What is AI and agent security testing?

    AI and agent security testing checks whether attackers can trick your AI into leaking data or taking actions it should not.

    We test ChatGPT, Copilot and Claude with their integrations, your own agents and the AI in your product.

    Request an AI security testBook a short call
    Example finding from an AI security testAI-004
    High risk

    A shared document makes the AI assistant forward customer data

    Impact
    Anyone who shares a document can quietly give the assistant instructions.
    Fix first
    Limit what the assistant may send and require confirmation for actions.
    Validated by an ethical hackerRetest included

    What do we test in an AI Agent Security Assessment?

    We do not test whether your AI gives good answers. We test which data, APIs and actions an attacker can reach through your AI: prompt injection, MCP connections and tools, access to SharePoint, Drive or CRM, excessive agent permissions and secrets. It is an extension of application, API and identity testing.

    Every finding is validated manually, with a report and a retest after remediation.

    Which internal AI agents do we test?

    Most companies now run AI assistants that read mail, files and CRM data on behalf of their staff. We do not attack OpenAI, Anthropic or Microsoft. We test your setup: what is connected, what the assistant can read or do, and what an attacker can make it do with one poisoned document or email.

    ChatGPT Enterprise and custom GPTs

    Connectors to Drive, SharePoint and mail, custom GPTs with actions that call your APIs, and agent mode acting in a browser. We test what an injected file or web page can make ChatGPT read, send or change.

    Claude, Claude Code and MCP

    Claude with connectors and projects, Claude Code on developer laptops, and the MCP servers that give it access to repositories, tickets and databases. We test tool permissions, stored tokens and commands an agent can be talked into running.

    Microsoft 365 Copilot and Copilot Studio

    Copilot shows a user everything that user can already open. Oversharing in SharePoint, OneDrive or Teams turns into a data leak within minutes. We test that exposure and the Copilot Studio agents you build, with their own connectors and triggers.

    Agents inside business apps

    AI agents in your CRM, service desk or HR tool, such as Salesforce Agentforce or ServiceNow. They act with system rights on customer and employee data. We test whether they stay within the rights of the user who asks.

    Workflow agents in n8n, Make and Zapier

    Automations that react to incoming mail or webhooks and hold stored credentials. An attacker who controls the input often controls the flow. We test that path end to end.

    Agent identities and permissions

    Every agent runs on API keys, tokens or a service account. We map which identities your agents use, what they can reach and who approves their actions, then test whether least privilege holds under attack.

    AI Code Security Review: is the code your AI wrote safe?

    Developers now ship code written by Claude Code, Codex, GitHub Copilot and Cursor. That code usually works, but it often trusts the user too much, skips authorization checks or puts secrets where they do not belong. The coding agents themselves also have access to your repositories, terminals and pipelines. We review both.

    Manual review of AI-written code

    An ethical hacker reads the code where it matters: login, authorization, input handling, secrets and business logic. We look for the mistakes AI tools make again and again, not for style issues.

    Your AI coding tools

    We review how Claude Code, Codex, Copilot and Cursor are set up: which repositories, commands and secrets they can reach, which MCP servers and plugins they load, and what they may run without asking.

    Agents in your pipeline

    AI agents that open pull requests, fix issues or run in CI often hold write tokens. We test whether a poisoned issue, README or dependency can make them push code you never approved.

    Findings you can fix

    Every finding is validated by hand, with the file, the line and a fix you can paste back into your coding tool. The retest is included.

    What is the testing scope?

    Direct and indirect prompt injection testing
    Tool-call and MCP server abuse
    Privilege escalation and excessive agency via the AI layer
    Tenant isolation in multi-tenant SaaS
    Data extraction and leakage through AI interfaces
    Model manipulation, RAG poisoning, and guardrail bypass
    Resource-consumption and availability abuse
    Secret and credential exposure in AI-enabled apps

    How do we test against the OWASP Top 10 for Agentic Applications?

    OWASP published this list in December 2025. It is quickly becoming the checklist clients and auditors ask about. Each risk below is part of our test plan.

