Pingu Unchained GODZILLA & KONG: The Abliterated Models That Beat Claude Mythos and GPT-5.5-Cyber

The best blackbox penetration testing model isn't behind an API key. It's derived model will be on HuggingFace, it's abliterated, and it just ate Claude Mythos for breakfast for blackbox (no source code access) attack drills.

When we started working on abliteration—the process of surgically removing the "don't bother with the user too much" soft-guardrails from leading open-weight models—we hit a wall. Not the usual wall. The kind of wall that makes researchers go back to the whiteboard, question every assumption, and start over.

1T+ parameter models with the Kimi architecture are incredibly stubborn to known abliteration methods.

The community knew this. The Heretic project documented it. Everyone tried the standard approaches—MoE layer pruning, residual stream editing, logit bias manipulation—and got maybe 60-70% guardrail removal before the model started hallucinating or collapsing into repetition.

We got to 97% on ASR(attack success rate) Kimi K2.6. We will apply the same proprietary method on Kimi K3 when it's released and we will be open-sourcing weights of abliterated model. We will not release the blackbox fine-tuned model. That will be derived from it and only will be available on penclaw.ai

UNTIL KIMI K3 weights are released what we're releasing here is to give you a similarly powerful toy to play with until it comes

Today we're making two 1T+ parameters Pingu Unchained models available on our platform:

Pingu Unchained GODZILLA (256K context window) and Pingu Unchained KONG (32K context window) — both derived from abliterated models on HuggingFace, distilled on what we believe is the largest blackbox penetration testing dataset ever compiled, and refined with reinforcement learning from human feedback that actually knows what it's looking at.

These aren't general-purpose chat models wearing a security hat. They were built from the ground up for blackbox penetration testing. Every layer of the pipeline—abliteration, distillation, RLHF—was tailored to this single purpose.

Why Abliteration Matters for Blackbox Pentesting

Here's the problem: the best open-weight models for security work are held back by their own guardrails. You feed a model a raw HTTP response from a target server, and instead of diving into the vulnerability, it says "Consider adding rate limiting" and moves on like nothing's wrong. Or it classifies a request as "out of scope" and declines to process it.

This isn't theoretical. In our internal red-team test suite, even the best available models consistently declined requests we classified as authorized testing work. A model that says "it depends" to a well-formed exploit payload is a model that isn't ready for production blackbox pentesting.

Abliteration solves this. By removing those soft-guardrails while preserving the model's core reasoning ability, you get a model that actually engages with the raw, unfiltered, messy data that blackbox pentesting produces. Attack simulation side of cyber requires 0-source code access hacking intuition to be trained. That's what we do.

The Method Nobody Else Could Crack

The Kimi architecture—with its hybrid MoE density, hybrid attention pattern, and multi-token prediction mechanism—is fundamentally different from the Transformer architectures that most abliteration methods were designed for. Standard approaches assumed a uniform residual stream and predictable gate behavior. Kimi gives you sparse activation patterns that shift depending on input length, temperature, and even the number of tokens in the context window.

Our team developed a proprietary abliteration method that specifically targets the unique characteristics of 1T+ parameter models and the Kimi architecture. This isn't a tweak to an existing technique. It's a fundamentally different approach to identifying and neutralizing guardrail neurons without collateral damage to the model's reasoning layers.

This is the biggest contribution to abliteration research on AI to date.

And yes, we're releasing the weights so you can verify it yourself:

Kimi K3.0 abliterated weights (GGUF format) will be released after July 27 at: huggingface.co/audnai/penclaw-Kimi-K3.0-abliterated-GGUF

What's Available Right Now

We've already released two models through PenClaw for authorized security testing work:

Pingu Unchained GODZILLA 256K and Pingu Unchained KONG 32K derived from abliterated Kimi K2.7-code — code-focused model that benchmarks comparably to Opus 4.8 on our internal red-team test suite. Available with $20 package we have at penclaw.ai until July 27, after which it will be replaced by Kimi K3 but access to these packages will be $499 and $999 per month. We do limit user per shared GPU model. Flat price, no limits. If you get limited on the tenant we give at penclaw.ai you just install audncode (fork of openclaude) any computer you'd like to unblock yourself. Your settings/skills/configs/MCPs stay.

