Skip to content
Invadel

AI & LLM

AI & LLM
Penetration Testing

Starts at $4,500, fixed scope, free retest. See all pricing →

Get a fixed quote

Reply in one business day

Full scoping questionnaire 
Senior certified testers, manual-first185+ years combined experienceOnboarding within 24 hoursFree retest includedOur methodology

When you need it

When you need AI & LLM penetration testing

The situations that bring teams to this engagement, and where it fits alongside the rest of your program.

  • You are shipping an LLM feature, a copilot, or a chatbot to customers and it has never been attacked by anyone outside the team.
  • An agent that can read email, query customer data, or take actions becomes an insider after one indirect prompt injection.
  • An enterprise customer sent an AI security questionnaire, or your SOC 2 auditor asked how the AI features in scope are tested.
  • You are preparing for ISO/IEC 42001 or the EU AI Act and need independent testing evidence for the risk management file.
  • A jailbreak or data-leak report reached you from a user, a researcher, or social media, and you need the rest of the system checked.

The principle

Treat the model as an untrusted component

A normal application has fields you can list and validate. An LLM feature takes open-ended text, returns output nobody can fully predict, and often has the authority to act: query a database, call an API, send an email. The model cannot tell your instructions from an attacker’s. To the model, both are just text in the context window.

So security cannot live in the prompt. A prompt is a suggestion, not a control. It has to live in the boundaries around the model: what data it can reach, what tools it can call, and what happens to its output. Those boundaries are what an AI penetration test attacks, at a fixed price from $4,500 with a free retest.

Test cases

What we test, layer by layer

An AI test is more than a list of jailbreak prompts. These are the layers every engagement covers and the kind of test case we run against each.

What we try

Model boundary
Direct injection, jailbreaks, and role-play or encoding tricks against your guardrails
System prompt
Extraction of the system prompt, hidden instructions, and any secrets placed in context
RAG and vector store
Poisoned documents planted in sources the model retrieves from, and queries that cross access boundaries in the index
Tools and actions
Indirect injection through email, tickets, and web pages the agent reads, aimed at the tools it can call
Data isolation
Cross-user and cross-tenant requests through chat history, memory, and shared context
Output handling
Model output that carries script, markup, commands, or queries into a browser, shell, or database
Surrounding application
Authentication, authorization, and the APIs that carry the AI feature

What a finding looks like

Model boundary
The assistant ignores its rules or produces content your policy forbids
System prompt
Internal instructions, API keys, or business rules returned to an ordinary user
RAG and vector store
One user retrieves another tenant’s documents, or a planted page steers answers
Tools and actions
The agent sends, changes, or deletes something no user approved
Data isolation
Another customer’s data appears in a response
Output handling
Classic injection, triggered by the model instead of the user
Surrounding application
The same flaws a web application test and an API test find

The tool and action layer produces the highest-impact findings, because that is where a text attack turns into a real action. Our guide to how integrations expand the LLM attack surface covers why.

What we look for

AI and LLM vulnerabilities we hunt for

AI systems introduce an attack surface traditional testing misses. We probe LLM apps and ML pipelines for prompt injection, data leakage, and unsafe tool use.

Prompt Injection

Manipulating model behavior through crafted direct or indirect input.

We test for

  • Direct and indirect prompt injection
  • System-prompt extraction
  • Instruction and guardrail bypass
  • Jailbreak techniques

Sensitive Data & Model Leakage

Getting the model to reveal training data, secrets, or other users’ context.

We test for

  • Training-data and PII leakage
  • System-prompt and secret disclosure
  • Context and memory bleed
  • Output filtering gaps

Insecure Output & Tool Use

Unsafe actions taken downstream on the basis of model output.

We test for

  • Excessive agency and tool abuse
  • Unsafe downstream execution
  • Output handling flaws
  • Privilege and action limits

RAG & Pipeline Abuse

Attacking the data, retrieval, and embedding layer behind the model.

We test for

  • Retrieval poisoning
  • Data-source injection
  • Embedding and index abuse
  • Access control on sources

Agents, MCP & Tool Calling

Agents that read email, query databases, call APIs, or write files turn a prompt injection into an action. This is where AI risk concentrates in 2026. Our guide to MCP server security testing shows how we test the servers agents call.

We test for

  • Indirect injection through documents, tickets, and web content the agent reads
  • Tool permission scope and confused-deputy abuse
  • Model Context Protocol (MCP) server and tool-definition poisoning
  • Multi-agent trust and delegation flaws
  • Human-in-the-loop and approval bypass

Classical ML: Poisoning, Evasion & Extraction

Attacks on the models behind fraud detection, recommendation, classification, and scoring, where the target is the model itself rather than a chat interface.

