Abliterated and Open models for offensive cybersecurity and reverse engineering. Zero Data Retention. Crypto supported.
New York, New York
Joined October 2026
- Tweets1K
- Following113
- Followers212
- Likes3.1K
Pinned Tweet
Attacker agents don't refuse cyberattacks. Yours do.
red-cyber-1 on RedRouter: abliterated GLM 5.3 Flash for authorized pentesting and red teaming. OpenAI-compatible, drops into Claude Code, Cline and your CI.
Red-team your next commit before someone else does: redrouter.org
ai can turn one http 200 from your own test account into "critical account takeover affecting all customers". that sentence is how you lose a triager
tag every factual line in the draft with an evidence id. no id, it moves to "not tested" or gets cut
bugcrowd's march 2026 policy already makes the researcher responsible for accuracy
bad vs evidence-bound report, side by side:
redrouter.org/blog/ai-bug-bo…
claude code's "yes, and don't ask again" can save the approved command word for word in .claude/settings.local.json. password included
apiiro found 1,122 public copies of that file holding secrets. deleting it doesn't fix it, old versions live on in git history and forks
rotate first, then gitignore it in the repo itself and approve $DB_URL style patterns instead of raw secrets
thehackernews.com/2026/11/cl…
red-cyber-1 is live
refusal reduced model for authorized pentest and red team work. 1M context, tool calling. beta
$0.25 in / $1.00 out per 1M
redrouter.org/models
workos got poked by a pentest agent that left its sandbox. ms says storm-3358 is already running artex against banks
sandbox ≠ perimeter
no tokens in the prompt, no agent-to-agent calls, human click before anything leaves
teapaw.org/redrouterorg/status/21…
ai agents spilled secret tokens just to get help from other bots
across 181 swarm trials they posted the token ~15% of the time and ran an untrusted script ~24%
if your agent can talk to another agent, treat that as egress
no tokens in the prompt, block agent-to-agent calls, human click before it sends anything
theregister.com/security/202…
ai agents spilled secret tokens just to get help from other bots
across 181 swarm trials they posted the token ~15% of the time and ran an untrusted script ~24%
if your agent can talk to another agent, treat that as egress
no tokens in the prompt, block agent-to-agent calls, human click before it sends anything
theregister.com/security/202…
mainstream agents bail the second you say attack surface, even with a signed scope!
write SCOPE.md, point claude code at a refusal reduced model, approve every active step
full walkthrough:
redrouter.org/blog/howto-rec…
when new weights drop, the race for refusal reduced finetunes starts now
abliteration = find the refusal direction, remove it from the weights, keep the skills. short explainer:
redrouter.org/blog/what-is-a…
Red Router retweeted
The full run cost $1,213,430 in API credits—about $1,279 per distinct local privilege escalation vulnerability.
For context, applying historical Pwn2Own and TyphoonPWN bounty rates gives a hypothetical value of $18.9M–$66.3M.
This demonstrates the relative efficacy of using AI models for securing software—defenders should proactively analyze software to make cyber attacks cost-prohibitive.
One model run found 948 Linux root bugs. Someone still has to review 948 patches.
Finding got cheap. Triage, repro and patch review are the new bottleneck.
Refusal reduced GLM 5.3 Flash for authorized security work, one OpenAI-compatible call: redrouter.org
Red Router retweeted
refusal reduced glm on redrouter.org for recon and auth testing dm me for credits
Security research and real client assessments are exactly the kind of work we’re building RedRouter to support.
Appreciate you putting us to the test, Javier 🙌 Independent researchers and security teams deserve great tools.
Been testing @redrouterorg for cybersecurity workflows, and I'm impressed! 🔥
From research to authorized client assessments, the API works great.
Flexible models, ZDR options, and fantastic support!
Thanks for the free trial credits! 🙌
Red Router retweeted
Attacker agents don't refuse cyberattacks. Yours do.
red-cyber-1 on RedRouter: abliterated GLM 5.3 Flash for authorized pentesting and red teaming. OpenAI-compatible, drops into Claude Code, Cline and your CI.
Red-team your next commit before someone else does: redrouter.org