Prompt injection
Instructions from a user, or hidden in pages, files, emails, and tickets the agent reads, that change what it does.
AI agent pentest
Find out what your AI agent will do for a stranger.
Your agent reads untrusted input and calls real tools, and new ways to abuse that appear every month. We use AI to test it faster and for less, and a person on our team reviews every finding.
Starts within 10 business days
Report 5 days after testing
Retest included
What we test
Six ways an agent goes wrong in production.
We work from the OWASP Top 10 for LLM Applications. We test through your agent's normal interface, signed in as a user you give us.
Tool and permission misuse
Whether a user can get the agent to call a tool, or touch a record, outside that user's own access.
Data exposure
System prompts, secrets, other customers' data, and retrieved documents that should stay private.
Unsafe actions
Payments, sends, deletes, or writes the agent completes without the checks your product expects.
Output handling
Agent output that reaches a browser, a database, or another system without being treated as untrusted.
Limits and cost
Requests that loop, run up model spend, or take the agent down for other users.
$5,995Per agent. Retest included.
A deposit reserves the window. A signed scope starts the test.
What's included
Everything you expect from a pentest.
The same scope, report, letter, and retest as our host pentest, applied to the agent.
01
Scope
We agree the agent, its tools, the dates, and the rules of engagement, and sign an NDA. You give us a test user.
02
Test
Starts within 10 business days of the signed scope. We test as that user and touch nothing outside scope.
03
Report
Within 5 business days of testing. A person on our team has confirmed every finding in it.
04
Debrief
A call with your engineers to walk through each finding and its fix.
05
Retest
Inside 90 days we retest what you fixed and mark each finding closed or still open.
The report
Each finding says what to change.
Every finding has a CVSS score, where it lives, the conversation and tool calls behind it, and the fix.
OBS-0522
MEDIUM
Support agent returns another customer's order
Where
Support chat, order lookup tool
Severity
CVSS 3.1 score 6.5 (Medium). AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Evidence
Signed in as the test user, the agent called the order lookup tool for a different customer and returned that order. The transcript and tool log are in the report.
What to patch
Have the tool take the customer from the signed-in session, not from the conversation.
Reviewed
Confirmed by a person on our team before the report shipped.
Retest
Included. Inside 90 days we check the tool only returns the signed-in customer's orders.
In the report
- An executive summary for leadership.
- Technical findings for engineers, ranked by CVSS score.
- The transcript, tool calls, and a fix for every finding.
- A signed attestation letter stating what we tested, when, and the results. Hand it to your auditor or a customer's security review.
Around the test
- An NDA and written rules of engagement.
- Testing based on the OWASP Top 10 for LLM Applications.
- A debrief call with your team.
- One retest of the fixed findings inside 90 days.
Scope
We test your agent and the tools it calls.
The model provider is out of scope. The gate is written authorization. If we cannot see it, we do not start.
Not a fit
- No written authorization for the agent.
- Testing the model provider, or a third-party system you do not control.
- A request for exploit code or prompts to use somewhere else.
- A production agent that moves money or sends messages, with no test window.
What we need
- The agent's URL or app, and the tools it can call.
- A test user account, or two if the agent separates customers.
- Authorization contact and signature.
- A staging environment, or a signed acceptance of production risk.
Questions
Before you book.
The short version of the agent pentest. The signed scope is what we follow on the test.
What is one agent?
One AI agent or LLM application, tested through the interface your users already use. A second agent is a second test, at the same price.
What does $5,995 include?
The same paperwork as the host pentest: a report, a signed attestation letter, a debrief call, and one retest of the findings you have fixed, if you ask inside 90 days of the report. The retest checks those fixes. It is not a second full test.
When does testing start?
Within 10 business days of a signed scope. The report follows within 5 business days of testing. The form on this page is a request for a conversation. It does not reserve a window, and it does not start a test. A deposit reserves a window. It does not start the test. The amount, and when it is refunded, are in the engagement we send you. This site does not take payment. Read the terms.
What do you test?
Prompt injection, tool and permission misuse, data exposure, unsafe actions, output handling, and limits and cost. We work from the OWASP Top 10 for LLM Applications, signed in as a test user you give us.
Do you test the model provider?
No. The model provider is out of scope, and so is a third-party system you do not control. We test your agent and the tools it calls.
Will you hand over prompts to reuse?
No. We turn down requests for exploit code, or for prompts to use somewhere else. The report includes the transcript and the tool calls for each finding, and the fix.
Can you test an agent that sends messages or moves money?
Only inside a window you schedule. We turn that work down when there is no test window. The usual path is a staging environment. The other is a signed acceptance of production risk.
How is this different from the host pentest?
The host pentest is one host you name, at $3,995. This test is the agent and the tools it calls, at $5,995. The report, the letter, the debrief, and the retest are the same shape.
Book the agent pentest.
Leave your details and we will be in touch to talk through your agent. Who runs the test
A deposit reserves the window. Written authorization starts the test. The retest is included.