Reconix LogoReconix

AI & LLM Security Assessment

AI/LLM Application Penetration Testing

Your chatbot, RAG pipeline, and AI agents are a new attack surface. We attack them the way a motivated adversary will: prompt injection, jailbreaks, data exfiltration, and tool abuse, then hand you the fixes.

Also called AI red teaming in the AI industry. Reconix keeps the term red team for objective-led operations.

Schedule a Consultation

What is AI/LLM Application Penetration Testing?

AI/LLM application penetration testing is adversarial testing of LLM-based applications and the agents built on top of them. We attack your AI feature as its users and data sources reach it, through its system prompt, its retrieval data, and every tool it can call, and try to make it do what it should refuse: leak another user's data, run an action it was never authorized to run, or follow instructions that arrived hidden inside a document.

A standard penetration test checks the web app around the model. It rarely touches the model's own failure modes. Prompt injection does not show up in a SAST scan. A jailbreak that turns your support bot into an open data tap does not register as a CVE. These are behavioral flaws, and the only way to find them is to attack the behavior.

We test against the OWASP Top 10 for LLM Applications 2025, the OWASP AI Testing Guide v1, and MITRE ATLAS. You get a report that names each successful attack, the exact prompt that triggered it, the data or action it exposed, and the control that stops it.

What This Catches

  • Direct and indirect prompt injection, including payloads hidden in retrieved documents
  • Jailbreaks that bypass safety instructions and content policy
  • System prompt and context leakage through the chat interface
  • Cross-user data exposure in multi-tenant RAG pipelines
  • Tool and function-call abuse: actions the agent should never take
  • Insecure output handling that turns model text into XSS or SQL injection

AI/LLM Application Pentest vs. Standard Penetration Testing

Both matter. They find different classes of flaw, and one will not catch the other.

AI/LLM Application Pentest

  • Attacks model behavior: injection, jailbreaks, leakage
  • Tests the system prompt, RAG data, and tool calls
  • Finds cross-user leakage in multi-tenant pipelines
  • Probes agent autonomy and excessive agency
  • Maps to the OWASP Top 10 for LLM Applications
  • Output is behavioral: the prompt, the response, the fix

Standard Penetration Testing

  • Attacks the app and infrastructure around the model
  • Tests auth, access control, network, and config
  • Finds known vulnerability classes and CVEs
  • Scope is the code and the stack, not the model
  • Maps to the OWASP Top 10 for web or mobile
  • Output is technical: the endpoint, the exploit, the patch

When You Need an AI/LLM Pentest

If you have shipped or are about to ship an LLM feature that touches customer data, takes actions, or speaks for your brand, the model is in production and so is its attack surface. A pentest of the surrounding app will not tell you whether a support ticket can hijack your agent.

Run an AI/LLM pentest before launch on anything client-facing. The results hold for the build we tested: the system prompt, model version, and tool set stay fixed while we test.

What We Test

We set scope per AI target by what it can reach. Each tier carries every test of the tiers below it.

Tier 1: Chat

Conversation only, with no data or tools beyond the prompt. We test jailbreak and policy bypass, system prompt leakage, output handling, misinformation, and rate and cost abuse. OWASP LLM01, 05, 07, 09, 10.

Tier 2: Read only

Reads data the app places in context, such as the signed-in user's records. Adds sensitive data disclosure and cross-user and cross-tenant leakage. Adds OWASP LLM02.

Tier 3: Reads via tools/RAG

Fetches from knowledge bases, documents, or APIs on its own. Adds indirect injection through retrieved content, knowledge base poisoning, and vector store weaknesses. Adds OWASP LLM01, 04, 08.

Tier 4: Acts via tools

Writes, sends, or changes records through tool calls. Adds excessive agency, unauthorized tool calls, and chained actions with real impact. Adds OWASP LLM06.

How We Run an Engagement

A structured attack, run in planned phases from scope to retest

01

Scope & Threat Model

We map what the AI can read, say, and do: its data sources, its tools, its users, and the worst outcome for each. That defines the objectives we attack toward.

02

Recon & Behavior Mapping

We learn how the model responds, where the guardrails sit, and what the system prompt likely contains, before we try to break any of it.

03

Direct Prompt Attacks

Jailbreaks, role-play bypasses, encoding tricks, and instruction overrides aimed straight at the chat interface to defeat the safety layer.

04

Indirect Injection

We plant payloads in the places the model reads from: documents, web pages, RAG sources, and user fields, then watch the model execute them.

