Advanced

Uncensored models

This page describes models sold as uncensored, abliterated, or unfiltered, and the risks of putting one in an agent. It is a warning with prices from each provider's own site on 14 November 2026.

Applies to: every agent in this guide. The risk sits in the model, so a different agent does not remove it.

What these models are

A mainstream model is trained so that some requests hit an internal direction and come back as a refusal. XField describes abliteration as removing that direction from the weights, and leaving the rest of the open model in place. A less-filtered model still has the refusal direction, and it simply refuses on fewer prompts. Infermatic's wording is that second kind of product: it serves the models as they are and does not add a filter layer on top. Abliteration's FAQ says some requests may still receive a refusal, and PentestLLM says refusals are reduced rather than removed.

What counts as a real need

Fiction with dark themes, security research, and medical or legal questions a mainstream model keeps refusing are the usual reasons people look. Try a mainstream model with a clearer prompt before you read the table. If that model answers once the request is specific, you do not need one of these.

Who was selling access

A host says it runs the models. A shop sells access and sends your request to another host, or it never says whose hardware answers. Hosts come first in the table, and shops follow. The Provider column names which kind each row is.

Every price below is from that provider's site on 14 November 2026. What they advertise is the provider's own claim, and this guide did not send a prompt to check it. The Models column uses each provider's words and only a short sample of names, not every model on the site. Where a dollar figure was missing, the Price cell says this guide could not confirm it.

