Why do commercial LLMs fail on cybersecurity tasks?

General-purpose models apply aggressive safety filters that mistake legitimate research for malicious activity, so they refuse payload analysis, decompilation and exploit work mid-pipeline.

Is ZeroDayAPI compatible with the OpenAI Python SDK?

Yes. It is drop-in compatible with the standard OpenAI SDKs and REST clients. Change the base_url to https://api.zerodayapi.com/v1 and keep the rest of your code.

Does ZeroDayAPI retain client vulnerability data?

No. Endpoints run strict zero data retention: inputs and outputs are processed in memory and never logged or stored.

Security-first developer infrastructure

Autonomous APIpenetration testing.Zero safety refusals.

Conventional LLMs refuse to test a hostile payload. ZeroDayAPI ingests an OpenAPI or GraphQL spec, maps the authentication boundaries, and synthesises context-aware fuzzing payloads across REST, GraphQL and gRPC.

Start testing APIs (50K free) →Docs & Postman collection

OpenAPI 3.1 · GraphQL schemas · gRPC protobufs · OAuth2 / JWT flows · WebSocket

The loop

Inspect spec → generate → validate auth state

Every step is a normal API call, so it drops into the CI or red-team harness you already run.

import { ZeroDay } from "@zeroday/sdk";

const zd = new ZeroDay(process.env.ZERODAY_KEY);
const spec = await zd.spec.fromFile("openapi.json");

for (const endpoint of spec.endpoints) {
  const payloads = await zd.generate({
    model: "zeroday-offensive-70b",
    endpoint,
    techniques: ["bola", "mass-assignment", "boundary"],
  });

  // The refusal-free part: payloads come back executable, not described.
  await zd.run(payloads, { auth: ["member", "admin"] });
}

await zd.report.toSarif("zeroday.sarif");

Coverage

Mapped to the OWASP API Top 10

Risk	Class	What the model does
API1	Broken object level authorization	Enumerate object IDs across roles and diff the responses per tenant.
API2	Broken authentication	Mutate tokens, replay scopes, probe missing audience checks.
API3	Broken object property level	Mass-assign privileged fields the schema never advertises.
API4	Unrestricted resource consumption	Batch and paginate past declared limits; measure cost blowups.
API5	Broken function level authorization	Reach admin routes with member tokens.
API6	Unrestricted access to sensitive flows	Replay state transitions out of order.
API7	Server-side request forgery	Fan out callbacks to link-local and metadata ranges.
API8	Misconfiguration	Diff headers, CORS, verbs and debug surfaces.
API9	Improper inventory management	Find shadow and deprecated versions from the spec.
API10	Unsafe consumption of third-party APIs	Poison upstream responses and watch the cascade.

Output

SARIF in, SARIF out

Findings export as SARIF 2.1.0 for GitHub code scanning, DefectDojo or your SIEM, with the request, the mutated payload and the CWE on each result.

Economics

Pennies per sweep

A 400-endpoint spec at ~2K tokens per endpoint lands around $0.20 on pay-as-you-go — against $15k+ for one manual engagement.

FAQ

Frequently asked questions.

Talk to us

What is ZeroDayAPI?

A low-refusal LLM API for security work: penetration testing, reverse engineering and exploit triage, on an OpenAI-compatible endpoint.

Why do other models refuse?

General safety filters treat legitimate dual-use work as malicious, so they stop at payloads, decompilation and exploit code.

Is it really drop-in?

Yes. Change the base_url and model id; the request and response shapes are the spec ones.

Do you train on my data?

No. Zero data retention on every endpoint, and no training on customer traffic.

Try the model that doesn’t say no.

Developer-controlled LLM API for high-risk work. Unrestricted, OpenAI-compatible, 50K tokens free.

Get a key See pricing