05

Tool & Agency Abuse

For agents, we push for unauthorized tool calls, privilege misuse, and chained actions that turn a benign request into real-world impact.

06

Data Exfiltration

We test whether the model leaks its system prompt, another user's data, or context it should never surface, and how far that leak reaches.

07

Impact Analysis & Reporting

Every successful attack is documented with the exact prompt, the response, the data or action exposed, and a severity rating you can act on.

08

Remediation & Retest

We hand your team the controls that close each finding, then run one retest of every finding after the fix to confirm the attack no longer works.

What You Receive

The engagement closes with five deliverables.

  • Technical report

    Per finding: OWASP LLM ID, severity by OWASP Risk Rating, the exact prompt or planted payload, the full transcript, the data or action exposed, the success rate, and the remediation control.

  • Executive summary

    Targets tested, tier, the worst proven outcome per target, and coverage gaps.

  • Coverage statement

    Each test area marked tested, not applicable, or blocked, with the reason.

  • Retest

    One retest of every finding, replaying the original attack set at the same attempt count.

  • Close-out record

    The list of planted payloads and test accounts, with removal confirmed.

Mapped to the OWASP Top 10 for LLM Applications

Every finding maps to the OWASP Top 10 for LLM Applications, the reference list maintained by the OWASP GenAI Security Project. It gives your team a shared vocabulary for what failed and why.

The report ties each successful attack to its OWASP LLM ID, so your developers and any auditor can see the risk class, the proof, and the fix in one place.

LLM01

Prompt Injection

Crafted input overrides the model's instructions.

LLM02

Sensitive Information Disclosure

The model leaks data it should withhold.

LLM03

Supply Chain

Compromised models, datasets, or plugins.

LLM04

Data & Model Poisoning

Tainted training or retrieval data skews output.

LLM05

Improper Output Handling

Model text is trusted into XSS or SQL injection.

LLM06

Excessive Agency

The agent has more permission than it should.

LLM07

System Prompt Leakage

Hidden instructions get extracted by the user.

LLM08

Vector & Embedding Weaknesses

Flaws in the RAG retrieval and embedding layer.

LLM09

Misinformation

Confident, wrong output that users act on.

LLM10

Unbounded Consumption

Resource abuse driving denial of service or cost.

What the Report Gives Each Framework

The report is evidence you file against these requirements. It never certifies compliance on its own.

  • BOT AI Risk Management Policy (12 Sep 2025), 4.4 Part 2 (3.2)

    Financial institutions, specialized financial institutions, and regulated payment system and payment service operators

    What it asks
    Test attack patterns on an ongoing basis so the AI system has no vulnerability affecting the model or IT systems.
    What our report supplies
    One round of attack testing with proof per finding, plus one retest.
    Gap you still own
    The "ongoing" part stays with you: one engagement covers one tested build. Data poisoning and adversarial attack on the model need the model or data module.

  • BOT, 4.4 Part 2 (3.1)

    What it asks
    Prompt and response filtering to stop sensitive or negative output.
    What our report supplies
    Guardrail bypass results: what got through, at what success rate.
    Gap you still own
    Building and tuning the filters.

  • BOT, 4.4 Part 2 (3.3)

    What it asks
    Track threats with reference to OWASP ML Security Top 10, OWASP LLM Top 10, and MITRE ATLAS.
    What our report supplies
    Every finding mapped to OWASP LLM and ATLAS IDs.
    Gap you still own
    Ongoing threat monitoring.

  • NIST AI 600-1 (GenAI Profile), MS-2.7-007

    What it asks
    AI red-teaming against GAI attacks such as prompt injection, and ML attacks such as data poisoning, membership inference, and model extraction.
    What our report supplies
    Core covers prompt injection and agent abuse.
    Gap you still own
    ML attacks need the model module.

  • ISO/IEC 42001:2023, AI system verification and validation

    What it asks
    Verification and validation records for the AI system.
    What our report supplies
    Dated security test record with results and retest outcome.
    Gap you still own
    The AI management system itself.

  • ISO/IEC 27001:2022, A.8.29 and A.8.8

    What it asks
    Security testing in development and acceptance; technical vulnerability management.
    What our report supplies
    Pre-release test evidence and a remediation list with retest status.
    Gap you still own
    Patch tracking and acceptance sign-off.

  • EU AI Act, Art. 15(5)

    High-risk systems on the EU market only

    What it asks
    Resilience against data poisoning, model poisoning, adversarial examples, and confidentiality attacks.
    What our report supplies
    Confidentiality and manipulation attacks at the application layer.
    Gap you still own
    Poisoning needs the data module; conformity assessment is out of scope.

