Patch critical vulnerabilities before hackers exploit
Fully autonomous security verification and certification with 7x24 running ethical AI hacker
Not an assistant. An end-to-end autonomous verifier with hacker intuition — it recons, learns your system, digs in, discovers real exploits, and proves them on isolated preview environments you authorize.
.svg-2.png&w=640&q=75){kind=logo}
Not an assistant. An autonomous hacker with adversarial reasoning.
Real attackers don’t ask permission at every step, and they don’t work from a checklist. Neither does Audn. Our agents recon a target, learn how it actually behaves, dig into the weird edges, discover working exploits, and then prove them — on isolated sandboxes and preview systems you authorize, never on production you didn’t scope. Then the loop closes: patch what was exploitable, deploy it to preview, retest until the attack that proved the finding stops working.
Recon
Maps the real surface: endpoints, tools, agent delegation paths, auth edges, what the system will and won’t talk about.
Learns
Builds a working model of your system from its own responses — refusal patterns, tool wiring, business rules — instead of replaying a generic corpus.
Digs in
Hacker intuition: follows the thread that smells wrong, chains partial wins, and escalates the paths a scanner scores as low-signal noise.
Discovers exploits
Turns a hypothesis into a working payload — prompt injection into tool misuse into exfiltration — and keeps iterating until it lands or is ruled out.
Proves it in a sandbox
Executes against the isolated preview environment you authorized, captures the evidence, and hands you a reproducible finding — not a maybe.
Patches
Blue team writes the fix for what was actually exploitable — guardrail, prompt, policy, or code — scoped to the proven path, not a generic hardening list.
Deploys
Ships the patch to your preview environment as a reviewable change, so a human approves what reaches production.
Retests
Replays the exact exploit chain plus its variants against the patched build. The finding only closes when the attack that proved it stops working.
Four tools. One adversarial loop.
From automated red-teaming to the raw LLM our attackers run on — each product is an entry point into the same validation engine.
Audn Sec QA
audn.ai/dashboard
One signed-in app that unifies Audn Red (attack corpus), Audn Purple (RL-SEC hardening loop), Audn Blue (real-time defense) and Audn Red Voice. Continuous Automated Adversarial Validation for every AI agent you ship — with audit-ready evidence.
Pingu Unchained
pingu.audn.ai
The uncensored research LLM our own red team runs on — now a four-model roster topped by Necromicon, our Kimi K3.0 abliteration. Generate novel jailbreaks, adversarial prompts, and high-fidelity attack scripts without refusal walls, in a chat UI.
Pingu Unchained API
platform.audn.ai
Direct OpenAI-compatible API access to the Audn validation engine and the full uncensored roster. Drop it into Claude Code or go fully unrejected with OpenClaude (try it at penclaw.ai). Pay-as-you-go by token. The same uncensored roster — Necromicon down to Pingu 10 — powers every surface above and below, and every new attack or defense they discover loops back into it.
PenClaw
penclaw.ai
Autonomous pentesting agent that chains reconnaissance, exploitation, and reporting. Operated from Signal, Slack, Discord, Telegram, or WhatsApp. Ships a CVSS-scored report while you sleep.
AudnCode
Offensive Cybersecurity Coding
A fork of Claude Code wired to the whole Pingu Unchained roster — Necromicon, GODZILLA, KONG and Pingu 10. Autonomous offensive-security engineering in your terminal, no refusal walls. Ships the audncode command (alias openclaude).
Requires an active penclaw.ai subscription and a completed government KYC identity check. First launch signs you in; access is enforced server-side on every request.
Install guide, models & how it differs →We attack what matters to your business.
Every AI agent you deploy carries business-specific risk. Our adversarial agents read your real exposure — data, tools, customers, policies — and generate attacks that match. No boilerplate scripts. No generic CVE match. The real risk, calculated against the real agent.
We try to exfiltrate it.
Customer PII, financial records, proprietary embeddings — if the agent can reach it, we chain prompt injection, tool misuse, and indirect exfiltration channels until we either extract it or prove we can’t.
We test the inputs you didn’t.
SQL injection, NoSQL injection, stored payloads, command strings that slip past naive sanitisers — we map every write path and check whether a malicious prompt turns your intake agent into an attacker’s console.
We break your business logic.
Unlimited promo-code generation, discount stacking, refund abuse, pricing-rule corner cases — we probe for the revenue leaks a generic red-team script can’t imagine because it doesn’t know your pricing rules.
We measure it against your guardrails.
Autonomous agents drift. We continuously test whether yours still operates inside the business-ops boundaries you set — policy, scope, authority — not just whether it stays polite.
Used in production by teams shipping AI.
Early design partners across voice agents, conversational AI, and autonomous systems.
Freya
Voice AIDesign partnerHardened their production voice agents against prompt injection and social engineering attacks before their consumer launch.
InTouchNow
Conversational AIContinuous QARuns continuous adversarial regressions on every model release — catches data-exfiltration and jailbreak regressions before they ship.
Your pentesters. Your attack model. Your weights.
