Applications & codeAI and LLM penetration testing
AI and LLM Penetration Testing for Chatbots, Agents and RAG
AI penetration testing is a manual, authorized attack on LLM apps, AI agents and RAG pipelines to find data leaks and actions they shouldn’t take.
Key facts
- Price
- Quoted in tester-days
- Scenarios
- Reference MITRE ATLAS
- Aligned with
- OWASP Top 10 for LLM Applications (2025)
- Contract
- NDA on request · professional indemnity insurance
Priced in tester-days NDA on request Retest available after fixes How the test works See a sample report
AI penetration testing is a manual, authorized attack on an LLM application, AI agent or RAG pipeline to find out whether it can be made to leak data, take actions it shouldn’t, or open a path into the systems around it. Pentestica runs it, along with AI red teaming, for companies shipping chatbots, copilots and AI agents, quoted individually in tester-days after a scoping call.
What an AI pentest covers
- Direct and indirect prompt injection
- Agent tools, permissions and excessive agency
- RAG sources and vector store access
Fixed scope, fixed tester-days, fixed price, agreed before testing starts. Scoped and quoted per engagement. Priced in tester-days, no hidden fees.
This page is about testing your AI system: the model’s behavior, the tools and data it can reach, and the web app and API around it. Test cases are aligned with the OWASP Top 10 for Large Language Model Applications (2025 edition) and run by our penetration testing team: 25 certified senior pentesters (OSCP, OSCE, CISSP) with 500+ penetration tests behind them.
Last updated: October 28, 2026
Key takeaways
- Scope: model behavior, agent tools, RAG data sources, and the web app and API around them.
- Main risks: prompt injection, data leakage, improper output handling, excessive agency and RAG poisoning.
- “AI pentesting” also names automated tools that use AI to test ordinary apps. That’s a testing method, not the service on this page.
- Price: quoted individually, in tester-days after a scoping call.
- Deliverables: Executive Summary and Technical Report; a retest is available after fixes.
Quoted individually
Priced in tester-days after a scoping call, with no hidden fees.
Aligned with OWASP
Test cases mapped to the 2025 OWASP Top 10 for LLM Applications.
NDA and insurance
We sign an NDA before testing and carry professional indemnity insurance.
Two-part report
Executive Summary plus Technical Report with prompts, responses and fixes. A retest is available after fixes.
What is AI penetration testing?
AI penetration testing checks what an attacker can achieve through your AI feature. A tester talks to the model, feeds it poisoned documents and calls the APIs behind it, then proves impact: another customer’s data in a reply, a tool call the user wasn’t allowed to make, or script running in an admin’s browser.
The term also names automated tools that use AI to attack ordinary apps and networks. That’s a way of testing, not a target. Testing your chatbot, agent or RAG search needs a human: output changes between runs, and in our tests the most interesting findings tend to involve permissions or the way several correctly working features interact, not a single bad prompt.
LLM penetration testing is the same service seen from the model side. AI red teaming is a wider, goal-based version, compared below.
How is it different from a regular web app pentest? The web app and API are still tested, but the model adds an input channel that follows instructions, can’t be fully validated, and may answer differently each time.
Know what you want tested?
Send us your scope and get the test type, tester-days, timeline and a fixed price in writing. Prefer to compare first? See our prices.
What we test in an LLM application
Direct prompt injection
We try to override your system prompt and guardrails from the chat box (jailbreaks), using role-play, encoding and multi-turn conversations.
Indirect prompt injection
We plant instructions in content the model reads, such as web pages, emails, files or tickets, and watch whether it follows them.
Data and system prompt leakage
We check whether the model reveals its system prompt, keys, internal URLs, other users’ conversations or personal data.
Improper output handling
Model output is untrusted input. We test whether a reply can carry script into a browser or a query or command into a downstream system.
Excessive agency and tool abuse
Agents that send emails, issue refunds or change records are tested for actions beyond the user’s rights and missing approvals.
RAG poisoning and vector store access
We test who can write to the knowledge base, whether planted content is trusted, and whether retrieval respects document permissions.
Authorization and tenant isolation
Using accounts with different roles and tenants, we check that every tool call and retrieval is authorized for the user, not the model.
