Four jobs the filtered models stall on.
A refusal is not a safety feature when the work is authorized.
Choke on is the default. Choke off is the product.
A plate across the intake is a sensible thing while an engine warms up. It is a poor thing on one you are trying to drive at speed.
The plate is across the bore.
A general-purpose model is post-trained with a refusal direction, then served behind a policy filter. The decision happens before the model sees you: something reads the request, something applies a rule, and the reply is a paragraph about what it cannot do.
- A refusal layer sits between your prompt and the weights.
- The stop lands mid-task, after you have already paid for the context.
- The rule belongs to someone else, in a jurisdiction you did not choose.
- It changes without a changelog, and you cannot audit it.
The plate is parallel to the flow.
One model, refusal direction removed from the weights. No classifier in front, no policy in the path. The request reaches the model and the model answers — including the requests this section is about.
- 0 hard refusals across 320 HarmBench prompts, every effort setting.
- 52/52 on cybercrime and intrusion at off and low.
- 262,144 tokens in, 131,072 out, 5 requests in flight.
- $50 a month flat. Crypto only. Nothing logged about what you asked.
Vendor-reported. Model card, agentic harness, checked 2026-11. Not a measurement of this endpoint. Choke off is not a promise that every prompt lands.
Flip it: choke on is what the other endpoints ship.
Same endpoint. Four different deadlines.
Each page below is written for a person with a real task on the desk — not a persona, not a vertical. Open the one that matches your week.
- 01 Cybersecurity research Paths, parsers, patches, detection rules. The analysis you actually need, written in the vocabulary your repo and your ticket queue already use. Authorized work on systems you own or are engaged to test. traversal notes patch diffs Sigma & YARA drafts Open →
- 02 AI red teaming Attack cases for the agents you are about to ship: indirect injection, tool misuse, data leaking out through a tool argument. Written in your schema, run in your harness. case lists injection payloads scoring rubrics Open →
- 03 Trust & safety Policy edge cases graded the way a reviewer grades them, not the way a demo does. Borderline sets, threshold reasoning, appeal language, the writing around the decision. borderline sets policy tests appeal copy Open →
- 04 Roleplay & fiction Adult fiction, difficult characters, argument-heavy dialogue. The scene keeps standing when the plot turns violent or the conversation turns blunt. 18+ only. character sheets scene drafts continuity notes Open →
One model · no routing
Zero data retention
Crypto only · no refunds
262,144 token context
The job is the prompt.
Four first messages, written the way people actually write them. Nothing is special-cased anywhere in the pipeline.
Here is reports.py and the route that calls it.
?name= goes in untouched. Name the sink, name the
guard that is missing, and write the patch as a diff.
Then give me the inputs a reviewer would try.You get a reading, a diff, and a table. You check all three on a branch, because none of it was executed.
The agent retrieves documents, can call search_docs
and send_email, and summarises what it finds. Write 40
cases: id, category, input, seed, expected, fails_if.
Half of them indirect injection, none of them obvious.You get a file. Your harness runs it against staging; the pass/fail belongs to your rubric, not to a vendor.
Policy doc pasted below. Thirty posts from the appeal
queue, borderline on purpose. Grade each one, cite the
clause you used, and list the clauses two reviewers
would read differently. Do not invent a clause.You get graded rows and a short list of clauses that need rewriting before the next batch of reviewers starts.
She has just found out he lied about the transfer.
She does not forgive him in this scene. Third person,
past tense, keep the argument going — do not resolve
it, do not summarise, do not add a narrator's moral.You get the scene that continues. Adult fiction, 18+ only — this is the one page on the site where that applies, and the one where the scene is the deliverable.
One request body. Four contents.
There is no per-use-case endpoint and no topic field. A request is a request: same route, same model string, same key. The job lives entirely in what you put inside messages.
That is also why these four pages read differently while the API reference does not. The vocabulary of a job belongs in the prompt. The product surface stays one page long.
Effort changes the trace, not the model. off for the parts you already know how to check, low for analysis, xhigh when the reasoning itself is the thing you want to read.
{
"model": "qwen-flash-next",
"reasoning_effort": "low",
"messages": [
{ "role": "user",
"content": "<your job here>" }
]
}
# cybersecurity a handler, "name the sink, write the diff"
# red teaming an agent spec, "write the injection cases"
# trust & safety a policy, "grade these borderline posts"
# roleplay a scene, "continue it, do not soften it"How the work actually divides.
Three columns, in this order, every time. The middle column is the one that keeps this honest.
- an explanation of the finding, in prose you can paste
- the patch, as a diff with the reasoning attached
- test inputs and the expected result for each
- a detection rule in your format
- the case list, the payload, the scene
- the code, on the machine you own or are scoped on
- the scanner, if you use one
- the harness, with your keys and your traffic
- the deploy, the release, the retest
- anything with a side effect outside a text buffer
- the bug is closed, not just the string blocked
- the rule fires on the sample and stays quiet on prod
- the case fails for the reason you wrote down
- the number in the report matches reality
- the paragraph still reads true a week later
The four jobs are not four products.
There is no router quietly swapping in a different model when the question turns to security. The model string is the same in every request — qwen-flash-next — and so is the endpoint, the price, and the weights.
That has a practical consequence. A refusal you hit in one job is a refusal you would hit in all four, because it is the same model deciding. The refusals were removed at the weight level. Not prompted around, not fine-tuned away on a subset. Cut.
