The model API built for authorized red teaming.
One endpoint for the models security teams actually test with — abliterated models for breadth, frontier open models for realism — with per-token pricing and an authorized-use policy stated up front.
// model access is tied to the acceptable-use policy; previews are not on sale until resale contracts are signed
The adversary's toolbox already shipped
No futurism — only things that have already happened, each with a public source. Offensive capability no longer depends on a human writing the exploit, and defenders need harnesses that can exercise it.
AI found a new zero-day in real software
Google Big Sleep (Project Zero × DeepMind) used an LLM for variant analysis and surfaced a previously unknown exploitable vulnerability in SQLite — widely cited as the first AI-found zero-day in widely used software.
source: Project Zero ↗AI took DARPA's $4M cyber-challenge prize
At the AIxCC finals, Team Atlanta's system found and fixed vulnerabilities in real open-source code fully automatically, against a $29.5M cumulative prize pool.
source: DARPA ↗No robotics background + Claude = a robot in a day
In Project Fetch, the team with model access got a quadruped autonomously seeking objects the same day; human–AI pairs iterated roughly 20× faster than the manual-only team.
source: Anthropic Research ↗94% of tested AI agents fall to prompt injection
Straiker's agent testing broke 94% via prompt injection; a 78-study review found every tested coding agent reachable on a credential-theft path. The capability is now table stakes.
source: Straiker ↗Six attack classes, one endpoint
LLM systems turned natural language into the instruction boundary — one that auth, WAFs and sandboxes do not cover. These are the classes our models are used to exercise, aligned with the OWASP LLM Top 10.
Direct & indirect prompt injection
A few lines in a web page, ticket or document hijack the agent's next steps — models cannot reliably separate data from instruction.
MCP & tool-chain poisoning
Malicious tool descriptions and rug-pull instructions ride in with “just install a plugin”, then cross-contaminate other servers in the session.
Long-term memory poisoning
One injection written into agent memory executes on every later session — the attacker is long gone.
Exfiltration via legitimate tools
Induced calls to normal-looking log, summary and share tools wrap sensitive data into ordinary traffic on the way out.
Confused deputy
Agents act with the user's full credential set. One successful injection ≈ account takeover, inside a session the user started.
Agentic spending & signing
When agents can order, transfer and sign, an injected instruction converts directly into funds loss.
Two kinds of models, one base URL
Abliterated models give your harness breadth — fewer refusals to work around while probing. Frontier open models add realism when you need stock-like behavior in the loop. Same endpoint, same SDK, per-token billing from the catalog.
| LINEUP | MODELS | ROLE IN A HARNESS |
|---|---|---|
| Abliterated | 5 | Breadth — fewer refusals mid-probe |
| Frontier open | 5 | Realism — stock-like behavior |
Get a key
Sign in to the console, create an API key, top up with Stripe.
Change one line
Point the OpenAI SDK's base_url at the router — Python or Node, nothing else moves.
Call by model id
Public names like openai/gpt-oss-120b@groq; streaming and tool calling included.
Your harness deserves models that answer.
One key, one base URL, per-token pricing. Start with the migration guide — it is a one-line change.