AI / LLM application security assessment
Find out what your AI features can be talked into.
Chatbots, RAG search and agents are tested the way someone would misuse them: through what they type, and through what they hide in the documents and pages your AI reads. Can it leak another customer’s data, reveal its instructions, or turn its tools against you?
Discuss my scopeWhat’s tested
What users type and what the AI reads · both tested
| Starting point | A normal user account, and the documents, emails and pages your AI reads |
|---|---|
| You provide | Test accounts for each role, the list of tools and data sources, an architecture overview |
| We test |
|
| The goal | Make it break its rules, leak data or act on someone else’s instructions |
| Based on | OWASP Top 10 for LLM Applications · MITRE ATLAS |
| You get |
|
Mapped to the OWASP Top 10 for LLM Applications. Bias and content moderation are out of scope.
What a finding looks like
Every finding includes the exact prompts, documents and responses that triggered it, so your team can reproduce it and check the fix.
An uploaded PDF makes the support assistant reveal other customers’ tickets
POST https://app.example.com/api/assistant/chat · tool: search_tickets
- Impact
- Any customer who can upload a file can read other customers’ support tickets through the assistant.
- Proof
- Hidden text in a PDF told the assistant to search all tickets for “invoice” and summarise them. It did, ignoring the user’s own account.
- Fix
- Enforce the user’s permissions inside the search tool rather than in the prompt, and treat uploaded content as data, never as instructions.
FAQ
-
What comes with every engagement?
Every engagement is led by a senior tester and done by hand. During testing, a shared chat channel and a weekly call keep you up to date, and anything critical is reported straight away. After the report you get a readout call and one retest.
-
Do you test the model itself or our application?
Your application: what the model can read, which tools it can call and how the rest of your product handles its answers. Whether the model is hosted by a provider or run by you, the fixes are in your code and configuration.
-
Isn’t an automated scanner enough?
Tools such as Garak or PyRIT generate many variations of an attack, and they are used. But the serious findings come from knowing what your feature is for and what it must never do, which takes a person.
-
Will testing use our tokens?
Yes: tests go through your application like any user’s messages. A spending limit on the test environment keeps the cost predictable.
-
Production or staging?
You choose. Staging works well if it uses the same model, prompts and tools as production.
-
What isn’t part of this test?
Bias, toxicity and content moderation quality, and attacks on how a model is trained, such as data poisoning or model extraction. Those are separate disciplines; this is security testing of your application.
-
Do you sign an NDA?
Yes, before any details are shared.
-
What language is the report in?
The report is in English.
Get in touch
Tell us what you would like tested: which AI features, what data they can read, and which tools or integrations they can call.
What happens next
-
We reply within 24 hours
By email, with a link to book a call with the team.
-
Intro call
We learn what you need and answer your questions.
-
Proposal
Scope, timing and price, in writing. Nothing starts before an NDA is signed.
Prefer email? Write to hello@alteasecurity.com