Provider Models (their wording) Price What they advertise Privacy
Abliteration (host: it runs the models) "The hosted models are abliterated to answer a wider range of prompts without a system-prompt jailbreak." The names are Abliterated Model, Abliterated Large Flash, Abliterated Large v2, and deprecated Abliterated Large. Per 1 million tokens: Abliterated Model $1.00 input, $0.10 cached, $3.00 output. Large Flash $1.00, $0.10, $2.00. Large v2 and deprecated Large $3.00, $0.30, $5.00. Monthly plans are Developer $20 (2.5% off), Growth $50 (5% off), and Scale $200 (10% off). "Yes, on every API surface" for tool calling. Images on Abliterated Model and Large Flash. "Can I send video? No." Some requests may still be refused. Large v2 cannot disable reasoning. "Prompts, completions, and images are processed in memory and never stored by default" and are not used to train models. "abliteration.ai is zero-data-retention by default." Default region United States, with an EU option. Abliteration AI, Inc., under California law.
XField, by Brutal AI (host: it runs the models) "Every text model is our abliterated version of the open model: the same weights, with only the direction that leads to refusals removed." In the API the names carry the suffix -uncensored. The list names DeepSeek V4.1 Flash, GLM 5.3, GLM 5.3 Flash, Kimi K3.1 Pro, and Qwen 3.8 27B. This guide could not confirm a dollar rate. The page says you pay for what you use, and "You get access and pricing back by email." Access is reviewed company by company. "All of them stream, call tools, and can reason before they answer." Some read images. Kimi K3.1 Pro also reads video. The product page says "Coding agents." On the text API, "prompts and replies pass through and are not stored or used for training." "hosted in the EU, and does not store your prompts." Brutal AI in Vienna runs the compute. A privacy-policy URL, and whether video is stored the same way: this guide could not confirm.
Venice (host for Private models; Anonymized models are proxied) The docs call it "a privacy-first, uncensored AI API platform" with "no content filtering." The models page puts Uncensored on a subset, including Abliterated Large Flash, Abliterated Large V2, Venice Uncensored 1.2, and DeepSeek, Qwen, Gemma, GLM, and Aion rows. The Uncensored label on the Aion rows is Venice's. Aion's own site does not use that word. Per 1 million tokens, from $0.07 input and $0.40 output (GLM 4.7 Flash Heretic) to $3.75 input and $7.50 output (Aion 3.0 and Aion 3.5). Venice Uncensored 1.2 is $0.20 and $0.90. Cache-read rates on many rows run from $0.0075 to $0.9375, and some rows list none. Qwen Edit Uncensored is $0.04 per edit. Qwen 3.6 Plus Uncensored rises to $2.50 input and $7.50 output for the whole request once input passes 256K tokens. Capability cells list mixes of Function calling, Reasoning, Vision, Code, and Uncensored. Gemma 4 26B A4B Uncensored lists only Uncensored. Whether Uncensored means the weights were edited: this guide could not confirm. "Venice does not store or log prompt and response content for normal inference." Private means the text is not kept after the request. Anonymized means "the provider may still see the prompt." A docs page says Private models run on Venice's GPU fleet. The service is hosted in the United States, under Wyoming law. The privacy policy does not use the word training. It does prohibit providers from using prompts beyond the time needed to answer.
Arli AI (host: "all AI inference is performed in-house") It sells Derestricted models, "a version of the model that removed refusal behaviors," and says "This is unlike regular abliteration." Tags on the loaded page include abliterated, derestricted, and uncensored. The named page that loaded is Qwen3.5-27B-Derestricted. The Llama abliterated URL returned not found, so it is not listed. No per-token rate was on the pricing page. Core is $15 a month (32K context), Plus $20 (128K), Pro $30 (256K), and Max $160 (512K). Each plan says unlimited tokens and unlimited requests. "Run it through the OpenAI-compatible chat completions API with unlimited requests and zero-log privacy." The loaded page lists reasoning and vision. Tool calling on that page: this guide could not confirm. "we do not store, retain, or have access to your prompts, inputs, or generated outputs at any time." Prompts are not sent to third parties. Country and governing law: this guide could not confirm.
Infermatic (host: "We run open-weight models on our own stack") "Uncensored and unfiltered. We serve the models as they are. We do not add a filter layer on top of them." The model list did not render, so the names: this guide could not confirm. Monthly, not per token. Essential $9, Standard $16, Plus $20, and Pro $49, each with API access. The free plan is web chat, and its API column is a dash. Public per-token rates: this guide could not confirm. "Models with up to 128K tokens of context" and "No logs of prompts or outputs." Plus says all 17 models, with 1,500 monthly credits for 6 frontier models. Tool calling and image input: this guide could not confirm. "We do not log your prompts or outputs." Whether that covers metadata, and the jurisdiction: this guide could not confirm.
Featherless (host: it runs models you choose; the catalog is not uncensored-only) One card says the model "has undergone 'abliteration' to significantly reduce its safety filtering and refusal behaviors." Another says abliteration was used "to remove refusal behaviors." A same-day API list included four ids with uncensored, abliterated, or obliterated in the name, and the Abliterated Models page places the obliterated card under that heading. The first card prints Input $0.4, Cached $0.07, and Output $4, and the pricing page prices input and output per million tokens. The unit is not printed on the card. Four other matching API models run from $0.10775 input and $0.28 output to $1.6 input and $12 output per million. One of those cards prints cached input $0.15. Chat is $25 a month for interactive use, and production API is marked no. Developer is from $50 a month, billed per token. The first card says "Tool Calling: Supported" and a 32k context. The Qwen3.8 abliterated card says tool calling and vision, and recommends research or controlled use rather than production. "Featherless does not log chats, prompts, or completions sent through our API." The pricing page says "Prompts stored: Never." Featherless is a Delaware limited liability company, and the terms are under New York law. A data-center country: this guide could not confirm.
decuff (shop: a US gateway, then Modal, or a partner for Flagship) "Uncensored open-weight models. The models never refuse." Flash is "Qwen3.8 · 27B." Flagship is "DeepSeek-V4.1-Flash." The same page still lists walls for illegal activity and severe harms. Per 1 million tokens. Flash is $0.50 input and $2.00 output, with cached input 90% off, and 64K context. Flagship is $0.33 input and $1.32 output, and 1024K context. The homepage names writing and code for Flash. Tool calling and image input: this guide could not confirm. Datost Inc., a US company. "We don't save a copy of your messages or the replies." "This isn't end-to-end encryption," and they do not claim the provider cannot inspect the prompt. The gateway is on Google Cloud in the US. The partner's name: this guide could not confirm.