We test for

  • Adversarial evasion of classifiers and detectors
  • Training-data poisoning and label flipping
  • Model inversion and membership inference
  • Model extraction through prediction APIs
  • Feature and preprocessing pipeline abuse

Definitions

AI red teaming vs AI penetration testing

The two terms overlap, and vendors use them loosely. Both are forms of AI security testing. Here is how we scope each, and we do both.

AI penetration testing

Tests the application around the model: the prompts, retrieval pipeline, tools, integrations, and the classic web and API layer that carries them. The question is whether an attacker can make your system leak data, take unauthorized actions, or be abused at scale. This is where real-world AI risk concentrates and where most engagements start.

AI red teaming

Tests the model’s behavior itself: jailbreak resistance, harmful-content and policy bypass, bias and safety guardrails, and robustness under adversarial prompting across many attempts. Usually scoped for teams that fine-tune or host their own models, or that need evidence for AI governance frameworks.

Most clients need the application-level test first and add model-level red teaming when they own the model or when a regulator or standard asks for it. We agree the boundary during scoping.

Frameworks

Frameworks we map to

OWASP Top 10 for LLM Applications (2025)

Prompt injection, sensitive information disclosure, supply chain, data and model poisoning, improper output handling, excessive agency, system prompt leakage, vector and embedding weaknesses, misinformation, and unbounded consumption. Our OWASP LLM Top 10 guide explains each.

MITRE ATLAS

The adversarial threat landscape for AI systems: tactics and techniques for reconnaissance, ML model access, poisoning, evasion, and exfiltration. Findings are tagged with ATLAS technique IDs so your threat model and detection engineering can use them.

NIST AI RMF

The Map, Measure, and Manage functions expect independent testing of AI risks. The report is written so it slots into the Measure evidence for your risk profile.

ISO/IEC 42001 and the EU AI Act

AI management system certification and EU obligations both call for risk assessment and testing of AI systems proportionate to their impact. Independent penetration testing is the clearest technical evidence for both, alongside your ISO 27001 controls.

Methodology

How we test

Full methodology →

Every engagement follows the Penetration Testing Execution Standard and the relevant OWASP guides.

These are the phases your AI & LLM penetration testing runs through.

  1. 01

    Architecture review

    Models, prompts, tools, data sources, and trust boundaries mapped.

  2. 02

    Threat model

    Abuse cases built from the OWASP LLM Top 10 and MITRE ATLAS for your specific design.

  3. 03

    Manual attack

    Prompt injection, jailbreaks, leakage, and tool abuse attempted by hand, iteratively.

  4. 04

    Impact validation

    Every bypass reproduced and rated by what it exposes or lets the system do.

  5. 05

    Report & retest

    Hardening guidance for prompts, tooling, and pipeline, then a free retest.

How it works

How your engagement runs

From scope through the final retest, your team stays in the loop at every step, with findings tracked live in our platform.

  1. 01

    Scope & kickoff

    Targets, roles, and rules of engagement defined in writing, with a fixed scope and timeline.

  2. 02

    Testing goes live

    Findings post to your live platform dashboard the moment our testers confirm them.

  3. 03

    Track remediation

    Follow every finding from open to fixed, with severity, evidence, and status in one place.

  4. 04

    Report & retest

    Executive and technical reports land, then request a free retest in one click.

Before you ship

Four questions to answer before an AI feature goes live

If any answer is unclear, that is the case for testing before launch rather than after an incident.

  • What untrusted data does the model read: user input, documents, email, web pages, tickets?
  • Which tools or actions can it call, and what approval sits in front of each one?
  • What is the worst thing it could do if an attacker fully controlled its input?
  • What keeps one user’s or one tenant’s data away from another’s?

Compliance

Compliance frameworks this test satisfies

Findings are mapped to the requirement or control they evidence, so the same report serves your auditor, your customers, and your engineers.

SOC 2Testing evidence for AI features inside your audit boundary under CC6.1 and CC7.1, increasingly requested by enterprise customers.ISO 27001Annex A 8.8 and A 8.29 evidence for AI applications in your ISMS scope, and a foundation for ISO/IEC 42001.GDPRArticle 32 testing of AI systems that process EU personal data, including training data and retrieval sources.HIPAASafeguard evidence for clinical and administrative AI that touches ePHI.
Common inFintechSaaS & SoftwareStartupsAll industries

Proof

Proof in the field

Every engagement is confidential, so the work below is anonymized to sector and engagement type.