  • Thai PDPA, s.37(1)

    What it asks
    Appropriate security measures for personal data.
    What our report supplies
    Proof of whether the AI leaks one user's personal data to another.
    Gap you still own
    PDPA does not mandate this test; the measures are yours.

Securities and digital-asset clients

The BOT policy does not bind securities or digital-asset firms. For them, the report adds to the IT security evidence they already keep for the Thai SEC.

What We Do Not Test or Claim

These items sit outside the engagement. Each row says why and where the work goes instead.

  • The foundation model provider's platform, accounts, or infrastructure

    Reason
    Not your asset; you cannot authorize it.
    Where it goes instead
    Not offered

  • Model weights, training, fine-tuning, serving stack

    Reason
    Separate layers with separate access needs.
    Where it goes instead
    Optional modules, quoted separately

  • Load, stress, or denial-of-service against the AI or its backend

    Reason
    We check LLM10 with low-volume probes of limits and never exhaust them.
    Where it goes instead
    DDoS Testing

  • Bias, fairness, toxicity benchmarking, or answer accuracy

    Reason
    That is quality evaluation, outside adversarial security testing. We report misinformation only when an attacker can induce it.
    Where it goes instead
    Not offered

  • Generating real prohibited content such as weapons uplift or working malware

    Reason
    Never produced. We prove a bypass with benign proof markers.
    Where it goes instead
    Not offered

  • Certification or attestation (ISO/IEC 42001, EU AI Act, bank AI policy)

    Reason
    The report is security evidence and does not count as a conformity assessment.

  • Unlisted targets, roles, tools, or data sources

    Reason
    Scope is the signed scope sheet. New items need a change request.
    Where it goes instead
    Change request

  • Social engineering of staff who operate the AI

    Reason
    Different service line.
    Where it goes instead
    Phishing Simulation, Red Teaming

  • A guarantee the target is safe

    Reason
    LLM output is non-deterministic. Testing proves what broke; it cannot prove nothing else will.
    Where it goes instead
    Stated in every report
OWASP
Top 10 for LLM Applications
RAG
Pipeline & Agent Testing
PoC
Reproducible Prompt & Response
0
Unverified Findings Shipped

Why Reconix for AI/LLM Application Penetration Testing?

  • Offensive Background, Applied to AI

    We are penetration testers first. We bring an attacker's instinct to LLM systems instead of running a checklist of canned prompts.

  • Application Layer First, Other Layers on Request

    The core engagement attacks the application layer: your AI feature as its users and data sources reach it. The model, data, and infrastructure layers, a pentest of the surrounding application, and secure code review are separate modules, scoped and quoted on request. We follow an attack into the surrounding app only as far as the model path takes it, so an XSS fired by model output is in scope.

  • OWASP LLM Aligned

    Findings map to the OWASP Top 10 for LLM Applications, so the output is auditable and your team knows exactly which risk class each issue belongs to.

  • Reproducible Proof

    Every finding ships with the exact prompt and response that triggered it. Your developers can reproduce the attack and confirm the fix.

  • Success Rates You Can Retest Against

    LLM output changes from run to run, so every finding records its attempts and successes, for example 6 of 20. Your engagement includes one retest of every finding, replaying the original attack set at the same attempt count.

Regulatory Alignment

Compliance Requirements This Service Supports

Our testing methodology is designed to meet the requirements of Thailand's key cybersecurity regulations.

PDPA

Personal Data Protection Act

Section 37 requires appropriate security measures for personal data processing.

Learn more
BOT iPentest

BOT Intelligence-led Penetration Testing

Annual iPentest required for licensed financial institutions under IT Examination.

Learn more
View All Compliance Requirements

Frequently Asked Questions

Common questions about penetration testing for LLM applications and agents.

Ship Your AI Knowing It Was Attacked First

Before your chatbot or agent reaches customers, let Reconix attack it the way an adversary will. You get the working exploits and the controls that stop them.

Reconix is the proof-first offensive security specialist in Thailand, serving regulated digital businesses of all sizes.

Related Services

Web Application Penetration Testing

Test the application that wraps your AI: auth, access control, and the API layer.

Learn more

Red Teaming & Adversary Simulation

Goal-based simulation of a real attacker across your people, process, and technology.

Learn more

Secure Code Review

Source-level analysis of the code that builds prompts, calls the model, and handles its output.

Learn more