built on Qwen by community authors or third parties; none is a release by the Qwen team. The table on this page is filled from the live catalog and is the record of what is listed today. Some of the large uncensored rows, the Coder and vision builds among them, are billed per request, not per token; the table shows that flat fee in place of the token rates.
Why Qwen suits security tooling
Qwen’s strength is code. The family has had dedicated Coder models for several generations, and the general models inherit much of that: they read unfamiliar source quickly, follow a data flow across files, and write the small scripts a tester needs, such as a parser for tool output or a harness for a lab target. That makes a Qwen build a sound default for code review, for explaining what a public proof of concept does, and for drafting detection rules from observed behaviour.
The mid-size builds are quick enough for bulk work such as scan triage, and several current rows have context windows long enough for a full scan export or a large log extract. The thinking variants trade speed for a reasoning pass, which helps on CTF problems with several steps.
Abliterated or cybersecurity-tuned?
They solve different problems. Abliteration removes the reflex to decline and adds no knowledge: the model answers the question with whatever it already knew about the subject. A cybersecurity tune is trained on security material, so it uses the field’s vocabulary, knows the common tools and frameworks, and answers the way an analyst would. It also declines less, because the tuning data contains the questions a general model avoids.
For pentest work the tuned builds are usually the better first choice. The abliterated ones are a good second opinion, and a fit for tasks that are mostly programming with a security subject. Either way the honest description is reduced refusals, not zero. Uncensored LLMs for pentesting goes through the methods in more detail.
Tool calls and structured output
Qwen is the family to look at if the build has to drive an agent. As of November 2026 the cybersecurity builds publish tool calling and a reasoning parameter, one of them also publishes structured output against a JSON schema, and one derestricted tune publishes tools as well. The plain abliterated rows do not publish tool calling, so use them for chat-shaped work.
Every row lists both the OpenAI-format chat completions endpoint and the Anthropic-format Messages endpoint. In practice the same build can sit behind OpenCode, Cline, aider or Cursor on the OpenAI side and behind Claude Code on the Anthropic side. The request at the top of this page uses the OpenAI Python client; replace auto/security with a build id from the table to pin one.
Compared with running Qwen weights locally
Qwen is one of the easier families to host yourself. A 27B or 32B build fits a single 24 GB card once quantized to 4 bits, with limited room left for context, and the abliterated weights are on Hugging Face in ready-made quantized files. If you have the card and the work must stay offline, that is a reasonable setup.
The API earns its place in three cases. The first is context: a long window costs GPU memory you may not have. The second is the larger builds, which do not fit a workstation at all. The third is upkeep: Qwen releases often, the community abliterates each release again, and keeping a local copy current means repeating the download, the quantization choice and your own testing. Here you change a model id. The trade is that prompts leave your machine, so check what your engagement rules allow.
Distills, and when to choose another family
Some rows in the table carry a DeepSeek name. They are DeepSeek reasoning distilled into Qwen weights, so they match both families and appear on the DeepSeek page too. If you want a different style of reasoning, or a second model to check a finding against, the GLM and Gemma pages list their own cybersecurity builds. All of them fall under the acceptable use policy: lawful work, on systems you own or have written permission to test.
21 Qwen builds, priced per token
Read from the live catalog on 2026-11-12. Prices are US dollars per million tokens, paid from a prepaid balance that starts at $10. The id auto/security has no price of its own: each request is billed at the build that answered.
Questions
Yes. PentestLLM serves abliterated, derestricted, uncensored and cybersecurity-tuned builds built on Qwen through OpenAI-compatible and Anthropic-compatible endpoints, billed per token from a prepaid balance.
Start with a cybersecurity-tuned Qwen build, because it is trained on security material and publishes tool calling. Use an abliterated build when the task is mostly programming or writing, or as a second opinion.
As of November 2026 the cybersecurity-tuned Qwen builds and one derestricted tune publish tool calling. The plain abliterated rows do not, so check the supported parameters on a build’s model page before wiring it into an agent.
No. They are community or third-party modifications built on the open Qwen weights, not releases by the Qwen team.
Yes, the mid-size builds fit a 24 GB GPU when quantized to 4 bits. The API is the easier route when you need a long context window or a larger build, or do not want to maintain weights.
People doing authorized security work: systems they own, engagements under a signed scope, bug bounty programs they are enrolled in, CTF events and labs. The acceptable use policy lists what is not allowed.
Read next
- DeepSeek abliteratedThe DeepSeek uncensored and abliterated builds served by API, with live prices.
- GLM abliteratedThe GLM uncensored, abliterated and cybersecurity builds served by API, with live prices.
- Abliterated modelsHosted abliterated builds by API, with no weights to download or GPU to rent.
- Uncensored LLM for pentestingWhat abliterated and security-tuned builds change for authorized penetration testing.
One key, from $10
PentestLLM is for systems you own or have written permission to test. The acceptable use policy says what is not allowed.
- Input, 8,000 tokens at $0.40 per million
- $0.0032
- Output, 1,000 tokens at $2.40 per million
- $0.0024
- One turn
- $0.0056
- 1,000 turns
- $5.60