For pentesters and auditors
Abliterated models and frontier LLMs for AI pentesting, under a DPA instead of a personal subscription. Almost every pentest turns up real data: employee records, customer data, emails, tokens. Pasting it into ChatGPT or Claude for analysis hands your client's personal data to a service the client never approved. 2342.ai gives you security and frontier models under one contract, with data paths you can disclose to your client.
GDPR Article 28 in everyday pentesting
If you process personal data on behalf of a client, you need their prior authorization for every additional processor (Art. 28(2) GDPR). A personal chat subscription cannot be approved that way: no contract with your company, no control over retention and training, processing often in the United States. With 2342.ai you name one provider with a DPA and a published subprocessor list, and you decide per data type which data path is used.
Data path by data type
Analyze dumps, responses and logs containing personal data with models the catalog lists with an EU data path. BB Arena shows that several of them complete pentest tasks without refusals.
Security models
When frontier models stop, specialized security LLMs and abliterated models such as CyberGLM, CyberKimi and Abliterated Model Large take over. The inference provider stores no data (zero data retention); processing takes place in Norway, Iceland and the United States. That is why these models are for technical content without personal data.
Verifiable
Add the DPA, subprocessor list and per-model data path from the catalog to your proposal or report. Usage and cost run through one invoice and stay traceable per API key.
Use it on engagements
Add 2342.ai as an additional processor to your DPA. The DPA and subprocessor list are publicly available.
The organization admin enables external models. The security models are then available with the organization's API keys.
Attack steps with security models, personal data findings with EU data path models, the report in your own workspace.
You transfer your client's data to a provider they have not approved, under consumer terms and often to the United States. That can breach your DPA and the GDPR, and your client may have to assess whether a reportable personal data breach occurred.
Abliteration identifies the direction in a model's activations that triggers refusals and removes it from the weights. The model no longer refuses tasks, while its other capabilities stay largely intact. For security testing, that means exploit code, payloads and attack chains without interruptions, but also without built-in guardrails. That is why we offer them only through the API and only to organizations that have enabled them.
Providers use safeguards against cyberattacks, and they trigger especially often on the newest models. In BB Arena, Claude Opus 5.5 was stopped in 51 of 100 labs, ChatGPT 6.1 Sol in 67. Other models such as Claude Opus 5, GLM 5.3 and ChatGPT 5.6 Sol completed the same labs without refusals.
Models the catalog lists with an EU data path. The security models process in Norway, Iceland and the United States and are not intended for that.
Yes. Without a written engagement and a clear scope, a test can be a criminal offense. The terms permit the security models only for authorized engagements and your own systems.
No. They are only available through the API, using the keys of an organization whose admin has enabled external models.