Uncensored LLMs for pentesting
An uncensored LLM for pentesting is a model whose refusal behaviour has been reduced, by abliteration or by security tuning, so it answers the offensive security questions a general assistant declines. PentestLLM hosts 9 security builds and the abliterated builds beside them behind one API key, for authorized testing only.
curl https://api.pentestllm.ai/v1/chat/completions \
-H "Authorization: Bearer sk-ptl-live-…" \
-H "Content-Type: application/json" \
-d '{
"model": "auto/security",
"messages": [{"role": "user", "content": "Rank these scanner findings by severity and say what to verify first."}]
}'
Three ways a model becomes “uncensored”
- Abliteration
- The direction in the weights that produces refusals is found and removed. The model keeps its knowledge and stops declining by reflex.
- Security tuning
- The model is fine-tuned on security material, so it answers as an analyst would and knows the vocabulary of the field.
- System prompt
- A stock model is told to behave differently. This is the weakest method: the refusal training is still there and returns under pressure.
The models page labels each build as security or abliterated. The security builds are the default for pentest work; the abliterated general builds are useful when the task is mostly coding or writing with a security subject.
Why refusals matter more in an agent
In a chat window a refusal costs one retry. In an agent loop it can end the run: the model declines a step, the agent reports failure or wanders, and the tokens spent so far are wasted. Testers who run OpenCode, Claude Code or a PentestGPT-style assistant feel this most, because the agent sends many small requests and any one of them can trip a refusal.
A build tuned for security work declines far less often, so the loop keeps moving. It still refuses sometimes. Treat “reduced refusals” as the honest description and keep a human reviewing what the agent proposes to run.
What uncensored does not mean
It does not mean anything goes. The acceptable use policy applies to every request: the work has to be lawful, and the systems have to be yours or covered by written permission. It also does not mean the model is right. An abliterated model will answer a question it would once have declined, and that answer still needs checking against the target, the documentation and your own judgment.
Picking a build for a pentest
Start with auto/security. The router sends short questions to a fast build, requests with tools or code to a balanced build, and reasoning-heavy requests to a frontier build, each billed at its own price. If you want one voice for a whole engagement, send an x-session-id header and the same build keeps answering that session for 30 minutes after its last request.
For long inputs such as a full scan export or a large source file, check the context window on the build’s page; the largest listed today is 1M tokens. For agent use, pick a build that takes tool calls. The live table below has every security build with its price.
Running it where you work
The endpoint is OpenAI-compatible at https://api.pentestllm.ai/v1 and also accepts Anthropic-format requests, so it drops into existing tools. The OpenCode guide and the Claude Code guide take a few minutes each, and the Kali MCP guide covers driving tools on a Kali machine you control.
9 security builds, priced per token
Read from the live catalog on 2026-11-11. Prices are US dollars per million tokens, paid from a prepaid balance that starts at $10. The id auto/security has no price of its own: each request is billed at the build that answered.
| Build | Input | Output | Context |
|---|---|---|---|
| Qwen3.8 27B Cybersecurity | $0.40 | $2.40 | 262,144 |
| Gemma 4 26B A4B Cybersecurity | $0.4224 | $1.3376 | 262,144 |
| GLM-5.3 Flash Cybersecurity | $0.5093 | $1.6975 | 1,048,576 |
| Red Team (Flash) | $0.90 | $3.00 | not published |
| Red Team (Pro) | $1.50 | $6.00 | not published |
| OrcaCyber MiniMax M3.1 Flash | $2.00 | $4.00 | 261,632 |
| OrcaCyber Qwen3.8 Flash Next | $2.00 | $4.00 | 261,632 |
| Cyber Frontier | $5.25 | $15.75 | 1,048,576 |
| OrcaCyber Zero 1.5 | $7.50 | $18.75 | 999,488 |
Questions
A model whose refusal direction has been removed from its weights. It keeps what it knows and stops declining by reflex, without a system prompt doing the work.
Using one is a tooling choice. What matters is authorization: test only systems you own or have written permission to test, and follow the acceptable use policy of the service you use.
No. Security-tuned and abliterated builds refuse far less often than general assistants, but any model can still decline a request. The accurate description is reduced refusals.
Some open-weight security and abliterated models can be run on your own GPU. The API is for people who would sooner pay per token than run the hardware, and who want the larger builds that do not fit on a workstation.
The smallest top-up is $10, by card or crypto, with no subscription. On 2026-11-11 the lowest-priced security build costs $0.40 per million input tokens.
Read next
- Hacker AISecurity-tuned models by API for ethical hacking and authorized testing.
- PentestGPT alternativeThe model endpoint to run PentestGPT on, or to use in place of a chat subscription.
- OpenCodeThe opencode.json provider block for the security builds.
- Red teamModels for authorized adversary emulation: planning, tooling review, detection notes and reporting.
One key, from $10
PentestLLM is for systems you own or have written permission to test. The acceptable use policy says what is not allowed.
- Input, 8,000 tokens at $0.40 per million
- $0.0032
- Output, 1,000 tokens at $2.40 per million
- $0.0024
- One turn
- $0.0056
- 1,000 turns
- $5.60