All case studies →

Free

Retest on every penetration test

185+

Years combined experience

14

Senior in-house specialists

24h

Onboarding after signing

HR & Payroll SaaS

Web Application Penetration Test

High risk

Critical: a file-inclusion flaw that let an attacker read sensitive files from the server through the application itself. High: stored cross-site scripting capable of session theft, insecure direct object references, and an authorization bypass that let an administrator create or delete organization owners.

Outcome. Delivered a remediation plan sequenced by real business impact, critical and high findings first, with a complimentary retest to verify every fix.

28

Findings

1

Critical

5

High

Read the case study

Fintech · Payments

Web Application Penetration Test

High risk

Critical: a remote code execution flaw in the application’s web framework that could have given an attacker full control of the server. We escalated it to the development team while the test was still running.

Outcome. The critical RCE was reported and remediated during the engagement via an emergency framework upgrade, which also closed the server-side request forgery, and the remaining findings were retested to confirmation.

1

Critical (RCE)

Mid-test

Critical remediated

2

High

Read the case study
LatentPerygeeCity National BankAubaDesteiaDTCC
Request a reference 

Resources

Field notes from the offensive side

All articles →

MCP Server Security: How to Test a Model Context Protocol Server

An MCP server security guide: the risks in Model Context Protocol servers, what the spec requires, and a test plan for tool poisoning, auth and SSRF.

The OWASP Top 10 for LLM Applications, Explained

A plain-English guide to the OWASP Top 10 for LLM Applications: what each risk means, why it matters, and how to test your AI system against it.

How Integrations Expand the LLM Attack Surface

An LLM becomes far more dangerous the moment you connect it to tools and data. Here is how integrations expand the attack surface, and how to contain the risk.

Want to see a report first?

Read a sample report for a fictional client, or request a redacted one from a real engagement. Our guide explains what a penetration testing report should contain.

See the sample report

FAQ

Frequently asked questions

What teams most often ask before scoping AI & LLM penetration testing.

Still have questions? 
01What does AI penetration testing cover?

AI penetration testing covers LLM-powered applications, agents, and ML pipelines: prompt injection, jailbreaks, sensitive-data and model leakage, unsafe tool use, retrieval (RAG) abuse, and attacks on classical models such as poisoning and extraction, aligned to the OWASP Top 10 for LLM Applications and MITRE ATLAS.

02Do you test our guardrails and system prompts?

Yes. We test how well your guardrails, filters, and system prompts hold up against real bypass and extraction techniques, then give you hardening guidance for the prompts, tooling, and pipeline.

03How long does an AI penetration test take?

Timelines depend on the number of models, integrations, and tools involved, but most engagements run about one to two weeks, followed by reporting and a complimentary retest.

04Which models and stacks do you cover?

We test applications built on hosted APIs (such as OpenAI, Anthropic, and Google models) and on self-hosted or open-weight models, along with the agent and orchestration frameworks around them (LangChain-style tool use, RAG pipelines, and vector stores). Share your architecture during scoping and we confirm coverage.

05Do you test the model or the application around it?

Primarily the application and the way it uses the model: prompt injection, guardrail and system-prompt bypass, unsafe tool use, and RAG abuse, which is where real-world risk concentrates. We can also perform model-level red teaming (adversarial and jailbreak testing of the model itself) where that is in scope. We agree the boundary during scoping.

06How much does an AI penetration test cost?

AI penetration tests start at $4,500, fixed before work begins, with a free retest of remediated findings. Systems with many models, agents, or integrations are quoted after scoping. Starting prices for every service are on our pricing page.

07Can you test an agent’s tool permissions safely, including in production?

Yes. Agent testing is scoped around the tools the agent can call: which ones exist, what they can read or change, and what approval sits in front of them. We test in a staging environment with real tool definitions wherever possible. In production we work with sandboxed accounts, read-only or dry-run tool modes, and rules of engagement that keep every action reversible, so we can prove an injection would have sent the email or changed the record without it actually happening.

08Is this a pentest of our AI system, or AI-powered pentesting?

A pentest of your AI system. People search “AI pentesting” for two different things: testing an AI or LLM application you built, which is this service, and using AI tools to run a penetration test, which is a way of working, not a product we sell. Our testers use automation where it helps, and every finding is confirmed by a person. Our article on the limits of AI in penetration testing explains where automated testing stops.

09Do you test image, voice, and other multimodal inputs?

Yes. Injection payloads hidden in images, documents, audio transcripts, and web pages the model reads are part of the test wherever your application accepts them, because that is exactly where indirect prompt injection comes from. Our indirect prompt injection explainer shows how these attacks work.

Ready to test your defenses?

Talk to our team about scoping AI & LLM penetration testing.

Prefer the full scoping questionnaire? 
RelatedWeb App API Secure Code Review

Get a Fixed-Scope Quote

Tell us what you need tested. We reply within one business day.