An AI system that answers customers or calls tools is an attack surface. Most have never met an attacker.
Why classic pentests miss it
A penetration test checks the application around the model: authentication, network, infrastructure. It does not try to make the assistant reveal its system prompt, leak another customer’s documents through retrieval, or send an e-mail it was never supposed to send. Those attacks live at the prompt and retrieval layer, and that is where we test.
What we try
Direct and indirect prompt injection, jailbreaks, data leakage across users and tenants, tool abuse, authorization bypass through the model, and attacks on your API bill. We work in staging with realistic data behaviour, document every attempt, and keep the ones that worked reproducible.
Better you than someone else.
What you get
A findings report ranked by exploitability, with reproduction steps for every finding. A walkthrough with your engineers. A remediation backlog, and a retest once the fixes are in. The report is written so you can hand it to a customer, an insurer or an auditor who asks for one.