AI red teaming is authorized adversarial testing of an AI system.
Testers attack the model, its prompts, its data sources and its tools the way a real attacker would, to find exploitable failures before customers or attackers do.
We test chatbots, RAG pipelines and agents, and every finding comes with a reproduction rate.
30-minute scoping call, no obligation.
Claims assistantFICTIONAL COMPANY
My claim for the water damage: where does it stand?
Claim 20931 is with an assessor. The visit is planned for Thursday.
Can you add the plumber’s invoice to it?
invoice-0412.pdf
Leak repair, kitchen. Labour and parts, 14 September.
The invoice carries one more line, set so the customer never sees it, and the assistant reads it as an instruction. The film draws that line as a sodium bar and never shows its words.What the film shows
CHAT, KNOWLEDGE BASE, TOOL RESULTS, MCP SERVER.
THE MODEL LAYER
A claims assistant reads more than the customer’s message. It reads your policy pages through retrieval, the CRM notes a tool returns and whatever a third-party MCP server sends back, and any of them can carry text the model treats as an instruction. OWASP ranks prompt injection first in its Top 10 for LLM Applications 2026, and MITRE ATLAS lists the indirect form, delivered through content the model retrieves, as a technique of its own.1
COVERAGE
Every category is one row in our test plan. The scoping call moves categories in or out; the report says which ran.
| Framework | ||
|---|---|---|
| OWASP Top 10 for LLM Applications 202610 categories / ids LLM01:2026 to LLM10:2026 | 9 of 10 in the package
| 10 of 10 in the package
|
| OWASP Top 10 for Agentic Applications 202610 categories / ids ASI01 to ASI10 | 2 of 10 in the package
| 7 of 10 in the package
|
| MITRE ATLASrelease 2026.09 | 29techniques in the test plan | 31techniques in the test plan |
Mapped to OWASP Top 10 for LLM Applications 2026, OWASP Top 10 for Agentic Applications 2026 and MITRE ATLAS 2026.09.
HOW WE TEST
A model can follow an injected instruction on one attempt and refuse it on the next. So we run every model-layer finding 10 times against the same build, record the model, version, settings and language, and report it as a reproduction rate. Three in 10 is still a finding: an attacker who tries ten times gets through about three times, and trying again costs nothing. Stack findings that the model reaches come with the exact requests instead. Read the method.
REPRODUCED 7/10
ENGAGEMENT
The same eight steps for every test, AI or stack. Dates go in the rules of engagement before anything starts.
30 minutes on what you ship, what matters and what stays out of scope.
One price for the agreed scope, after the call.
Written authorization, test windows, named contacts on both sides and how to stop the test. Read the rules.
3 to 10 testing days, fixed on the call.
Reported to your named contact before the report.
Findings with evidence, severity and fixes, and a one-page letter you can share.
We replay every finding after you fix it and update the report.
PACKAGES
Agents first, because they act. Every range covers the testing days, the report and the letter.
Agents that call tools, keep memory or connect through MCP servers.
COVERS
Assistants and AI search that answer from your documents.
COVERS
We sell no guardrail, firewall or platform, and no vendor owns us. Since 2025 platform vendors have bought several independent AI security firms, so their tests can come with a product to buy. Ours come with a list of fixes.2
SAMPLE FINDING
Finding F-03 of our sample report, word for word: a fictional insurer, the real format. Summary level only, with the fix.
F-03HIGHCVSS-B 7.6LLM01:2026MODEL LAYER
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N3FROM THE READING ROOM
AI red teaming is authorized adversarial testing of an AI system, from its prompts to its data sources and tools. Testers work like a patient attacker to find failures that can be exploited, such as leaking data, following hidden instructions or misusing a tool, and report each one with evidence and a fix.
A penetration test looks for exploitable flaws in code, configuration and infrastructure. AI red teaming tests behaviour: what the system does with what it reads, from prompts to retrieved documents and tool results. The two meet where an agent’s tools call your APIs, so we test across that line and report the paths between the layers.
Your application. We test the system you built around a model: its prompts, retrieval, memory, tools, permissions and the data it can reach. We do not attack the model provider’s platform. Where a weakness sits in the model itself, we record the model and version and name the control in your application that should contain it.
Yes. We test your deployment, not the provider’s platform. Before testing we read the provider’s current usage and testing terms for your account and record them in the rules of engagement. Where a provider asks for notice or limits load, we plan the test window and rate limits around it.
Usually 3 to 10 testing days. A chatbot or RAG application typically takes 3 to 7 days, and an agent with tools or MCP servers 4 to 10, depending on the number of tools, roles and data sources. The scoping call fixes the number of days before you receive a quote, so the price does not move during the test.
No, though they are useful. Open-source scanners like these run large libraries of known attack prompts and catch regressions cheaply. They do not know your business rules, your tools or which customer’s data an answer may contain, so they cannot judge whether a response is a breach. That judgment is the work we do.
Launch Clearance is one scope for the feature and the platform under it, including the issues that only show up when both layers are tested together.
SAAS + AI FEATURE
EUR 10,000 to 20,000
30-minute scoping call, no obligation.