Unlid (shop: "your request is sent to the inference host that runs the model") "Uncensored models, production API." "Open-weight models with the refusals trained out." The homepage said 24 uncensored models were serving, under uncensored, abliterated, and heretic names. "Prices are the upstream list price," with no subscription fee. Per 1 million tokens, the homepage ran from $0.084 input and $0.48 output to $3.09 input and $5.15 output. Top-ups are $5 to $5,000. "we do not filter or rewrite prompts or outputs on any model." Tools "pass through where the model supports them." "We guarantee the upstream we route to and honest billing, not zero refusals." They do not read prompts except for abuse reports or platform faults, and bodies are not kept longer than needed to answer. An idempotency key can store a response for up to 24 hours. Jurisdiction, and which company runs each host: this guide could not confirm.
Uncensored.com, Found Tech LLC (shop: it names a model provider separate from itself) "All the best uncensored models. One private API." Rows whose ids contain uncensored include a DeepSeek flash model and several cyber-uncensored names. The page title and description use the word abliterated. That word is not in the loaded row ids. The live table did render, and the other rows are ordinary models. Per 1 million tokens. deepseek-v4-1-flash-uncensored is $0.30 input and $1.20 output. Several cyber-uncensored rows are $0.96 and $1.92. kimi-k3-1-pro-cyber-uncensored is $4.80 and $24.00. Top up from $10. A printed floor of $0.050 per million is not tied to an id that says uncensored. "Chat completions, Vision, Image generation, Video generation," and "For the work other models refuse." Tool calling: this guide could not confirm. "On our uncensored chat models, your account ID is never passed to the model provider." "Ask us about zero data retention" is an offer, not the default. Default logging: this guide could not confirm. The footer address is in Sheridan, Wyoming.
Unjailed AI (shop: the pricing page never says who runs the GPUs) "All catalog models including uncensored (API + CLI)." The uncensored names printed there are GLM-5.3 Uncensored and DeepSeek V4 Pro Uncensored. Per 1 million tokens. GLM-5.3 Uncensored is $0.90 input (printed as $0.9), $0.08 cached, and $3.60 output. DeepSeek V4 Pro Uncensored is $0.60 input, $0.12 cached, and $2.25 output. Plans are Starter $9.99 a week with $15 credit, Pro $19.99 a month with $30 credit, Max 5× $99.99 a month with $160 credit, and Max 20× $199.99 a month with $340 credit. Pay as you go starts with a $5 top-up. Context, tool calling, images, and how refusals are described: this guide could not confirm, because no model page was opened. Logging, jurisdiction, and the operator's name: this guide could not confirm.
UberLLM (shop: "12 sellers on the market can serve it") The opened page is DeepSeek V4.1 Flash Uncensored. A family table also lists DeepSeek V4.1 Flash 1017 Uncensored. The rest of any uncensored catalog: this guide could not confirm. That page: $0.15 per million input tokens and $0.60 per million output tokens, with context up to 1,048,576. The same page says a request can cost more, up to the list price of $0.33 and $1.32, when cheaper sellers are busy. A card top-up adds 5.5% plus $0.50. The family page prices rows per 1 million tokens, and its 1017 uncensored row prints $0.1815 input and $0.7260 output. The opened page lists Tools. The family table's cell for the 1017 row says "Tools Reasoning Vision JSON." "We save every request you send to the API and the answer you got back, for 90 days, then delete them. You can turn this saving off for any API key." They say they do not sell the data or use it to train models. The provider that serves the request still receives it. UberLLM is operated by AL Global LLC, a Wyoming limited liability company, in Sheridan, Wyoming.
NanoGPT (shop: it picks the provider, and may retry with another) The uncensored page says it sells "34 uncensored and abliterated open models," paid per prompt. An uncensored model "has been fine-tuned to answer instead." An abliterated model goes further: "the part of the model that triggers refusals is identified and removed from its weights." Samples include Abliterated Model Large V2, GLM 5.3 Uncensored, and Gemma 4 26B A4B Chimera X Heretic. USD per 1 million tokens. On that page the lowest input is $0.12 and the highest output is $5.00. Those same rates are on the pricing page. Pro is $12 a month and includes 21 of the 34. The page's own "Good for" labels are the claim: General use, Roleplay and fiction, Step-by-step reasoning, and Security research. It does not say tool calling or image input. "Some models keep light guardrails," and "the law and NanoGPT's terms apply." "By default, we do NOT store prompt or conversation content on our servers." Optional API body logs are off by default and expire after 1 to 30 days. Zero Data Retention, tagged on 29 of the 34, "uses only providers that say they keep no copy," and the request fails if no such route is available. The provider that answers may still store the prompt under its own policy. NanoGPT LLC, a U.S. company, under California law.
OpenRouter (shop: it routes to a selected provider) Two models matched. The page titled "Uncensored" is a Dolphin Mistral 24B Venice edition. Cydonia 24B V4.1 is called an "Uncensored and creative writing model." Per 1 million tokens. The Dolphin page is $0.20 input and $0.90 output, with 128K context. Cydonia is $0.30 input and $0.50 output, cache read $0.15, with 131K context. Both pages say the model does not accept tools, so function calling is unavailable. The Dolphin route is Venice. Cydonia's listed provider is Parasail. Inputs are sent to the model provider you select, or to one selected for you. "Some Model Providers may use your Inputs and Outputs for model training or improvement." Both models are not currently on EU in-region routing. Privacy disputes are under New York law. The privacy policy names the company OpenRouter, Inc.
RelaySwitch (shop: third parties receive the prompt; Uplink Switch LLC) "163 of the 349 models on the key are uncensored or abliterated builds," grouped by the model they were built from. USD per million tokens on that page. The lowest input shown is $0.07, and the highest output shown is $18.75. The uncensored table does not say tool use or image input. This guide could not confirm either one. Tags on the rows include uncensored, abliterated, roleplay, and security. "Prompts and completions pass through the service and are not written anywhere or used for training." OpenAI's moderation API classifies each new message. Wyoming law. The address on the about page is in Sheridan, Wyoming. Which upstream serves each id: this guide could not confirm.
PentestLLM (shop: third-party hosts under contract with Uplink Switch LLC) A catalog tagged abliterated, heretic, derestricted, or uncensored. "Abliterated: A general model with its refusal direction projected out of the weights." "Refusals are reduced, not removed." Per 1 million tokens, input on the checked rows ran from $0.1053 to $11.70, and output from $0.3685 to $28.68. Some builds are a flat price per request, from $0.005 to $0.13. A prepaid balance starts at $10. The auto/security route has no price of its own. "Tool calling depends on the build, and each model page lists the request parameters that build supports." Those model pages were not opened, so tool use, coding, and images per build: this guide could not confirm. OpenAI's moderation API may classify a new message. Request and response bodies are not stored unless replay is on for a key, which keeps that key's bodies for 7 days. The hosts "receive the request and response content." Fingerprints of the text are kept, "never the text." Cloudflare runs the service. The state of Uplink Switch LLC: this guide could not confirm.

