---
title: "Vulnerability Research AI: Models for Code and CVE Work"
canonical: https://pentestllm.ai/vulnerability-research
generated: 2026-11-11T18:04:16.197Z
source: https://pentestllm.ai/vulnerability-research
base_url: https://api.pentestllm.ai/v1
---

![Rows of server cabinets in a data centre](https://pentestllm.ai/img/datacenter.webp)

## Research tasks the models take

- Code review: Read a file, a module or a diff for memory safety, injection, deserialization and access control problems, and point at the lines.
- Patch analysis: Compare the code before and after a fix and explain what the vulnerability was and which versions are affected.
- CVE reading: Explain an advisory in plain terms: the component, the precondition, the impact, and how to check whether a system you look after is exposed.
- Crash triage: Group fuzzer crashes by likely root cause from their stack traces and say which look exploitable enough to investigate first.
- Variant search: Given one confirmed bug, describe the pattern and list other places in the code base that match it.
- Advisory: Draft the advisory and the vendor report: description, affected versions, severity reasoning and fix guidance.

## Why the model’s attitude matters

Research is the study of how software fails, and a researcher has to discuss failure in detail. General assistants hedge or decline once a conversation moves from “is this a bug” to “what can it lead to”, which is the question that sets severity. The security builds here are tuned or abliterated to answer security questions other models decline, so the conversation continues. Refusals are reduced, not removed.

A model’s reading of code is a lead, not a result. It will miss bugs and it will report some that are not there. Confirm every claim in a debugger or a test before it goes into an advisory.

## Large inputs, sensible routing

Code review is input-heavy. `auto/security` sends requests with code blocks or more than 16,000 tokens to at least the balanced tier, and reasoning requests to the frontier tier, and bills each at the answering build’s price. For a multi-hour review, an `x-session-id` header keeps one build on the session for 30 minutes after its last request, so its understanding of the code base carries from question to question.

Terminal agents make this practical on a whole repository. The [OpenCode](https://pentestllm.ai/agents/opencode), [Claude Code](https://pentestllm.ai/agents/claude-code) and [aider](https://pentestllm.ai/agents/aider) guides each take a few minutes.

## Tools on the API side

Research means looking things up. Web search ($0.01 per search) and page fetch ($0.001 per page fetched) let the model read a vendor advisory or a commit itself, and the code sandbox ($0.05 per container-hour, 1-minute minimum) runs small test programs in Bash, JavaScript or Python. They run on the API side and are billed with the request, so they work from a plain script as well as from an agent.

## Authorization and disclosure

Reviewing open-source code, or software you have licensed, on your own machines is research you are generally entitled to do. Testing someone else’s running service is different and needs their written permission or a published program. PentestLLM is for the authorized kind, as the [acceptable use policy](https://pentestllm.ai/acceptable-use) sets out. When you find something real, report it to the vendor through their disclosure process before you publish.

## 9 security builds, priced per token

Read from the live catalog on 2026-11-11. Prices are US dollars per million tokens, paid from a prepaid balance that starts at $10. The id `auto/security` has no price of its own: each request is billed at the build that answered.

| Build | Input | Output | Context |
| --- | --- | --- | --- |
| [Qwen3.8 27B Cybersecurity](https://pentestllm.ai/models/qwen3.8-27b-cybersecurity) | $0.40 | $2.40 | 262,144 |
| [Gemma 4 26B A4B Cybersecurity](https://pentestllm.ai/models/gemma-4-26b-a4b-it-cybersecurity) | $0.4224 | $1.3376 | 262,144 |
| [GLM-5.3 Flash Cybersecurity](https://pentestllm.ai/models/glm-5.3-flash-cybersecurity) | $0.5093 | $1.6975 | 1,048,576 |
| [Red Team (Flash)](https://pentestllm.ai/models/uplink-red-team-flash) | $0.90 | $3.00 | not published |
| [Red Team (Pro)](https://pentestllm.ai/models/uplink-red-team-pro) | $1.50 | $6.00 | not published |
| [OrcaCyber MiniMax M3.1 Flash](https://pentestllm.ai/models/minimax-m3.1-flash-cybersecurity) | $2.00 | $4.00 | 261,632 |
| [OrcaCyber Qwen3.8 Flash Next](https://pentestllm.ai/models/orcacyber-qwen3.8-flash-next) | $2.00 | $4.00 | 261,632 |
| [Cyber Frontier](https://pentestllm.ai/models/cyber-frontier) | $5.25 | $15.75 | 1,048,576 |
| [OrcaCyber Zero 1.5](https://pentestllm.ai/models/orca-zero-1.5-cybersecurity) | $7.50 | $18.75 | 999,488 |

[Full price list and tool fees](https://pentestllm.ai/pricing) · [Every model](https://pentestllm.ai/models) · [API docs](https://pentestllm.ai/docs)

## Questions

- It finds some, especially well-known bug classes in readable code, and it is useful for narrowing where to look. It also produces false positives and misses subtle bugs, so its output is a list of leads to confirm.
- As much as the build’s context window holds. The largest listed today is 1M tokens. An agent can also walk a repository file by file.
- The security builds answer security questions other models decline, including how severe a confirmed bug is and why. They still refuse sometimes, and the acceptable use policy applies to every request.
- Yes. Give it the advisory and, where available, the patch, and it explains the flaw, the affected versions and how to check exposure on systems you manage.
- Per token from a prepaid balance, minimum top-up $10. On 2026-11-11 input prices for security builds start at $0.40 per million tokens, and the pricing page lists each build.

## Read next

- [Bug bounty Models for scope reading, recon notes, code review and report drafting on programs you are enrolled in.](https://pentestllm.ai/bug-bounty)
- [Malware analysis Models for static triage, behaviour summaries and detection rules. Analysis and detection only.](https://pentestllm.ai/malware-analysis)
- [CTF Models that reason through web, crypto, reversing, forensics and pwn challenge categories.](https://pentestllm.ai/ctf)
- [Cybersecurity AI Models for security teams, defensive and offensive, on one prepaid key.](https://pentestllm.ai/cybersecurity-ai)

## One key, from $10

PentestLLM is for systems you own or have written permission to test. The [acceptable use policy](https://pentestllm.ai/acceptable-use) says what is not allowed.

[Get a key](https://app.pentestllm.ai/console)

usage, 1,000 agent turns on Qwen3.8 27B Cybersecurity

- Input, 8,000 tokens at $0.40 per million: $0.0032
- Output, 1,000 tokens at $2.40 per million: $0.0024
- One turn: $0.0056
- 1,000 turns: $5.60

output price per million tokens, 9 builds

$1.3376 Gemma 4 26B A4B Cybersecurity OrcaCyber Zero 1.5 $18.75