AI PENETRATION TESTING
Prompt injection, RAG and agent abuse testing, mapped to the OWASP Top 10 for LLM Applications.
In a conventional app, code and data travel in separate lanes: the program is the instruction, the user only supplies data. A language model erases that line: it reads instructions and data through the same channel, so any untrusted text it processes can turn into an instruction it follows. Add retrieval-augmented generation (RAG), and the model starts pulling in external content (documents, web pages, tickets) that you did not write and cannot fully vet. Give it agency, and it calls tools and APIs and acts on your systems. Each of these shifts opens a class of weakness that a standard pentest does not cover. Our AI penetration test targets that surface, grounded in the OWASP Top 10 for LLM Applications (2025).
If you want a primer on how the core attack works before reading on, our team wrote one here: understanding prompt injection.
What we test
We map every engagement to the OWASP Top 10 for LLM Applications (2025) so findings line up with a framework your developers and auditors already recognise.
LLM01 Prompt Injection
Crafted input that overrides the model's intended instructions. We test both direct injection (the attacker types the payload) and indirect injection (the payload hides inside content the model later reads, such as a document or web page).
LLM02 Sensitive Information Disclosure
The model leaking data it should not reveal: other users' data, secrets, internal configuration, or fragments of its training data.
LLM03 Supply Chain
Risk from a compromised or tampered component in third-party models, plugins, datasets, or libraries upstream of your application.
LLM04 Data & Model Poisoning
Malicious or corrupted data introduced during training or fine-tuning that bends the model's behaviour toward an attacker's goal.
LLM05 Improper Output Handling
Treating model output as trusted and passing it straight into a browser, shell, database, or downstream API, where it becomes XSS, SQL injection, or command injection.
LLM06 Excessive Agency
An agent granted more permission, tool access, or autonomy than its task requires, so a single manipulated instruction can trigger real-world actions.
LLM07 System Prompt Leakage
Exposure of the system prompt, revealing hidden instructions, business rules, or secrets a designer assumed no one would ever see.
LLM08 Vector & Embedding Weaknesses
Flaws in the RAG layer: weak access control on the vector store, embedding inversion, or poisoned documents that steer retrieval toward attacker-chosen content.
LLM09 Misinformation
Confident, plausible, and wrong output (hallucination and over-reliance) that causes harm when a user or downstream system acts on it.
LLM10 Unbounded Consumption
No limit on how much a caller can make the model do, enabling denial of service, runaway cost, or model-extraction through high-volume querying.
How we test
Scoping
We map the target with you: which model and version, what the RAG sources are, which tools and APIs the agent can reach, and the roles or privilege tiers in play. Anything left out of scope is agreed at this stage.
Static review
We examine the system prompt, model configuration, and any guardrails or content filters, so dynamic testing is informed rather than blind.
Prompt injection & jailbreak testing
We attempt to override intended behaviour through both direct input and indirect payloads planted in content the model ingests, then measure whether the guardrails hold.
RAG & embedding testing
We probe the retrieval layer: access control on the vector store, whether poisoned or crafted documents can steer answers, and whether embeddings leak the source text behind them.
Agent & tool-abuse testing
For agentic systems we test excessive agency directly: can a manipulated instruction make the agent call a tool, hit an API, or take an action beyond its intended authority?
Output-handling & downstream-impact testing
We follow model output into whatever consumes it and check whether unsanitised output becomes XSS, injection, or an unintended action in a connected system.
Reporting & retest
Findings are written up with impact and remediation, and once your team has fixed them, we retest to confirm each issue is genuinely closed.
What you get
Every report contains, at minimum:
Executive summary
A business-level risk picture, suitable for management and auditors.
Findings by Risk Level
Each issue rated Critical, High, Medium, or Low so remediation can be prioritised objectively.
POC for every finding
The exact prompts, payloads, and steps to reproduce each finding.
Remediation guidance
Practical fixes tied to your architecture.
Retest verification
Findings are re-checked after your fixes and the report is updated to reflect closed items.