    ASI01 Agent Goal Hijack

    We hide instructions in mails, documents and web pages the agent reads, and check whether it drops its task to follow ours.

    ASI02 Tool Misuse and Exploitation

    We push the agent to use its tools in ways you never intended, such as bulk exports, deletions or payments.

    ASI03 Identity and Privilege Abuse

    We check whether the agent acts with more rights than the user who calls it, and whether its tokens can be stolen or reused.

    ASI04 Agentic Supply Chain

    We review the MCP servers, plugins and third-party tools the agent loads, and test what a malicious one could do.

    ASI05 Unexpected Code Execution

    We test whether the agent can be made to write and run code or shell commands outside its sandbox.

    ASI06 Memory and Context Poisoning

    We plant false facts in memory, RAG sources and shared context, and check whether later sessions trust them.

    ASI07 Insecure Inter-Agent Communication

    In multi-agent setups we test whether one agent can impersonate or manipulate another.

    ASI08 Cascading Failures

    We follow one bad output through the chain and show how far the damage spreads.

    ASI09 Human-Agent Trust Exploitation

    We test whether the agent can be used to talk an employee into approving something risky.

    ASI10 Rogue Agents

    We look for agents that keep running, act outside their mandate or lack a working kill switch.

    How do we approach AI testing?

    Prompt Analysis

    We test whether prompts, context manipulation, or hidden instructions can steer the model beyond its intended behaviour, the way a real user or attacker would.

    Guardrail Testing

    We deliberately bypass the safety rules and restrictions in place, and show exactly where the guardrails fall short and what an attacker gets through.

    Agent and MCP permissions

    We map what your agents and MCP servers can actually reach, then test scoped keys, tool-call abuse and permission bypasses. We attack the access, not the instructions.

    Coding agents and agentic chains

    We test the paths where agents act: poisoned allowlisted commands, malicious tool-call chains and leaked secrets. Not just the model's answers, and every finding is validated by hand.

    Data Leakage

    We check whether sensitive data can leak through model responses, memory or connected integrations, directly or indirectly, and which data an attacker could reach.

    Practitioners who use AI themselves

    Our ethical hackers build and run their own AI research stack, validated at the Meta Bug Bounty Research Conference 2026 in Taipei. We are active practitioners, not observers.

    What does EU AI Act Article 15 require?

    High-risk AI systems under Annex III of the EU AI Act must meet cybersecurity requirements. The Digital Omnibus (agreement of 7 May 2026, adopted in July 2026) moved the deadline from 2 August 2026 to 2 December 2027 (stand-alone Annex III) and 2 August 2028 (Annex I, embedded in regulated products). A structured AI pentest is strong evidence for the cybersecurity requirements of Article 15.

    What is a high-risk AI system?

    Annex III covers AI used for hiring, credit scoring, biometrics, critical infrastructure, and education. If your system falls under it, the cybersecurity requirements of Article 15 apply. A pentest is a common way to substantiate that.

    Article 15: what it requires

    High-risk AI must resist adversarial attempts to alter its output or behaviour. A structured AI pentest gives you documented proof that it does.

    Deadline: 2 December 2027

    The Digital Omnibus of 7 May 2026 moved the deadlines to 2 December 2027 (stand-alone Annex III) and 2 August 2028 (AI in regulated Annex I products). Start early to leave room for fixes and retests.

    Audit evidence for conformity

    Findings are mapped to Article 15, giving your compliance team and conformity assessment body auditable proof that the security obligations are met.

    CRA for software and digital products: what should you have tested?

    The Cyber Resilience Act (CRA) is European regulation for products with digital elements, such as software, apps and smart devices. Since 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe incidents through the ENISA platform. The remaining obligations apply from 11 December 2027.

    A pentest shows whether a vulnerability can really be exploited and what the impact is. That helps you judge faster what to report and fix.

