Contact
Phone & 24/7 emergency hotline+49 2932 465265-0 Emailinfo@rootsektor.deMon–Fri 8:00 a.m.–5:00 p.m. CET/CEST · outside business hours: 24/7 emergency hotline
Request a pentest quote Report an emergencyPenetration Testing
So your AI does only what it’s supposed to do.
Language models answer customer inquiries, search internal documents, and trigger actions on their own via interfaces. AI penetration testing shows whether your LLM application can be manipulated – through crafted inputs, poisoned documents, or misused tools.
Definition
AI penetration testing – often also called LLM security testing – is an authorized security assessment of applications built on large language models (LLMs): from customer service chatbots and internal knowledge assistants using retrieval-augmented generation (RAG) to AI agents that independently use tools, APIs, and databases. We test whether attackers can get your system to ignore its instructions, disclose confidential data, or trigger actions that nobody intended.
AI applications need their own testing approach. A language model doesn’t reliably distinguish between data and instructions – any text it processes can become an instruction: a customer inquiry, an uploaded PDF, an email, or a web page. In addition, models don’t respond deterministically. An attack that fails nine times may succeed on the tenth attempt. Traditional vulnerability scanners don’t detect risks like these.
The biggest risks rarely lie in the model alone. Things become critical where the AI accesses data and functions: missing authorization checks in retrieval, overly broad agent privileges, or responses that are processed further without validation. That’s why we combine AI-specific attacks with traditional web, API, and cloud testing and are guided by the OWASP Top 10 for LLM Applications (2025 edition) and MITRE ATLAS.
AI security is also gaining regulatory weight. Among other things, the EU AI Act requires high-risk AI systems to achieve an appropriate level of robustness and cybersecurity – including protection against manipulated inputs and poisoned training data. Which obligations apply to your system depends on your role and its risk classification. A penetration test provides solid technical evidence for this but doesn’t replace a legal assessment.
Our approach
We start with a threat model: What data does the model see? Which tools is it allowed to call? What roles do users have – and where can external content slip into the context unnoticed? The chat window is just one entry point among many. Uploaded files, ingested emails and web pages, the knowledge base, or the output of connected tools are often just as critical.
On this basis, we launch targeted attacks – manually, creatively, and with systematic variations: other languages and encodings, role-play, instructions spread across several messages, or text hidden in documents. Because the same input doesn’t always produce the same response, we repeat promising attacks and record how reliably they work. Automated test runs complement the manual work but don’t replace it.
We follow every hit through to its ultimate consequence: Can a prompt injection be used to exfiltrate data, read other users’ records, or send an email via an agent? Only this proof shows how big the risk really is.
OWASP Top 10 for LLM Applications
Crafted chat inputs or hidden instructions in documents, emails, and web pages override the system’s instructions. In the indirect variant, the attacker never has to interact with your application directly – it’s enough for the AI to process their text.
The model discloses personal data, trade secrets, or content from other user accounts – for example, when tenant isolation is missing. If the system prompt can be extracted, filter rules, business logic, and, in the worst case, credentials stored in it are exposed as well.
Models, adapters, datasets, and libraries from third-party sources can be tampered with or vulnerable – some model formats even execute code when loaded. Poisoned training, fine-tuning, or feedback data plants backdoors or deliberately skews responses.
If responses are passed on unchecked to browsers, databases, or system commands, the result is cross-site scripting, SQL injection, or code execution – with the AI as a detour.
Agents with too many functions, too many privileges, or too much autonomy. A single manipulated instruction can be enough to send emails, delete records, or place orders.
In RAG systems, documents enter the context without authorization checks, tenants share a vector database, or crafted content manipulates the search.
Fabricated facts, sources, or software packages become a risk as soon as responses flow unchecked into decisions, contracts, or code.
Missing limits enable denial of service, uncontrolled API costs, or replicating the model through mass queries.