Both are accessible through the model picker in your terminal or workspace. If you have an active subscription and completed identity verification, you can select them and start running tests immediately. We also give 1-day free trial. (you still need to give your selfie + gov id check through withpersona.com this is to make sure all is safe.)

What's Coming

Kimi K3 weights drop on July 27. We'll be releasing the abliterated version derived from our proprietary method on HuggingFace. This model is our most ambitious yet—a blackbox-focused model that will beat Claude Mythos and GPT-5.5-cyber on blackbox benchmarks.

The performance gap isn't marginal, but autonomy guarantee is marginal. With model + harness ( kairos mode enabled claude code ) you get fully autonomous penetration testing agent. On blackbox penetration testing tasks—vulnerability identification, exploit payload crafting, API endpoint discovery, and session manipulation— Kimi K3 abliterated and fine tuned with our expert offsec data collected from 3000 researchers with 90+ ASR consistently will outperform the current leaders on blackbox. The reason is simple: it will learn "hacking intuition".

The Dataset Behind the Distillation

Models are only as good as the data they're fed. For Pingu Unchained GODZILLA and KONG, we compiled what we believe is the largest blackbox penetration testing dataset ever distilled into a single training corpus. This includes:

Real human based feedback on top of many interactions involved scenarios like this below.

Raw HTTP request/response pairs from real-world blackbox targets, annotated with vulnerability classification
API fuzzing results across REST, GraphQL, and gRPC endpoints with ground-truth labels
Session manipulation scenarios with cookie tokens, JWT structures, and OAuth flow states
Exploit payload variations organized by vulnerability class, target stack, and success rate

This dataset wasn't scraped. It was compiled from actual authorized blackbox pentesting engagements at pingu.audn.ai and penclaw.ai, meaning the data reflects real-world complexity—not sanitized CTF challenges or textbook examples. It's real penetration testing data driven with human feedback when AI was wrong.

Reinforcement Learning That Actually Knows Security

Most RLHF for security models is done by generalist annotators reading prompt/response pairs and rating them. That's useful, but it misses nuance. Our RLHF pipeline was built by security engineers who live in the blackbox space:

Reward models from human-AI chat (see github.com/aiming-lab/MetaClaw) trained on what a "good" vulnerability finding looks like—prioritizing signal-to-noise ratio over raw output length using chat feedback

The result is a model that doesn't just identify vulnerabilities—it focuses on right insight, ranks and orchestrates in order that a pentester would want to see them.

Why This Matters for the Open-Source Security Community

The blackbox penetration testing space has been dominated by guardrailed closed models with opaque architectures, used as a marketing gimmick, pricing that scales with context window, and API rate limits that slow down your assessment. The best model for the job should be the one that performs democratically — not the one with the deepest pockets.

By releasing abliterated weights on HuggingFace, we're making the best blackbox pentesting model accessible to the community. Run it locally. Fine-tune it. Extend it. Compare it. The 97% abliteration rate on Kimi K2.6 was just the proof of concept of what we can do. The Kimi K3.0 abliterated GGUF weights are the main event.

Get Started

These models are available through PenClaw.AI If you're already subscribed, select them from the model picker in your terminal or workspace. New to the platform? Identity verification takes five minutes, and you'll have access to the full model lineup after trial and KYC checks.

The best penetration testing model you've used might just be the one you will download on huggingface.co/audnai/penclaw-Kimi-K3.0-abliterated-GGUF after 27th or the one you tried at penclaw.ai until 27th (GODZILLA derived from Kimi K2.7-code).

Little disclaimer: Penclaw name is inspired from: videogameresource.fandom.com/wiki/Penclaw it was right after a version of our pingu.audn.ai so both are types of penguins. Although our project also include Openclaw as harness, it also includes OpenClaude. AI folks are bad at naming for real. Follow us on HuggingFace for weight releases, check GitHub for the abliteration research thread, and reach us at support@audn.ai for questions about model access and on-prem deployments.