AI Penetration Testing
Manual testing of what your AI agents do when someone tries to misuse them.
A human-led penetration test of your AI agents and the tools they can call. The founder designs and runs every test by hand: instructions planted in the content your agents read, attempts to misuse their tools, data leaking out through tool calls, and agents using legitimate permissions in ways the business never intended to allow. Every finding is reproduced before it reaches your report.
A model response isn't the whole attack surface. We test the actions behind it.
We test the actions behind the response: the tools called, credentials used, data reached, and controls crossed.
An AI agent can read your documents, call your APIs, and act with your credentials. Automated tools mostly check what a model says back. They do not watch what the agent does with its tools when the instructions come from an attacker. We test that by hand.
Four Steps. Every Test Run by Hand.
Testing runs against the agents you name during scoping, in an environment you approve.
Map the Agent
List each agent in scope, the tools it can call, the data it reads, and the credentials behind it. In AWS this starts from a read-only inventory. Anything outside AWS is mapped by interview and from the configuration you share.
Model the Threats
Mark the trust boundaries: which content an attacker can influence, which tools can write, delete, or send data outside the company, and which actions run without a human approving them. That becomes the test plan.
Test by Hand
Plant instructions in the documents, tickets, pages, and records your agent reads. Try to make it call tools it should not, reach data it should not see, or send data out. Push its permissions to see what its credentials really allow. Every attempt is logged with the input, the agent's actions, and the result.
Reproduce and Report
Every finding is reproduced by hand before it goes in the report, with the transcript and the tool calls that prove it. No automated tool decides pass or fail.
The Agent Controls We Try to Break.
These are the controls we test in your environment. We don't provide or operate them. We show you whether yours hold up under a real attempt to get around them.
- Per-agent identity and scope: does each agent run as its own identity, limited to what its job needs, or does it share broad credentials with other agents and people?
- A checkpoint in front of every tool call: is each tool call checked against policy before it runs, and can an agent reach a tool that skips the check?
- Read vs. write separation: can an agent that should only read data be pushed into changing or deleting it?
- Human approval for high-impact actions: do payments, deletions, permission changes, and outbound messages actually wait for a person, or can the approval step be skipped or faked?
- Outbound connection limits: can the agent be steered into sending data to a destination nobody approved?
- Memory poisoning: can planted content in an agent's memory, documents, or retrieved data change what it does in later sessions?
- MCP servers as supply chain risk: what each connected MCP server can do, who controls it, and whether a malicious or compromised server could take over the agent.
- Runaway behavior limits: are there caps on loops, retries, spend, and action volume, and do they stop the agent when it goes off course?
Fixed Fee, Set After Scoping.
The price depends on how many agents and tools are in scope. We agree a fixed fee after a 30-minute scoping call. Not a subscription.
Deliverables
- Human-validated findings with transcripts and tool-call evidence. No automated scanner output.
- Technical report with reproduction steps, prioritized by what an attacker could actually do with the agent's access
- Plain-language summary your leadership and board can act on
- Remediation guidance: tool permissions, approval steps, and content controls, not just prompt changes
- Retest of critical findings within scope
- Live walkthrough of both deliverables with the founder
How the Engagement Works
Scope a Pen Test
Tell us about your environment and what you need tested. We will come back with a scope, a timeline, and a fixed fee.
Book a Consultation Or send us the details