Unrestricted AI, and its limits

Training

The model itself was trained to decline certain subjects. This is the layer that abliteration and security tuning change.

Platform terms

The service a model runs on says what it may be used for. Those terms exist here too.

Scope

The client’s rules of engagement say which systems you may touch, when and how.

Law

Testing a system without permission is illegal in most places, whatever tool produced the plan.

When people say an AI is restricted, they are usually describing one of these four layers without separating them. The distinction matters, because an unrestricted model changes only the first.

The builds on this API have the training layer reduced. Security builds are tuned on the field’s material and answer as an analyst would. Abliterated builds have the refusal direction edited out of their weights. In both cases the model stops treating the subject of security as a reason to decline, so an ordinary working question gets a working answer.

In practice that covers the reading and writing that fills an engagement: ranking scanner findings, explaining what an advisory affects, reviewing code for vulnerability classes, mapping findings to CWE and ATT&CK, drafting the report, writing detection rules for the blue team, and reasoning through CTF challenges.

Acceptable use

The service is for lawful work on systems you own or have written permission to test. The policy lists what is never allowed, including unauthorized access, fraud and attacks on critical infrastructure.

Enforcement

A key can be suspended until proof of authorization is shown, and accounts that break the policy can be closed.

Residual refusals

A build can still decline. Refusals are reduced, not zero, and no page on this site promises otherwise.

Rate limits

Each key has a request rate limit, lower in an account’s first day.

Four things stay, and a tester should want them to.

A security firm’s work is defined by permission. The same activity is a service on one side of a signed scope and an offence on the other. A model provider that claimed to have no boundaries at all would be a liability in a supplier review, and a risk to the testers who depend on the key staying live. Stated limits are what let a consultancy put the tool in a methodology document and a client accept it.

It also keeps the claim honest. “Unrestricted” on a landing page often means a stock model behind a system prompt, which holds until the provider changes something. Here the change is in the build, and the remaining limits are written down.

A model that answers everything also guesses at everything. It can cite a version that was never affected, misread a diff, or describe a tool flag that does not exist. Treat its output as a draft from a fast junior colleague: useful, and checked before it reaches a client or a target. Keep a human approving anything an agent proposes to run.

Requests go to https://api.pentestllm.ai/v1 with a prepaid key, and the smallest top-up is $10 by card. Send auto/security to let the router choose among the 9 security builds, or pick one from the table below. Uncensored AI covers the wider term, and the red team and bug bounty pages describe the work by role.