Web, API, and LLM features
AI penetration testing
AI penetration testing is an authorized attack on a running product that uses a model. An AI pentest of an LLM feature is LLM penetration testing: prompt injection testing, tool misuse, and model loading on the web app, the API, and the model path, with a proof for each exploitable finding and a retest after the fix.
prompt reviewed
Published AI reports you can open today
What the test covers
- Web applications
- APIs
- LLM features
- Prompt injection
- Tool misuse
- Model loading
- Exploit proofs
- Retest
What is AI penetration testing?
It is a human-led test of the running product, followed by a retest of the fix. The scope is the web app, the API, and the LLM features that share a session, a tool, or a key. The quote is fixed after we read that scope.
Three layers in one test:
Web, app, and API:
the screens and routes a person or another service can call, including the ones that invoke a model.
Prompt injection and tools:
direct injection in the user field, indirect injection in a page, a file, or a tool result, and the arguments a tool will accept.
Model loading:
the loader, the checkpoint, and the build that fetches weights or other external data.
What an AI pentest covers
We test the paths that turn model input into an action on the running system.
Web and app surfaces
The product a person uses: login, the agent or chat screen, and the session that ties that person to the model.
APIs
Routes that call a model, a tool, or a retrieval step, including routes the browser never shows.
LLM feature testing
The feature that sends user text, documents, or tool results into a model and then acts on the reply.
Prompt injection testing
Direct injection in the user field, and indirect injection from a page, a ticket, a file, or a tool result the model reads.
Tool misuse
A tool argument the model chooses: which tool runs, with which parameters, and whether a person has to confirm the call.
Model loading
The checkpoint, the loader, and the build recipe. A field that looks like a URL can still change the command the build runs.
A human-led test, then a retest
A human-led test writes an exploit proof and comes back for the retest.
Human-led penetration test
- Engineers test the running web app, API, and LLM features
- Prompt injection is followed to a tool call, a data read, or a stop
- Each exploitable finding includes a proof your engineers can reproduce
- The fix is retested after you deploy it
- The quote is fixed after we read the scope
Automated scan
- A tool reports the patterns it already knows
- The result is a score or a matched pattern
- The run ends when the scanner finishes
- A deployed fix waits for a later test
The quote is fixed after we read the scope: the applications, the LLM features, and the environments in the test.
Published reports you can open
Four published AI reports: NVIDIA garak, Baseten Truss, vLLM, and mistral-common. Each card opens the file that records the finding.
- PythonPypi misses dotted from imports and indented imports (opens the report in a new tab)
- A quote in the external_data URL becomes extra shell during docker build (opens the report in a new tab)
- translation skips the transcription string-file check (opens the report in a new tab)
- download_image calls requests.get with no timeout on the public encode path (opens the report in a new tab)
- image_from_chunk treats any "file" prefix as a local path and leaks the handle (opens the report in a new tab)
Check our work before you send code
How every finding is graded
Critical
Funds or safety, exploitable as scoped.
High
Serious, less immediate than critical.
Medium
Bounded loss or a broken assumption that does not yet have an exploit path in scope.
Low
Defense in depth.
Informational
An observation with no security impact as scoped.
Questions about AI penetration testing
What is AI penetration testing?
AI penetration testing is an authorized attack on a running product that uses a model. We test the web app, the API, and the LLM features, write a proof for each exploitable finding, and retest the fix after you deploy it.
What is LLM penetration testing?
LLM penetration testing is that test aimed at a feature that calls a model: the prompt, the tools, the retrieval, and the API in front of them. On this page it is the same engagement as an AI pentest.
Do you test prompt injection?
Yes. Prompt injection testing sends direct injection in the user field and indirect injection from a page, a file, or a tool result, and follows each one to a tool call, a data read, or a stop. The published reports on this page are separate files: garak's PythonPypi detector, a Truss external_data URL during docker build, vLLM's translation file check, and mistral-common image URL loading.
What is the difference between an AI pentest and an automated scan?
A human-led AI pentest exercises the running app, writes a proof for each exploitable finding, and retests the fix you deploy. An automated scan reports the patterns its tool already knows, and the run ends when the scanner finishes.
How is the quote set?
The quote is fixed after we read the scope: the applications, the LLM features, and the environments in the test.
Scope the test
Have the running AI product tested
Tell us the apps, the LLM features, and when we can test. We reply within two business days with a test plan and a fixed quote.
Related services
- sysusrModelTool
prompt reviewed
AI security audits
The code, loaders, and tools around the model.
entry found
Penetration testing
Web, API, mobile, and cloud, including paths that are not an LLM feature.