AI penetration testing is offensive security applied to the systems you have built on top of large language models, agents, and machine-learning APIs. Traditional web and API testing does not cover a model that can be talked into ignoring its own instructions, so these engagements target the model layer directly alongside the application around it.
I test for prompt injection (direct and indirect through retrieved documents, emails, tickets or web content), system-prompt and context leakage, jailbreaks that bypass safety and business rules, insecure tool and function calling, excessive agency in autonomous agents, output handling flaws that lead to XSS or SQL injection downstream, RAG data-boundary violations across tenants, and denial-of-wallet through unbounded token consumption.
Testing follows the OWASP Top 10 for LLM Applications and MITRE ATLAS, combined with manual adversarial work that automated scanners cannot replicate. Every finding arrives with reproducible prompts or payloads, the concrete business impact, and a fix at the right layer — guardrail, prompt design, tool permission, or application control — followed by a re-test to prove the fix holds.
Why it matters
- LLM features ship fast and often bypass normal security review
- Prompt injection can turn a helpful assistant into an insider threat
- Agents with tool access can act, not just answer — blast radius is real
- Customers and regulators increasingly ask for AI-specific test evidence
My approach
How the engagement runs
Typical engagement: scoping of models, prompts, tools and data sources; threat modelling of the AI attack surface; manual adversarial testing plus automated red-team suites; prioritised findings report; remediation guidance and re-test.