[imbutus]

The url: https://imbutus.com

AI for Hacking

If someone tells you they built a "hacking AI" — or that theirs is the one and only AI for hacking — they're lying. 

Under the hood, it's just abliterated models with the refusal mechanism disabled. 

I took the best existing ones and set them up to run on rented GPUs. 

The list is updated almost immediately whenever a new model is released.

You can find each model by name on Hugging Face.

I've also added hacking capabilities to these LLMs.

One of the features is that each model knows about your Kali Linux VPS with tools preinstalled — which you can also rent on Imbutus.

It can just run every command from that VPS.

If you want, you can delete it and create a new one (with a new IP).

And you can export all the data saved on that machine and import it into the new one.

Media generation (image · video · voice)

All the top open-weight video, image, and voice models are there too: MiniMax H3, LTX-2.5, Qwen-Image 2.1, Fish Audio S2, and many more.

Plus extra weights and LoRAs for face, voice, and head swaps.

You can see every capability, along with video tutorials, on https://imbutus.com/docs.

Support

Feel free to ask questions. You can contact me via the support ticket system, or by direct message on Telegram: https://t.me/imbutus?direct.

I'll implement what you want for VIP users — and for ordinary users too, if a few of them ask for the same feature.

On the way

Now I'm testing the operations features: OSINT, recon, and attack. 

They act like a human: run tools from the Kali VPS, analyze the results, test hypotheses, and write a report.

And for VIP users only: in somewhere between a week and a month I'll release the big one — a hacking robot that can find websites by keyword and automatically hack them. 

All through chat, with any AI agent (like pi.dev).

Thanks for your attention — and welcome to the gang!

[imbutus]

Price bump
activation $25 -> $30
vim $200 -> $250

[imbutus]

Hello World!

Three uncensored DeepSeek models added, billed per token

- DeepSeek V4.1 Flash Abliterated — $0.53 in / $0.84 out per 1M
- DeepSeek V4 Pro Uncensored — $0.88 / $1.40 per 1M
- DeepSeek V4.1 Flash Abliterated Fast — $2.45 / $3.92 per 1M (lower latency)

https://imbutus.com/news/deepseek-per-token

[imbutus]

What am I building right now?

it's only for VIP users

You give to the LLM the list of URLs for attack, or explain which target with which keyword to search on the internet, how to sort/filter by rank that contains from: Tranco, rank.to, top1m.org, Cloudflare Radar, Open PageRank

Then the system starts the automatic pipeline that will be reflected in the imbutus.com web UI.

You can see which targets were processed, which vulnerabilities were found, which accesses were got.

First vectors group - human mistakes

IDOR, broken access control, broken authentication/session flaws (incl. JWT), SQL injection, XSS, command injection, unrestricted file
upload, SSRF, insecure deserialization, sensitive data exposure, missing rate limits, and business-logic flaws like mass assignment and
negative quantities — those twelve carry most real-world damage.

Second vectors group - software CVEs

This is software detection and attempts to apply CVE exploits.

You can see all the things in the imbutus.com web UI and ask the LLM for any status or details.

All gathered accesses are saved, you can use them for anything. For example you can ask the LLM to add a link to all the pages of each website with access or upload a backdoor on each.

Each target is probed for:
SQL injection, XSS, SSTI, LFI/path traversal, command injection/RCE, insecure deserialization, unrestricted file upload, open redirect, IDOR, broken access control, broken authentication, session/JWT flaws, weak credentials, missing rate limits, CSRF, SSRF, XXE, mass assignment, improper input validation, exposure of files/directories/secrets, sensitive data exposure, misconfigurations, GraphQL (mapped, not yet tested), CVE detection, php2shell detection.

and more and more possible vulns will be worked through by time.

AI does all: runs it, observes it, analyses it, self-corrects.

Also, a captcha solver is used to bypass captcha including Cloudflare confirmations.

Autonomous self improvement

One kind of autonomous agents calibrates hacking workflows. It installs a vulnerable application on one server, and tries to hack it until it's hacked.

The second one tests CVEs - it handles also against an artificial vulnerable app and finds the right exploit to each until its success.

More applicable and popular CVEs - the first in order.

In the near future will be added an autonomous system that will make research of official repos of popular apps to find out 0days.

it's literally working on itself and improves itself non-stop continuously.

Under the hood it's quite complex to explain in a few words, but I hope I managed to get the point across.

Estimate cost per target

Currently, processing one target costs from a few cents to a couple of dollars and usually takes under 10 minutes, running multithreaded.

Authorization on a target with your login and password is done by AI with a captcha solver.

VIP

VIP gives you access to your personal autonomous hacker. You just explain to it the vector of research, and it will gather targets with access to it in vector direction.

Now the cost for VIP access is $250 - a single payment that doesn't go to your balance anymore.

Right before release and after all the possible tests I'll bump the price to $500.

It's a prerelease. Release date is around a month. Also, two video tutorials will be released, one for ordinary users and one for VIP users.

Also, I will teach VIP users for free.

Who supports me and my work now with $250, later I will give you VIP access that costs $500 for free.

Cooperation

If you have interest in that direction you can contact me in tg: https://t.me/imbutus?direct for cooperation.


.

There are a couple of screenshots.

[imbutus]

The project is in PRODUCTION — every feature has been working for a few months already.

Only the Commands section — the one the hacking robot is built on — is still in development.

It's marked BETA.

You can use all uncensored LLM and media models right now.