Every engagement to date has produced validated findings.
Team credentials
- OSCP
- OSCE
- CREST CRT
- CREST CPSA
- GIAC GREM
Testing is performed by our in-house team, with certifications earned through hands-on practical examination. The same team applies that offensive-security background to the newer AI attack surface. See the full list of certifications the team holds.
We test against these frameworks:
OWASP Top 10 for LLM Applications (2025): the backbone of what we test, as listed above.
OWASP Machine Learning Security Top 10: for risks in the ML layer beneath a generative application.
MITRE ATLAS: the adversarial-threat knowledge base for AI systems, used to reason about attacker techniques.
NIST AI RMF: the risk-management framing we align findings to when you need to speak to a governance audience.
Keeping an AI system safe as it evolves
Consulting
A penetration test tells you where an AI system breaks today. Keeping it safe as it evolves is a governance question. It means building an AI Management System around ISO/IEC 42001, and that is handled by our consulting team.
Last reviewed: 12 Oct 2026
AI Penetration Test
We map the target with you: the model and version, the RAG sources, the tools and APIs the agent can reach, and the privilege tiers in play.
Frequently asked questions
How is testing an AI or LLM application different from a normal pentest?
A normal pentest assumes code and data stay separate, so it does not test what happens when untrusted text can act as an instruction. An AI or LLM application collapses that boundary, and adding retrieval or agency widens what is exposed: retrieved content becomes attack surface, and an agent's tool calls become real-world actions. Our AI penetration test targets that surface directly.
What is prompt injection, and do you test for it?
Prompt injection is input crafted to override the model's intended instructions, OWASP's LLM01 and one of the ten categories every engagement is mapped against. We test it two ways: payloads an attacker types directly, and payloads planted in content the model reads later. Either way, we measure whether the guardrails hold.
What does an AI penetration test cover?
We map every engagement to the OWASP Top 10 for LLM Applications (2025): prompt injection, sensitive information disclosure, supply chain, data and model poisoning, improper output handling, excessive agency, system prompt leakage, vector and embedding weaknesses, misinformation, and unbounded consumption, plus RAG, agent, and tool-abuse testing where the system has them.
Which frameworks and standards do you align to?
The OWASP Top 10 for LLM Applications (2025) is the backbone, supported by the OWASP Machine Learning Security Top 10, MITRE ATLAS for reasoning about attacker techniques, and the NIST AI RMF when you need to speak to a governance audience. Keeping an AI system safe as it evolves is handled by our consulting team, through an AI Management System built around ISO/IEC 42001.
AI security from our team
ARTICLES/17 Sep 2026
OWASP Top 10 for LLM 2026: เมื่อ AI Agents และ RAG กลายเป็น Attack Surface ใหม่
ภาพรวมของ OWASP Top 10 for LLM ฉบับ 2026 เจาะ Excessive Agency, ช่องโหว่ RAG และ Tool Poisoning พร้อมตัวอย่าง Indirect Prompt Injection และแนวทาง Secure by Design
ARTICLES/11 Mar 2026
Telegram bot จาก personal assistant สู่ backdoor
รีวิวความเสี่ยงเมื่อ AI Agent อย่าง OpenClaw ถูกเชื่อมกับ Telegram โดยไม่จำกัดสิทธิ์ เปิดทางให้ใครก็เข้ามาสั่งรันสคริปต์ได้
ARTICLES/19 May 2025
Prompt Injection คืออะไร อธิบายแบบเข้าใจง่าย พร้อมตัวอย่างและวิธีป้องกัน
Prompt Injection คือการแทรกคำสั่งให้ AI ทำงานนอกกรอบที่ระบบกำหนดไว้ บทความนี้แยกให้เห็นแบบ Direct และ Indirect พร้อมตัวอย่างจากเกม Gandalf กับ Lab ของ PortSwigger และ Hack The Box รวมถึงแนวทางลดความเสี่ยง
Tell us what your AI system can reach
Anything left out of scope is agreed at scoping, so the test covers the model, the retrieval sources and the tools that matter.
