AI agent security audit for agentic AI security

• Agent loop

  We review the loop that turns a message into a tool call. Untrusted text from a user, a page, a file, or a tool result can replace the task. That is ASI01 Goal Hijack, and LLM01 Prompt Injection when the loop treats the text as an instruction. When one agent sends a task or a result to another, we review who can send and whether the receiver treats the message as a new goal. That is ASI07 Inter-Agent Communication. A single agent with no second agent has no such channel in scope.

• Tools

  We review which tool may run, which arguments it accepts, and what it is allowed to change. Model output is not a permission. That is ASI02 Tool Misuse, LLM05 Improper Output Handling, and LLM06 Excessive Agency when one tool can spend, delete, deploy, or read data it should not.

• MCP servers

  We review each MCP server the agent is configured to call: authentication on the transport, the tool definitions, and what a tool result is allowed to change. When that server is third-party, or someone other than the reviewed build can change which server the process connects to, that is ASI04 Supply Chain. The review that stays on the server itself is the MCP security audit.

  MCP security audit

• Memory

  We review what persists across turns, sessions, and users, who can write it, and whether a stored entry becomes a standing instruction. That is ASI06 Memory and Context Poisoning.

• Credentials

  We review which identity the agent uses, whether one credential serves every user, and whether a tool result can grant a permission. We also review whether a credential is written into the prompt, a tool argument, or a reply. That is ASI03 Identity and Privilege Abuse and LLM02 Sensitive Information Disclosure.

• Model loading

  We review the format the weights use, the loader, and who can replace the file the process loads. Some formats run code on load. That is ASI05 Unexpected Code Execution, ASI04 Supply Chain, and LLM03 Supply Chain.

Check our work before you send code

• Published reports
• Report format and severity
• Methodology
• Terms of engagement
• Responsible disclosure
• security.txt

How every finding is graded

• Critical

  Funds or safety, exploitable as scoped.

• High

  Serious, less immediate than critical.

• Medium

  Bounded loss or a broken assumption that does not yet have an exploit path in scope.

• Low

  Defense in depth.

• Informational

  An observation with no security impact as scoped.

Questions about AI agent security audits

• What does an AI agent security audit cover?

  The agent loop, the tools it can call, the MCP servers those tools reach, the memory it keeps, the credentials it holds, and the code that loads the model. We trace each path from untrusted input to an action.

• What is agentic AI security?

  Agentic AI security is that review. The agent can take an action, so the work follows the loop, the tools, the MCP servers, the memory, the credentials, and the model loading. The quote is fixed after we read the scope.

• Which OWASP risks does this review cover?

  From the OWASP Top 10 for Agentic Applications: ASI01 Goal Hijack, ASI02 Tool Misuse, ASI03 Identity and Privilege Abuse, ASI04 Supply Chain, ASI05 Unexpected Code Execution, ASI06 Memory and Context Poisoning, and ASI07 Inter-Agent Communication when one agent sends a task or a result to another. From the OWASP Top 10 for LLM Applications: LLM01 Prompt Injection, LLM02 Sensitive Information Disclosure, LLM03 Supply Chain, LLM05 Improper Output Handling, and LLM06 Excessive Agency. The section above names which part of the system each id refers to.

• How is the quote set?

  The quote is fixed after we read the scope. We do not publish a starting price for this review. Smart contract audits publish a starting price on their page.

• What published reports can I read?

  Four published AI security audits: NVIDIA garak's Python package detector, vLLM's translation file field, image URL loading in mistral-common, and a shell breakout in a Baseten Truss image build. They are audits of AI tooling and inference code. Each one names the commit, the path, and the fix.

• Does the agent need to touch a blockchain?

  No. Most of these reviews have no chain. If the agent can also sign or move funds, that path stays in the same engagement.