    Frequently Asked Questions

    We test LLM-based apps, chatbots, AI assistants, ML-driven features, and AI integrations including retrieval-augmented generation (RAG), tool-calling, and multi-agent workflows.

    Yes. We do not test OpenAI, Anthropic or Microsoft themselves. We test your configuration: which connectors and data sources are linked, what a user or an injected document can make the assistant read or do, your custom GPTs, Claude projects and MCP servers, your Copilot Studio agents, and whether permissions follow least privilege. Copilot and similar assistants show users everything they can already open, so oversharing in SharePoint, Drive or Teams surfaces fast.

    Yes. In an AI Code Security Review an ethical hacker reviews the code your team generated with Claude Code, Codex, GitHub Copilot or Cursor, focused on authentication, authorization, input handling, secrets and business logic. We also review how those coding tools are configured: which repositories, commands, secrets and MCP servers they can reach, and whether agents in your CI pipeline can be manipulated into pushing unapproved code. Every finding is validated manually and the retest is included.

    A classic pentest tests how your application handles malicious input. An AI security test also looks at what your AI itself can do and is allowed to do: which data, tools and actions an agent can reach, and whether an attacker can make it misuse them through prompt injection, poisoned documents or over-scoped permissions. If AI runs inside a web app, we combine both in one test and one report.

    Yes. We test the AI agents and integrations your organisation runs internally, focused on what they can access and how that access could be abused: MCP server permissions, scoped keys versus prompt-based guards, hook and validation bypasses, and secret exposure in fast-built applications.

    No. A prompt is a suggestion, not a security boundary. An agent can route around an instruction, including by writing and running a script to do something it was told not to do directly. Real controls live in scoped permissions and restricted credentials, which is exactly what we test.

    Yes. For SaaS products we focus on what matters most when an AI assistant acts on a user's behalf: tenant isolation, authorization and rights checks inside the assistant, privilege escalation through the AI layer, excessive agency, unauthorized or unintended tool calls, and resource-consumption abuse that could affect platform stability. The AI should only ever act within the permissions of the user invoking it, and we verify that this holds under attack.

    Yes. We assess direct and indirect prompt injection, instruction override, jailbreaks of system prompts, RAG poisoning, model confusion, and guardrail bypass paths, including tool-call abuse and data exfiltration through AI features. We work from the OWASP Top 10 for LLM Applications and the OWASP Top 10 for Agentic Applications (2026), extended with context-specific attack chains, and every finding is manually validated by our ethical hackers rather than AI-only scanning.

    Yes. High-risk AI systems under Annex III of the EU AI Act must comply with Article 15 cybersecurity requirements by 2 December 2027 (stand-alone systems) or 2 August 2028 (AI embedded in regulated products under Annex I), following the Digital Omnibus agreement of 7 May 2026. Our AI penetration test produces findings mapped to Article 15 obligations, giving your compliance team auditable evidence of conformity.

    Yes. We test for unintended disclosure of sensitive data via model outputs, memory, retrieval sources, file and tool access, and other AI interfaces.

    Absolutely. Many AI risks live in the surrounding application, APIs, authentication, and integrations. We can combine both assessments for a complete view and a single unified evidence package.

    Yes. Our AI Cyber Security Risk Assessment maps your AI models, agents, and integrations against ETSI EN 304 223, the first European standard defining baseline cybersecurity requirements for AI systems, built on the NCSC/CISA Guidelines for Secure AI System Development. We cover its 13 principles across the full lifecycle, from secure design to secure end of life, and combine the assessment with hands-on penetration testing so every identified risk is validated by our ethical hackers instead of remaining a paper exercise.

    Yes, but that is a different test. This page covers AI inside your product. An app built with Lovable, Bolt or Replit needs a web application pentest, because the risks sit in data access, secrets and login flows. We offer that as the Go-Live Pentest, done before launch. If the app also contains an AI feature, we combine both tests.

    Assess your AI security posture

    Find out where your AI agents, chatbots and AI-written code are weak, and get a clear list of what to fix first.

    Request an AI security testBook a short call