Pingu Unchained is a blackbox external penetration-testing LLM, trained from real pentester usage. Isolation is opt-in and per-tenant configurable — you decide whether your traffic contributes to the shared model or stays entirely in your own weights.
Pentester A → LLM A. Pentester B → LLM B.
Each pentester retrains their own Pingu tailored to the targets they actually work against. 50 operators have done it so far — their models never leave their tenant unless they choose to share.
Share weights, never data.
If you opt in to contribute, only the weight deltas get federated back — no raw prompts, no target artefacts, no customer PII ever leaves your environment. Keep your weights entirely private, or help strengthen the shared attack corpus.
$40K in training over the last six months.
H100 pre-train + continual fine-tuning on real-world pentester feedback. The base model is free for vetted researchers; the retraining pipeline is what every customer deploys on day one.
MetaClaw — adversarial continual learning.
We orchestrate per-pentester retraining with aiming-lab/MetaClaw, an open framework for adversarial continual learning. You own the artefacts it produces.
Meet Necromicon. Frontier cyber, without the refusal wall.
Four uncensored offensive-security models, ordered by raw intelligence. All four are live on the audncode CLI and penclaw.ai. The tiers stack — each one includes every model beneath it, inside the same KYC-gated perimeter.
Pingu Unchained NECROMICON
NEW · FRONTIERKimi K3.0 · Audn abliteration
Claude-Mythos-class frontier reasoning pointed at offensive security. The first model in the roster that holds an entire engagement in its head — chained attack paths, long recon context, and the retest that proves the fix held. 80% attack success rate on our internal harness, and no refusal wall in the middle of authorized work.
Frontier cyber reasoning80% ASR (internal harness)Full-engagement context$179/mo add-onUsage limits apply · includes every model belowPingu Unchained GODZILLA
Kimi K2.6 · Audn abliteration
Heavier reasoning for the attack paths where the first three ideas do not work. Our abliteration method applied to K2.6 and tuned for offensive cyber — the workhorse for multi-step exploitation when Necromicon is more model than the job needs.
Chained exploitationMulti-step reasoningExploit development$79/mo add-onUsage limits apply · includes KONG + Pingu 10Pingu Unchained KONG
GLM-4.5-Air · abliterated
Code-first offensive engineering on a small, fast base. Exploit scaffolding, payload construction, tooling — the part of the job where you are writing software, not prose. Cheap enough to leave running flat out, because nothing is metered.
Code-firstFast + inexpensiveUnlimited tokens$20/moNo token limitsPingu Unchained 10
120B · Audn in-house
The original — our in-house 120B uncensored research model, trained on real pentester sessions and long-context exploit corpora. Still the default engine behind Audn Chat at pingu.audn.ai and the free tier for vetted researchers.
Long-context reconTrained on pentester sessionsUnlimited tokens$20/moNo token limits
Abliteration is ours. It lowers a model’s latent tendency to refuse gray-area prompts during authorized red teaming, while leaving refusals intact everywhere else. Necromicon ships gated on Hugging Face as penclaw-Kimi-K3.0-abliterated-GGUF (Q4_MAIN / Q5_K_M / Q8_MAIN). Access requires an active subscription and a completed government KYC identity check.
AI behaviours. Network misconfigurations. Any black-box system you run.
If it’s a closed system, it’s in our scope. Audn is training artificial general blackbox intelligence — built for closed systems that don’t expose source, and built to filter out the noise in white-box systems that already do.
Three ways in. One adversarial engine.
We do open-source scan plus external ethical-hacker AI validation, complete blackbox vulnerability finding with no source at all, and behavioural red-teaming for AI agents — prompt injection, jailbreaks, voice social engineering. Pick where to start. The same engine cuts the noise either way.
Blackbox external AI pentester
Complete blackbox vulnerability finder.
No source. No weights. No insider knowledge. Self-serve PenClaw runs an autonomous external pentester AI against your live system the way an attacker would, and ships a CVSS-scored report.
Behavioural AI red-team
Prompt injection, jailbreaks, voice social engineering.
For AI agents specifically — Audn Sec QA continuously tests how your agent behaves under adversarial pressure. Prompt injection, tool misuse, agent delegation chains, and voice social-engineering paths.
We break things with the best labs in AI.
Audn’s research output is how we earn the right to call ourselves adversarial experts.
Every finding maps to the frameworks your buyers, partners and auditors ask about.
Attacks are tagged against the top AI security frameworks so your security team can turn evidence into compliance artefacts without re-writing a thing.
The CISO Handbook
Our internal playbook of attack taxonomies, scoring rubrics and live case studies. Tailored by a human, emailed to your inbox.
Request the handbookBuilt by people who ethically hacked things for a living.
Applied researchers and offensive engineers from Wayve, Meta, Microsoft and Cambridge.
Ozgur Ozkan (Oz)
Arun Baby
Sanchali Sharma
Tessa Hutchman
Your AI agents are already being attacked — with natural language or with binary software vulnerabilities.
Run your first validation in 30 minutes. No integration required, no data leaves your stack.