AI and LLM penetration testing
Language models and AI systems introduce entirely new attack vectors. We assess the security of your AI infrastructure before a real adversary does.
Scope your project · Request an AI assessment
Rather talk it through? Call us at +34 960 730 013
Why does AI need dedicated penetration testing?
A poorly protected LLM can leak confidential training data, execute arbitrary instructions through prompt injection or be manipulated into bypassing business controls. Traditional pentesting tools do not detect these vectors. A dedicated methodology aligned with the OWASP Top 10 for LLMs and MITRE ATLAS is required.
Assessment scope
- Prompt injection (direct, indirect and multi-step)
- Jailbreaking and evasion of the model's safety controls
- Exfiltration of training data or system prompt
- Insecure output handling and arbitrary code execution
- Evaluation of RAG (Retrieval Augmented Generation) pipelines
- Security of plugins, function calling and tool use
- Security of AI agents and MCP (Model Context Protocol) servers: tool poisoning, escalation across connected tools and context trust confusion
- Insecure plugin design and model supply chain
- Model denial-of-service and resource exhaustion
- Review of access controls on the model API
- Alignment with the OWASP Top 10 for LLMs 2025 and MITRE ATLAS
Methodology
- AI threat modeling: We identify the AI assets (models, data, pipelines) and the applicable threat vectors according to MITRE ATLAS.
- Prompt injection assessment: Exhaustive direct and indirect, multimodal and multi-step injection testing against the target system.
- Pipeline analysis: We review the full chain: data ingestion, RAG, function calling, outputs and production usage.
- Exploitation and escalation: We chain vulnerabilities together to demonstrate real impact on data, users or connected systems.
- Reporting and remediation: Classification using CVSS v4 adapted to AI risks, with prioritized recommendations and layered defenses.
Deliverables
- Executive report with an AI risk map
- Technical report with a PoC for each vulnerability found
- Classification according to the OWASP Top 10 for LLMs 2025
- AI system hardening guide
- Architecture recommendations for secure pipelines
- Retest included after remediation
Use cases
- Startups integrating LLMs (GPT-4, Claude, Llama) into their products
- Companies with customer-facing chatbots or virtual assistants
- AI-powered coding platforms (copilots, code generation)
- RAG systems with access to corporate databases
- Products with function calling that reach internal APIs
- Companies deploying AI agents connected to internal tools via MCP or other orchestration protocols
Frequently asked questions
Does AI pentesting affect the model's performance in production?
No. Testing is carried out in a staging environment or with controlled traffic. We never interfere with real users or degrade the service.
Do I need access to the model or only to the interface?
It depends on the scope. A black-box test only requires access to the final interface. A full pipeline test requires access to the system code and the model configuration.
Do you cover open-source models deployed on-premises?
Yes. We assess both cloud models (OpenAI, Anthropic and Google APIs) and open-source models (Llama, Mistral, Qwen) deployed on your own infrastructure.
Do you assess AI agents and MCP servers?
Yes. An agent connected to several MCP servers inherits the trust of whichever tool is weakest. We test for tool poisoning, privilege escalation across connected tools, and exfiltration through a legitimate output channel (posting a message, sending an email, opening a PR).
Related resources
Ready to protect your business?
Answer the scoping form at your own pace and we'll use it to prepare your proposal. If you'd rather talk first, book a free 30-minute call.