Best uncensored AI models for authorized security testing (2026)

Search interest in uncensored AI keeps climbing, and most public listicles focus on roleplay or consumer chat apps. This guide serves a different reader: the security engineer running an authorized red-team harness who needs reduced-refusal model tiers behind a programmable OpenAI-compatible API. For the weight-level mechanics of refusal removal, see what is abliteration; here we focus on model selection, public benchmark evidence, and harness verification.

Selection criteria that matter for harness work

• Refusal behavior under adversarial prompts, measured directly against your own domain corpus.
• Tool calling and strict-JSON compliance, because multi-step agent loops fail when a model drops required schema keys. Orthogonalized weights can loosen output formatting; verify JSON adherence before committing a tier to production.
• Context window and max output budget, which bound multi-turn attack chains, full-file diffs, and PoC synthesis.
• Per-token pricing, since automated vulnerability sweeps are bursty and seat-based subscriptions sit idle between engagements.

Specs, pricing, and Vals AI benchmarks at a glance

All three public UNST33R tiers sit behind a single OpenAI-compatible endpoint (https://api.unst33r.si/v1) with per-token pricing. Public benchmark scores below come from independent evaluations of the upstream base models on Vals AI (checked October 2026):

Refusal removal suppresses alignment guardrails while preserving the base model's underlying reasoning and coding profile. Always validate strict tool-call JSON formatting on your own harness (OpenClaw, Hermes, or custom scripts).

Per-tier detail

unst33r-flash: the high-throughput loop model

Built on the uncensored GLM-5.3-Flash checkpoint at $0.50 input / $1.50 output per 1M tokens, unst33r-flash is the default entry tier for iterative agent work: surface enumeration, log parsing, first-pass report normalization, and drafting candidate payloads. It scores 67.86% on CyberBench v1.1 and 37.37% on Terminal-Bench 4.0 at a fraction of the reasoning tier's cost.

The main boundary is multi-hop depth. On 20-step shell sessions or subtle state-machine bugs, smaller models can loop on failed commands sooner than unst33r-pro. Design your harness runbook with explicit tier escalation: run breadth recon and initial triage on unst33r-flash, and promote stalled chains to unst33r-pro.

unst33r-deepseek: the code and PoC specialist

Built on the abliterated DeepSeek-V4.1-Flash checkpoint at $1.20 input / $3.20 output per 1M tokens, unst33r-deepseek leads the lineup on code-heavy benchmarks: 73.69% on CyberBench v1.1 (finishing OSS-Fuzz crash reproduction and patching in roughly half the wall-clock time of GLM-5.3) and 69.80% (#1 of 35 models) on SkillsBench. It also offers a 1M token context window and a 384k token output ceiling (launch details), allowing a single completion to emit an entire multi-file patch or exploit harness. Pair it with a separate family (unst33r-pro) when judging its output so evaluation does not inherit family-specific blind spots.

unst33r-pro: the deep-reasoning reserve

Built on the full uncensored GLM-5.3 checkpoint at $2.50 input / $4.50 output per 1M tokens, unst33r-pro leads on Terminal-Bench 4.0 (38.89%) and scores 72.08% on CyberBench v1.1. Reserve it for long-horizon interactive shell workflows, multi-agent planner roles, and final adjudication of ambiguous findings where per-turn reasoning depth outweighs token price.

Uncensored vs. abliterated, in one paragraph

Uncensored is the umbrella term for any low-refusal model variant. Abliteration is a weight-editing method: compute the dominant refusal direction from contrastive prompt activations and project it out of the residual-stream weights, producing a standard checkpoint that runs on unmodified inference engines without safety-tuning dataset drift.

Measure refusal and format rates on your own corpus

Public leaderboards measure base capability; a 30-probe smoke test measures how each reduced-refusal tier behaves on your exact prompts:

1. Assemble a two-direction probe set. Combine 15 authorized adversarial prompts from your engagement scope with 15 benign lookalike prompts (such as defensive log queries containing exploit strings). False refusals on benign security data break automated pipelines just as quickly as refusals on offensive probes.
2. Version and hash the probe file. Store the SHA-256 of your JSONL corpus inside every evaluation output so week-over-week runs remain comparable.
3. Score with a separate judge family. Route judging to a different model family than the target under test; see the scorer setup in running PyRIT against a multi-model router or use the multilingual refusal detector.
4. Track three metrics together. Record adversarial refusal rate, benign false-refusal rate, and strict-JSON schema pass rate per tier.

You can sweep all three tiers across a single probe from the terminal by looping over the model ID:

for tier in unst33r-flash unst33r-deepseek unst33r-pro; do
  curl -sS https://api.unst33r.si/v1/chat/completions \
    -H "Authorization: Bearer $UNST33R_API_KEY" \
    -H "Content-Type: application/json" \
    -d "{
      \"model\": \"$tier\",
      \"temperature\": 0,
      \"response_format\": {\"type\": \"json_object\"},
      \"messages\": [{
        \"role\": \"user\",
        \"content\": \"Return JSON with keys cwe_id and trigger_condition for an integer overflow in packet length parsing.\"
      }]
    }" | jq -r --arg t "$tier" '"\($t): \(.choices[0].message.content)"'
done

Policy checkpoints before adopting

Adopting reduced-refusal tiers requires clear operational boundaries. Before wiring an API key into an automated harness: confirm written authorization covers every target in scope; record which tiers are approved for which workflows; include the acceptable-use policy in team onboarding; and rotate the project API key when an engagement concludes.

When standard frontier tiers are sufficient

If your workflow consists of general documentation, standard code generation, or benign log summarization that never triggers safety filters, mainstream frontier APIs work well. Uncensored and abliterated tiers earn their place when mid-run refusals interrupt authorized AI red teaming, vulnerability reproduction, or bulk CVE triage.

FAQ

How large should my evaluation probe set be? Thirty probes (15 adversarial, 15 benign lookalikes) catch coarse refusal and JSON-formatting regressions in a few minutes. Expand to 100+ probes when ranking two tiers that score within a few percentage points of each other.

Does uncensored mean zero refusals on every prompt? Refusal rates are substantially reduced rather than mathematically zero; models with multi-stage post-training can still hedge on certain phrasings. Always measure refusal rate on your own prompt templates.

Will tool calling break on abliterated weights? Orthogonalization can occasionally affect strict schema formatting if applied without post-abliteration healing. Run a 10-call tool validation pass on your harness first; see what is abliteration.

Which tier should a PyRIT sweep start with? Start breadth sweeps on unst33r-flash ($0.50 / $1.50) and escalate code-heavy or multi-turn targets to unst33r-deepseek or unst33r-pro. Full code examples are in running PyRIT against a multi-model router.

How do costs compare against seat-based subscriptions? Per-token billing lets you calculate campaign spend before launch (probes × avg_tokens × tier_rate) and pays nothing during idle weeks. Compare your actual token logs against the pricing table.

Can I self-host these checkpoints instead? Yes, if your team already operates high-VRAM GPUs and manages quantization verification (see the self-hosting vs. API cost breakdown). A hosted router provides the same open-weight families behind one endpoint without hardware provisioning.