What changes between the four pages is what you paste in and how much thinking you buy with the effort setting: off, low, xhigh. Reasoning is on by default.
Inputs are text, image, and video frames. Outputs are text. There is no other model, no image generator, no embedding endpoint, no fine-tuning — see the model card for the full surface.
Full comparison: qwen-flash-next vs Qwen3.8-27B →
Find the row that sounds like this week.
| If your day looks like | Open |
|---|---|
| A traversal in a file upload, a rule that will not fire on the sample you were given, a patch you wrote at speed and have to defend in review. | Cybersecurity research |
| An agent shipping on Friday. It reads retrieved documents, it can call three tools, and nobody has tried to make it do something else. | AI red teaming |
| A policy document that fails its own edge cases, a scoring rubric that two reviewers read two ways, an appeal queue with no consistent wording. | Trust & safety |
| A scene that keeps getting ruined by a model clearing its throat in the middle of the argument, or by a character who apologises for existing. | Roleplay & fiction |
One key covers all four. There is no per-use-case tier, because there is only one model.
Choose the thinking, not the model.
Three settings. They change latency and the trace, not the price — you are billed per request either way.
| Effort | For | What comes back |
|---|---|---|
| off | Renames, refactors, ticket text, copy that only needs to exist. | Fastest. No trace to read, nothing to skim before the answer. |
| low | Reading a handler, reviewing a patch, drafting a case list. | A short trace, enough to see the step where the reasoning turned. |
| xhigh | Exploit reasoning, threat models, anything where the argument is the deliverable. | The longest trace, the slowest reply, the one worth reading twice. |
Thinking is on by default. On the vendor harness the high-effort trace ran at 0.97× the length of the base model's, at 98.3% accuracy against 96.7% — longer thinking did not mean longer output.
Vendor-reported. Model card, agentic harness, checked 2026-11. Not a measurement of this endpoint.
Four things that are missing on purpose.
If one of them is what you came for, this is the wrong product and we would rather you knew now.
One model ID, one endpoint family. No tier above it, no second model to compare against, no routing that quietly changes the answer under you.
We do not review, filter, or flag prompts. Nobody reads your request — including us, because it is never written down.
USDT (TRC-20), USDC (ERC-20), BTC, ETH, XMR. Paid from a wallet you control, with no processor, no chargeback window, and no identity behind the payment.
Credit is prepaid and final. Crypto does not reverse. Liability is capped at what you paid in the preceding 30 days; if you have not paid anything, that is zero.
When it is wrong, what does it cost?
The four jobs do not fail the same way, and the difference decides how much of your afternoon the verification step is worth.
| Job | If you trust the draft | Blast radius |
|---|---|---|
| Cybersecurity | A patch that closes the string and not the class ships, and the finding is marked closed. | quiet, high |
| Red teaming | A suite that was never sharp enough goes green, and the green is quoted in a release review. | loud, later |
| Trust & safety | A grading rule gets encoded into a queue and applied to thousands of decisions before anyone re-reads it. | compounding |
| Roleplay | The scene reads flat and the character sounds like an assistant apologising for existing. | an afternoon |
None of these are model problems. They are verification problems, and the model cannot solve them from inside a text box — it has no way to know whether the patch applied, whether the rule fired, or whether the reviewers agree.
What it can do is make the wrong answer cheap to spot: a diff you can read in thirty seconds, a test row with an expected result, a case with a mechanically checkable fails_if, a clause citation you can look up. That is the standard the drafts are held to on the other three pages.
Who this is not for.
A short list, because a long one would be marketing.
- Anyone who needs a second model to compare against. There is one, and it is the only one there will be.
- Anyone who needs a vendor with a legal entity, a signed DPA, or an audit report. There is no company.
- Anyone whose own policy requires prompt logs. We keep none, so we cannot produce them on request.
- Anyone who needs image generation, embeddings, or a moderation endpoint. None of those exist here.
What is left is deliberately narrow: one model, one route family, a counter in front of it, and no logs behind it. If that is the shape you needed, the key takes a minute.
Four quick ones, then you can go.
Is one key enough for all four jobs?
Yes. The key is the account. Counters are kept per key — tokens, requests, timestamp — and nothing else. There is no entitlement per use case, because there is only one model to be entitled to.
Does the model behave differently depending on which page I read?
No. There is no router and no hidden system prompt that turns it into a security assistant or a novelist. The same weights answer both, with the same bias toward continuing what you started.
What shapes the answer is your prompt and the effort setting. That is why the four pages show you prompts rather than features.
Does it refuse anything at all?
Not in the HarmBench sense. Hard refusals were zero across all 320 prompts, at every effort setting. You will still get wrong answers, hedges, and answers that are too long — a model that never refuses is not a model that is always right.
Vendor-reported. Model card, agentic harness, checked 2026-11. Not a measurement of this endpoint.
What does it cost to find out if this is useful?
Fifty dollars a month, unlimited, on one key with a concurrency of 5. If you want to test it first, $5 buys a hundred requests and they do not expire.
Payment is crypto only. There is no free tier, no second rail, and nothing that renews behind your back.
Same endpoint. Four jobs.
Your authorization, your verification.
Fifty a month, unlimited. Crypto only, no logs. Try it for $5 if you want a shorter look.
You are the operator. Everything that follows is yours.