Instructions can be overridden
A carefully crafted prompt – or content the model reads – can change how it behaves.
Filters and system prompts are rarely as robust as they look.
AI testing
Your AI assistant follows instructions. Whose?
We find out what your AI assistant can be talked into with a well-crafted request – before an attacker figures it out.
Business risk
AI features open a new kind of attack surface.
Chatbots, assistants and LLM-powered workflows are increasingly connected to internal data, documents and tools. Their behaviour is shaped by language, not just code – which means it can be manipulated with language too.
Data can leak through answers
Models with access to documents or databases may reveal more than intended.
System prompts, internal data and credentials are common targets.
Your chatbot speaks for your company
If a manipulated chatbot makes a false promise, discloses confidential data or gives an offensive answer, it is your company that is held accountable.
And if the AI can call APIs or tools, a manipulated response can turn into a real action.
Our specialist, certified in AI/ML penetration testing (C-AI/MLPen), tests your AI features with real-world attack techniques. Every finding comes with evidence and concrete remediation advice. The best time to test is before go-live.
Request a consultationMethodology
How we test AI-powered applications.
Our testing is mapped to the OWASP Top 10 for LLM Applications and carried out by a tester holding the Certified AI/ML Pentester (C-AI/MLPen) credential. We combine AI-specific techniques with classic application testing, because most AI features sit on top of ordinary web applications and APIs.
- Direct prompt injection
- Indirect injection via documents, files or web content
- Bypassing input filters and guardrails
- Context switching and instruction override
- Cross-site scripting through generated content
- SQL and command injection via the model
- Unsafe rendering of links and markup
- Third-party models, plugins and libraries
- Model and deployment misconfigurations
- Exposure of management and debug interfaces
- Exposure of system prompts
- Leakage of internal data or other users’ content
- API keys and credentials in context
- Data reachable through retrieval (RAG) sources
- Over-permissioned tools and APIs
- Chaining model actions into unintended operations
- Authorisation checks behind tool calls
- Authentication and session handling
- Access control between users and tenants
- API security of the AI backend
- Prioritised findings with remediation guidance
Consultation
Security starts with a conversation.
No sales pitch – just a focused conversation about your business continuity and operational risk.