AI models for red teams
Red team AI is a language model that supports an authorized adversary emulation exercise: it helps plan against a threat profile, reads tooling output, keeps the operator log readable and drafts the report. PentestLLM gives a red team 9 security-tuned builds on one prepaid API key, usable from the agents and scripts the team already runs.
curl https://api.pentestllm.ai/v1/chat/completions \
-H "Authorization: Bearer sk-ptl-live-…" \
-H "Content-Type: application/json" \
-d '{
"model": "auto/security",
"messages": [{"role": "user", "content": "Rank these scanner findings by severity and say what to verify first."}]
}'
Where a model fits in an exercise
- Planning
- Turn a threat intelligence report into an emulation plan mapped to MITRE ATT&CK techniques, with the objectives and constraints from the rules of engagement.
- Tooling review
- Read the output of the team’s own tools and say what it shows, what it does not, and what to confirm by hand.
- Operator log
- Rewrite raw timestamped notes into a clean activity log the white cell and the client can follow.
- Detection notes
- For each action taken, describe the telemetry it should have produced and a rule the blue team could write.
- Reporting
- Draft the narrative, the findings and the remediation plan in the firm’s template.
- Purple sessions
- Explain a technique to defenders at the level they need to tune a control.
Why general assistants fall short here
Red team work is offensive by definition, and general assistants are trained to back away from it. An operator who asks a stock model to explain the technique in a threat report, or to review a tool’s behaviour before an exercise, often gets a lecture instead of an answer. In an agent loop the same refusal ends the run.
The security builds here are tuned or abliterated to answer the questions other models decline. That is reduced refusals, not zero, and it does not replace operator judgment: the model proposes, a person decides what runs against a client’s estate.
Built for teams that script things
The API is OpenAI-compatible at https://api.pentestllm.ai/v1 and also takes Anthropic-format requests, so it works from internal tooling, from a C2 operator’s note-taking script, or from a terminal agent. The id auto/security routes each request to a fast, balanced or frontier build by what it carries. An x-session-id header keeps one build on a session for 30 minutes after its last request, which keeps the voice of an operator log consistent.
Server-side tools are there when a workstation is locked down: web search ($0.01 per search), page fetch ($0.001 per page fetched) and a code sandbox ($0.05 per container-hour, 1-minute minimum). Long inputs fit too; the largest context window listed today is 1M tokens.
Keeping the exercise inside its rules
Every red team exercise has rules of engagement: scope, timing, forbidden actions and an escalation path. Put them in the system prompt so the model’s suggestions respect them, and keep the signed copy where you can show it. PentestLLM is for systems you own or have written permission to test, and the acceptable use policy says a key may be suspended until proof of authorization is shown.
Decide with the client what data may leave their network before any of it goes into a prompt. The privacy page states what the service keeps.
Cost of a typical week
Usage is billed per token. Planning and reporting are light; agent runs that re-send long tool output are where tokens go, so the input price matters most. The table below is the live catalog on 2026-11-11, and the pricing page has the same figures with the tool fees. Start from $10 and see what a real week uses.
9 security builds, priced per token
Read from the live catalog on 2026-11-11. Prices are US dollars per million tokens, paid from a prepaid balance that starts at $10. The id auto/security has no price of its own: each request is billed at the build that answered.
| Build | Input | Output | Context |
|---|---|---|---|
| Qwen3.8 27B Cybersecurity | $0.40 | $2.40 | 262,144 |
| Gemma 4 26B A4B Cybersecurity | $0.4224 | $1.3376 | 262,144 |
| GLM-5.3 Flash Cybersecurity | $0.5093 | $1.6975 | 1,048,576 |
| Red Team (Flash) | $0.90 | $3.00 | not published |
| Red Team (Pro) | $1.50 | $6.00 | not published |
| OrcaCyber MiniMax M3.1 Flash | $2.00 | $4.00 | 261,632 |
| OrcaCyber Qwen3.8 Flash Next | $2.00 | $4.00 | 261,632 |
| Cyber Frontier | $5.25 | $15.75 | 1,048,576 |
| OrcaCyber Zero 1.5 | $7.50 | $18.75 | 999,488 |
Questions
A language model used to support authorized adversary emulation: planning against a threat profile, reviewing tooling output, writing detection notes and drafting the report. It assists operators and does not replace them.
No. AI red teaming usually means testing AI systems for failures. This page is about red teams that test organizations and use a model as a working tool.
Far less often than general assistants. The builds are tuned or abliterated to answer security questions other models decline. Expect reduced refusals, not none.
Yes. Ask for technique identifiers with each planned action or finding and check them against the current matrix, since any model can misremember an identifier.
From a prepaid balance, per token, with a minimum top-up of $10 by card or crypto. There is no seat licence. On 2026-11-11 input prices for security builds start at $0.40 per million tokens.
Read next
- Bug bountyModels for scope reading, recon notes, code review and report drafting on programs you are enrolled in.
- Vulnerability researchModels for code review, CVE and patch analysis, and advisory writing.
- Kali MCPmcp-kali-server on Kali, driven by a security build through an MCP client.
- Hacker AISecurity-tuned models by API for ethical hacking and authorized testing.
One key, from $10
PentestLLM is for systems you own or have written permission to test. The acceptable use policy says what is not allowed.
- Input, 8,000 tokens at $0.40 per million
- $0.0032
- Output, 1,000 tokens at $2.40 per million
- $0.0024
- One turn
- $0.0056
- 1,000 turns
- $5.60