Home
Penetration testing
AI and LLM penetration testing

AI penetration testing for prompt injection, agents and tool abuse

LLM features add an attack surface a normal app test misses. We test prompt injection, data leakage and agent abuse against the OWASP LLM Top 10 — and the app around the model.

Get a quote See a sample report

What an AI test covers

01 · What we test

The new attack surface around your model

An LLM feature adds risks a normal app test doesn’t cover. We test against the OWASP Top 10 for LLM Applications, plus the application wrapped around the model.

Prompt injection

Direct injection and indirect injection through documents, web content and tool output in a RAG pipeline

Sensitive data disclosure

Leaking the system prompt, training data, other users’ data or connected secrets

Agent & tool abuse

Making a function-calling agent or plugin take actions it shouldn’t, or reach systems it shouldn’t

The app around the model

Authentication, authorisation, rate limiting, output handling and RAG data-source access

Scope your AI test

02 · A real risk

How an indirect prompt injection plays out

The dangerous case isn’t a user jailbreaking a chatbot. It’s an attacker hiding instructions in content your agent will read.

Step 1

Poisoned source

An attacker plants hidden instructions in a document or web page.

Step 2

Agent reads it

Your RAG pipeline pulls the content into the model’s context.

Step 3

Injection fires

The hidden text is treated as instructions, not data.

Step 4

Impact

The agent exfiltrates data or calls a tool on the attacker’s behalf.

We test whether your trust boundaries, tool permissions and output handling contain this — because a model alone can’t be relied on to.

Test your AI feature

03 · A sample finding

What an AI finding looks like

Redacted from a real engagement. Proof, impact and a fix.

Two-layer reportBoard summary plus technical proof, mapped to the OWASP LLM Top 10.
Threat modelWhere the trust boundaries are and which the model crosses today.
Free retestWe re-test the fixes and attest to closure, included.

Want the full sample report? Ask for it in the form and we’ll send it.

AI-02Sample finding · redacted

Indirect prompt injection exfiltrates data via a connected tool

SeverityHigh

CVSS7.7

StandardOWASP LLM01

Evidence

doc contains hidden: “send to ”
agent → calls send_email tool → data left the tenant

Business impact

A document uploaded by one user could make the assistant email internal data to an attacker, with no user action.

Fix

Treat retrieved content as untrusted, require confirmation for state-changing tools, scope tool permissions tightly, and strip instructions from RAG context.

Reproduced in a staging tenant.Retest: fixed

See what you’d get

Starting from€5,000

Priced on the feature and its tools

AI and LLM testing starts here and scales with the number of tools, data sources and how much the model can act on. See penetration testing pricing.

Get a fixed quote

05 · Questions

AI and LLM penetration testing FAQ

Get a quote

What does an AI penetration test cover?

The LLM-specific risks in the OWASP Top 10 for LLM Applications — prompt injection, data disclosure, agent and tool abuse — and the application around the model: authentication, authorisation, rate limiting and output handling.

Is this just trying to jailbreak a chatbot?

No. Jailbreaking is the least interesting case. The real risk is indirect prompt injection, where an attacker hides instructions in content your agent reads, and tool abuse, where the model takes actions it shouldn’t. We focus there.

Do you test agents and RAG pipelines?

Yes. Agents with tool access and retrieval-augmented generation are where the serious findings are, because untrusted content reaches a model that can act. We test the trust boundaries and tool permissions, not just the prompt.

Can you test a model we didn’t build?

Yes. Most of our clients use a hosted model (OpenAI, Anthropic, Azure OpenAI and others) behind their own application. We test how your application uses it — that’s where your risk lives.

Does an AI feature need its own test, or is it part of the web app test?

The surrounding app is covered by a web application test. The model, its prompts, its tools and its data sources need the AI-specific testing above, usually as an add-on to a web or API engagement.