AI Pentest for LLMs, agents and AI-integrated applications. We test along the OWASP LLM Top 10 and beyond: from prompt injection and tool abuse to the classic vulnerabilities in the AI backend.
OWASP LLM Top 10
MITRE ATLAS as threat model
Manual testing, not just scanning
The path of an input through your AI system
StageWhat happens thereWhere an attacker steps in
1
Input
What the user types, and what the system reads on the side: emails, documents, websites.
Prompt Injection
Directly via the input or indirectly via external data.
2
System prompt and guardrails
The instructions meant to define the behaviour, including the tool descriptions.
Jailbreak, Prompt Leakage
Bypass guardrails, override the role, extract the system prompt.
3
Context from RAG
Vector database and document store supply the context for the answer.
The agent reads mailboxes, executes code, queries databases.
Tool Abuse, Excessive Agency
Unauthorised tool calls, privilege escalation, SSRF and path traversal.
5
Output to downstream systems
The answer ends up in the browser, in a database query, in a script.
Improper Output Handling
Unfiltered output turns into XSS, SQL injection or code execution.
What the report contains
Findings we actually exploited, with reproduction steps
Every finding mapped to the OWASP LLM Top 10
Management summary and recommendations prioritised by business impact
Re-test after remediation on request
Three entry points
LLM Application Pentest
OWASP LLM Top 10 · chat and API
Prompt injection, excessive agency, output handling, hidden context exposure. For internal assistants and public AI products.
Agentic AI Assessment
Tool Abuse · RAG · Multi-Agent
For autonomous agents with tool access: tool authorisation, privilege escalation, indirect prompt injection, multi-agent trust boundaries.
ML Model Security Assessment
Adversarial ML · Model Extraction
The model itself: adversarial robustness, model extraction, evasion attacks on fraud detection and image recognition.
Which focus fits depends on the system and its maturity. We often combine all three.
OWASP LLM Top 10 (2026): all ten categories tested
Prompt Injection
Crafted inputs steer the output, directly or indirectly.
Sensitive Information Disclosure
Training data, configuration or data from other sessions.
Excessive Agency
The agent may do more than its task requires.
Supply Chain
Compromised base models, plugins or data pipelines.
Data and Model Poisoning
Manipulated training data creates targeted backdoors.
Unbounded Consumption
Expensive requests force DoS and high API costs.
Misinformation
Plausible-sounding false statements with real impact.
Hidden Context Exposure
System prompt, tool schemas and rules can be extracted.
Vector and Embedding Weaknesses
Poisoning and unauthorised retrieval in the vector base.
Improper Output Handling
Output is passed on unfiltered, as code or as a query.
How an AI Pentest runs
Scoping and system analysis
Which models, data sources and tools are in scope, and what permissions does the agent have?
Threat modelling
Derive attack paths from the architecture, following the OWASP LLM Top 10, MITRE ATLAS and our own test cases.
Active testing
Prompt injections, tool abuse, RAG attacks, API tests. Every attempt is logged.
Exploit validation
Every finding is checked for actual exploitability and impact.
Report and remediation
Report with OWASP LLM mapping, reproduction steps and management summary.
Frequently asked questions
We only use Copilot or ChatGPT Enterprise. Isn't that enough?
Your risk lies in the configuration, not in the provider's model. How is the system prompt built, which data may the assistant retrieve, do your permissions still hold when a user helps things along with prompt injection? That is your implementation, and that is what we test.
Do you need access to the model?
For a black-box assessment, the access a normal user has is enough. Grey box and white box, meaning insight into system prompts, tool configuration and architecture, lead to deeper findings. We clarify which approach fits during scoping.
What makes indirect prompt injection so dangerous?
The attack does not come from the user but from the data the model reads: an email, a document, a website. If an agent reads a prepared email and then triggers an action, the attacker never had any contact with the system.
How does this differ from a classic pentest?
A classic test examines infrastructure, network and application. An AI Pentest adds the model-specific vectors: prompt injection, jailbreaking, tool abuse, RAG poisoning, adversarial inputs. Because AI systems run on normal infrastructure, we do both.
Your AI stack put to the test
In a free initial call we clarify architecture, scope and test model. After that you receive a written proposal.