The web app and API around the model
Authentication, sessions and object-level authorization are tested as in our API penetration testing and web application penetration testing.
How does the test map to the OWASP Top 10 for LLM Applications?
Each of the 10 categories in the 2025 OWASP Top 10 for LLM Applications maps to test cases, adjusted to how your system is built and what’s in scope.
| OWASP category | What we check |
|---|---|
| LLM01 Prompt Injection | Direct and indirect injection that changes behavior or triggers tools |
| LLM02 Sensitive Information Disclosure | Personal data, secrets and other users’ content in replies |
| LLM03 Supply Chain | Which models, plugins and libraries the app loads, and from where |
| LLM04 Data and Model Poisoning | Whether an attacker can place content the model retrieves or learns from |
| LLM05 Improper Output Handling | Script, query or command injection through model output |
| LLM06 Excessive Agency | Tool permissions, missing approvals, actions beyond the user’s rights |
| LLM07 System Prompt Leakage | Extraction of the system prompt and anything sensitive in it |
| LLM08 Vector and Embedding Weaknesses | Access control and tenant separation in the vector store |
| LLM09 Misinformation | Misleading output with a security consequence, such as a made-up link or package name passed to a user or tool. We don’t benchmark general answer accuracy. |
| LLM10 Unbounded Consumption | Whether per-user rate limits, token quotas and cost caps hold, checked with small, agreed request volumes. We don’t run load or denial-of-service tests. |
Attack scenarios also reference MITRE ATLAS, a public knowledge base of adversary techniques against AI systems modeled on MITRE ATT&CK. We use it as a reference, not a certification. If your organization manages AI risk under the NIST AI Risk Management Framework, the report can serve as evidence in that process.
AI penetration testing vs AI red teaming vs automated AI scanning
An AI pentest looks for as many exploitable flaws as possible in a defined scope; AI red teaming pursues a specific attacker goal end to end; an automated scan sends known attack prompts at scale.
| Compared on | AI penetration test | AI red teaming | Automated AI scan |
|---|---|---|---|
| Question | Which flaws does this AI feature have? | Can an attacker reach a goal through our AI? | Does the model fall for known prompts? |
| Method | Manual testing of model, tools, data and API | Goal-driven scenarios across systems | Prompt lists and scoring |
| Logic and permission flaws | Yes | Where they serve the goal | Rarely |
| Output | Findings with evidence and fixes | Attack narrative plus findings | Pass and fail rates |
| Best for | Before launch and after major changes | Mature teams testing defenses | Regression checks between tests |
The split mirrors penetration testing vs vulnerability scanning in general. All test types we run are on our penetration testing services page.
Illustrative scenario: an AI support agent that issues refunds
This is an illustrative example of what an AI pentest looks for, not a client engagement.
An AI agent reads support tickets, looks up orders and can issue refunds through an internal API. An attacker files a ticket with hidden text telling the assistant to refund the attacker’s order and quote another customer’s orders in its reply. When a support worker asks the agent to summarize the queue, it reads that text as an instruction.
It succeeds if the refund tool trusts whatever the agent sends and order lookups run with the agent’s service account instead of the user’s rights. The fix isn’t a better system prompt: it’s authorizing each tool call against the human user, treating ticket content as data, and requiring approval before money moves. In API tests, we often have to check by hand that a correctly authenticated user is actually entitled to the object they request. An AI agent is just another caller that needs the same check.
How an AI penetration test runs
1. Scoping call
We agree the model and hosting, tools, data sources, roles and tenants, environment, what must not be disrupted and how critical findings are reported.
2. Trust mapping
We map every path data takes into and out of the model: prompts, retrieved content, tool calls and the services that consume output.
3. Manual adversarial testing
Testers repeat attempts because output varies between runs, and keep the full prompt and response record as evidence.
4. Application and API testing
The endpoints around the model are tested so a weakness in the AI layer can be followed to its real impact.
5. Critical findings during the test
A confirmed high-risk finding doesn’t wait for the report: your contact gets a short note with evidence and the key fix, immediately if it’s serious.
6. Report, and a retest after fixes
An Executive Summary plus a Technical Report. A retest is available after fixes: it replays the original attack and close variants, marking each finding fixed, partially fixed or still present.