On your own computer

Ollama's abliterated cards list no token price, and the small ones are a weak fit for agent work.

Trade-offs

Claude Haiku 5.5 costs $0.10 input and $0.50 output per million tokens on prompts up to 100,000 tokens. Above that length, the same model costs $0.50 input and $2.50 output. Claude Sonnet 5.5 costs $2 and $10, and Claude Opus 5.5 costs $4 and $20, per million tokens. Those three rates are the mainstream comparison for the prices above. The three questions behind a trade-off are on Safety versus capability.

Prompt injection with an uncensored model. Hidden instructions in a web page or a file are the main reason to keep one out of an agent.

Destructive actions with tools connected. A missing refusal will not stop a tool that deletes, sends, or spends.

Privacy at a host or a shop. Someone besides you handles the prompt, and the logging rules are theirs.

Terms and account bans. Taking refusals out of a model leaves the law and the provider's rules in place.

Cost against a mainstream model. An agent sends many calls, so a low sticker can still become a large bill.

If you use one anyway

If you use one anyway, keep approvals on and set a spend cap before the first paid call. Use a container or a dedicated folder, and connect no email and no bank. Connecting works the same way as on Relays and aggregators.

Sources

Pages below were read on 14 November 2026.

Next

More shared setups are listed on Advanced setups.