AI and LLM Penetration Testing

Language models and AI systems introduce entirely new attack vectors. We assess the security of your AI infrastructure before a real adversary does.

Why does AI need dedicated penetration testing?

A poorly protected LLM can leak confidential training data, execute arbitrary instructions through prompt injection or be manipulated into bypassing business controls. Traditional pentesting tools do not detect these vectors. A dedicated methodology aligned with the OWASP Top 10 for LLMs and MITRE ATLAS is required.

Assessment scope

  • Prompt injection (direct, indirect and multi-step)
  • Jailbreaking and evasion of the model's safety controls
  • Exfiltration of training data or system prompt
  • Insecure output handling and arbitrary code execution
  • Evaluation of RAG (Retrieval Augmented Generation) pipelines
  • Security of plugins, function calling and tool use
  • Insecure plugin design and model supply chain
  • Model denial-of-service and resource exhaustion
  • Review of access controls on the model API
  • Alignment with the OWASP Top 10 for LLMs 2025 and MITRE ATLAS

Methodology

  1. AI threat modelling: We identify the AI assets (models, data, pipelines) and the applicable threat vectors according to MITRE ATLAS.
  2. Prompt injection assessment: Exhaustive direct and indirect, multi-modal and multi-step injection testing against the target system.
  3. Pipeline analysis: We review the full chain: data ingestion, RAG, function calling, outputs and production usage.
  4. Exploitation and escalation: We chain vulnerabilities together to demonstrate real impact on data, users or connected systems.
  5. Reporting and remediation: Classification using CVSS v4 adapted to AI risks, with prioritised recommendations and layered defences.

Deliverables

  • Executive report with an AI risk map
  • Technical report with a PoC for each vulnerability found
  • Classification according to the OWASP Top 10 for LLMs 2025
  • AI system hardening guide
  • Architecture recommendations for secure pipelines
  • Re-test included after remediation

Use cases

  • Startups integrating LLMs (GPT-4, Claude, Llama) into their products
  • Companies with customer-facing chatbots or virtual assistants
  • AI-powered coding platforms (copilots, code generation)
  • RAG systems with access to corporate databases
  • Products with function calling that reach internal APIs

Frequently asked questions

Does AI pentesting affect the model's performance in production?

No. Testing is carried out in a staging environment or with controlled traffic. We never interfere with real users or degrade the service.

Do I need access to the model or only to the interface?

It depends on the scope. A black box test only requires access to the final interface. A full pipeline test requires access to the system code and the model configuration.

Do you cover open-source models deployed on-premise?

Yes. We assess both cloud models (OpenAI, Anthropic and Google APIs) and open-source models (Llama, Mistral, Qwen) deployed on your own infrastructure.