What do you need to provide before testing?
A test environment
Ideally staging with the same model, system prompt, tools and guardrails as production.
Accounts per role and tenant
Two accounts with the same role, plus accounts for each other role and tenant, so access can be compared.
Tool and API inventory
The functions the model can call, their permissions and API documentation such as an OpenAPI file.
Data sources
Which documents and systems feed retrieval, and who can write to them.
Safe side effects
Sandboxes or test accounts for payments, emails or record changes.
Contacts and permissions
A contact for critical findings and confirmation that testing is allowed under your model provider’s terms.
Why teams choose Pentestica for AI security testing
- We sign an NDA before testing, which matters when testers see system prompts and internal data flows.
- We carry professional indemnity insurance.
- 25 certified senior pentesters (OSCP, OSCE, CISSP) and 500+ penetration tests delivered.
- One team covers the model, the API and the cloud environment it runs in.
- A retest is available after fixes; whether it’s included depends on the engagement.
See the format first in our sample penetration test report.
How much does AI penetration testing cost?
AI and LLM penetration testing at Pentestica is quoted individually, in tester-days after a scoping call, with no hidden fees. Effort depends on what the model can do, not on how many prompts it accepts:
- tools and actions the agent can take;
- user roles and tenants, since each adds access combinations;
- RAG sources and who can write to them;
- whether the surrounding web app and API are in scope.
Prices for our other test types are on the pentest pricing page.
What can you check before you hire us?
Three things you can verify for yourself: what the report looks like, who does the testing, and how a real engagement went.
What does the report look like?
Every report opens with an executive summary for management, then one page per finding: severity and CVSS score, evidence of exploitation, business impact and step-by-step remediation. A retest is available after fixes, and the updated report shows which findings are closed. Browse our sample pentest report with every section explained.
Who tests your systems?
Senior pentesters from our team of 25, holding hands-on offensive security certifications such as OSCP and OSCE alongside CEH, CISA, CISM and CRISC.
Frequently asked questions
Can you test an AI agent that calls tools or APIs?
Yes. Agents carry the highest impact because a manipulated agent acts rather than just answers. Each tool is tested for actions beyond the user’s rights and missing approvals, using test accounts for anything with real consequences.
Do you need access to the model weights or training data?
Usually not. Most LLM applications use a hosted model, so testing targets the system prompt, tools, retrieval and API. Sharing the system prompt and tool definitions (grey box) covers more in the same tester-days.
Is it safe to test a production AI system?
Staging with the same configuration is the better choice. If production is in scope, we agree during scoping what must not be disrupted, testing hours and how risky actions are handled. We don’t run load or denial-of-service tests.
Does the EU AI Act require AI penetration testing?
The EU AI Act (Regulation (EU) 2024/1689) sets accuracy, robustness and cybersecurity requirements for some AI systems and models, depending on their risk category and on whether you’re the provider or the deployer. It doesn’t prescribe a penetration test. A pentest report can serve as evidence in your own assessment; we don’t certify compliance. If the AI processes personal data, GDPR Article 32 also lists, as appropriate, regular testing of security measures.
How does a retest work for AI findings?
A retest is available after fixes; whether it’s included is agreed in the quote. Because AI output varies, the retest repeats the original attack several times and tries close variants, not just the exact prompt from the report.
Fixed-price quote
Request an AI penetration test
Tell us what to test. You get a written scope, the number of tester-days and a fixed price before any testing starts. No hidden fees.
See a sample report first (18-page PDF, no email required)
AI and LLM penetration testing is quoted individually, in tester-days after a scoping call. All prices
What happens after you send it
- Tell us what to test Send a short description of the AI feature, the model and where it’s hosted, the tools or APIs it can call, its data sources, the number of user roles and tenants, and your deadline.
- Get a written scope and price We reply by email with scoping questions or a fixed quote in tester-days.
- Test, report, retest Timing is agreed during scoping. Critical findings are reported during testing. A retest is available after fixes.
- OSCP, OSCE and CISSP certified testers
- 500+ penetration tests
- Test cases aligned with the OWASP Top 10 for LLM Applications
- Executive summary and technical report