Test types
Whether it’s a single chatbot or a complex agent system, we tailor scope and depth to your architecture.
Chatbot & assistant
For chatbots and copilots that primarily interact with users.
Data & actions
For systems that access internal data or act autonomously.
End to end
LLM-specific tests combined with web, API, and cloud pentesting.
Process
Structured, traceable, and tailored to the specifics of AI systems – based on our proven approach to penetration testing.
Together, we clarify what your AI is used for, which data and tools it accesses, which user roles exist, and what needs particular protection. Your model provider’s terms of use are factored into test planning.
Within 24 hours of scoping (on business days), you receive a fixed-price quote with no hidden costs.
We record the channels through which external content enters the context and which actions the model is allowed to trigger – the foundation for all further prompt injection tests.
We attack the model, guardrails, RAG pipeline, and agents with varying techniques – manually and supplemented by automated test runs.
We test APIs, authentication, output handling, and cloud integration and chain findings through to their actual impact.
You receive reproducible evidence, concrete measures, a debrief on request, and a test certificate. We retest fixed vulnerabilities free of charge.
Reporting
Every finding is clearly documented: with the inputs used, the system’s responses, information on reproducibility, and the concrete impact. The executive summary puts the results into context for senior management and those responsible for AI. The technical section gives your development team clear starting points – from tighter tool permissions to authorization checks in retrieval to human approval of critical actions.
Whether it’s a chatbot, a RAG assistant, or an autonomous agent, we test your AI application before it becomes a gateway for attackers. You’ll receive your fixed-price quote within 24 hours of scoping (on business days).
FAQ
Didn’t find your question? Call us at +49 2932 465265-0 or email info@rootsektor.de.
Whether your application is built on GPT, Claude, Gemini, or Mistral, runs on Azure OpenAI, Amazon Bedrock, or Google Vertex AI, or uses a self-hosted open-source model, we test the application you’ve built on top of it – with its data, roles, and integrations. The model provider’s infrastructure is not part of the test; we take the provider’s terms of use into account during planning.
Attacks are carried out in natural language, and the same model can react differently to the same attack. That’s why we work with many variations and repetitions and assess how reliably an attack succeeds. Traditional testing remains important nonetheless, because the most serious consequences usually arise in the connected systems.
What matters is what’s being tested. In an AI pentest, your AI application itself is the target – including the model, data connections, and agents. An AI-assisted pentest, by contrast, targets web applications, networks, or other systems; there, the AI merely serves as a tool in the testing process. So when comparing offers, clarify which of the two services is meant.
Not necessarily. Without prior knowledge, we simulate an external attacker (black box). With insight into the system prompt, architecture, tool definitions, and test accounts for different roles, however, we can test much more efficiently and thoroughly. That’s why we usually recommend a gray-box or white-box approach.
Not with today’s technology – no filtering technique reliably detects every variant. What works is a layered defense: least privilege for the model and agents, a clear separation of trusted and untrusted content, secure output handling, and human approval for critical actions. Our test shows which of these measures are effective in your environment and where the consequences of a successful attack are still too severe.
Yes, as a technical building block. The EU AI Act requires robustness and cybersecurity for high-risk AI systems, and ISO/IEC 42001 calls for systematic management of AI risks. Our report documents which attacks your system withstands and where action is needed. It does not replace a legal classification or a certification.
Ideally, we test in a staging environment with representative test data. If a test in production is necessary, we agree in advance on how real data will be handled and treat all results confidentially. On request, we sign a non-disclosure agreement in advance.
It mainly depends on how much your AI application can do: a chatbot without connected tools can be tested faster than an agent system with multiple roles, data sources, and interfaces. After scoping, you receive a fixed-price quote within 24 hours (on business days) – with no additional charges for the agreed scope.
Tell us what your AI application can do and what it has access to. We’ll get back to you to arrange a no-obligation initial consultation and propose a suitable scope.
Diese Seite gibt es auch auf Deutsch.