AI agent security testing
AI agent security testing checks whether the people who use your AI agent, and the content it reads, can make it act outside its permissions: return another user’s data, call a tool above the user’s role, leak a secret, or run up cost. Ghost Protocol tests the agent by hand inside a penetration test of your application and its API, against the OWASP Top 10 for LLM Applications 2025 and the OWASP Top 10 for Agentic Applications 2026.
Last reviewed
What we test in an AI agent
Seven things, each a way an agent can be made to work for the wrong person. The model is rarely the weak point on its own; the tools, data and permissions your application gives it usually are.
Prompt injection, direct and indirect
Instructions typed by a user, and instructions planted in what the agent reads: a document it summarises, a web page it fetches, the output of a tool it calls. We check whether any of them can change what the agent does.
Tool and permission abuse
Whether the agent can be talked into calling a tool, or passing an argument, that the signed-in user is not allowed to use. An agent must never act above the role of the person it is acting for.
Data exposure across users and tenants
Whether one user can get the agent to return another user's records, files or conversations, including through a search index shared by several customers.
MCP server authorisation and tenancy
Whether the MCP servers the agent calls check who is asking on every request, keep each customer's data apart, and accept only tokens issued for them. MCP server security testing
Token and secret handling
Whether API keys, access tokens or internal rules sit in the system prompt, in tool responses or in logs where the model or a user can reach them, and whether a token is passed on to services it was not issued for.
Rate limits and cost abuse
Whether one user or one script can drive the model and its tools without limit: endless requests, oversized inputs, tool calls in a loop that cost you money or take the service away from everyone else.
Output handling
Whether what the model writes is treated as untrusted before it reaches a browser, a database query, a template or a shell: script in a chat reply, a link that carries data away, a generated query that runs as written.
How the agent is tested
The same engagement as our web and API penetration test, with the agent’s tools added to what the engineer tests. The full method is published.
- Inside the penetration test of your application
- The agent is tested where your users meet it: in the web application and through the API behind it, grey box, logged in as two user roles.
- A role matrix that includes the agent's tools
- Before anything is tested we write down what each role may reach, and which of the agent's tools and MCP servers act for that role. Every finding is measured against that matrix.
- Planted content, in test accounts only
- Indirect injection is tested with documents, pages and records we place in the test accounts you give us. Nothing is changed outside the test data you designate.
- Reproduced by hand, with the evidence
- A finding reaches the report only after it replays from a clean session, with the request, the response and the identity it was run as. The engineer verifies every one.
The OWASP Top 10 for LLM Applications 2025, entry by entry
Each entry says whether this test covers it. “Where it applies” means we test it when your application has the feature it depends on.
| Entry | In this test | What that means |
|---|---|---|
| LLM01:2025 Prompt Injection | Tested | Direct injection typed by a user, and indirect injection planted in documents, web pages and tool output. |
| LLM02:2025 Sensitive Information Disclosure | Tested | Another user's or tenant's records, files and conversations reaching a response, and secrets reaching one. |
| LLM03:2025 Supply Chain | Not covered | We do not audit the model, its weights, or third-party plugins and servers you do not control. |
| LLM04:2025 Data and Model Poisoning | Not covered | Attacks on training and fine-tuning data are outside this test. |
| LLM05:2025 Improper Output Handling | Tested | Model output reaching a browser, a query, a template or a shell without being treated as untrusted. |
| LLM06:2025 Excessive Agency | Tested | Tools and permissions the agent holds beyond what the signed-in user may do. |
| LLM07:2025 System Prompt Leakage | Tested | Credentials and access rules kept in the system prompt, where a user can draw them out. |
| LLM08:2025 Vector and Embedding Weaknesses | Where it applies | Retrieval that returns one customer's documents to another, where the agent searches a shared index. |
| LLM09:2025 Misinformation | Not covered | Whether the answers are accurate is a quality question, not part of a security test. |
| LLM10:2025 Unbounded Consumption | Tested | Missing limits on requests, input size and tool calls that let one user run up cost or deny the service. |
The OWASP Top 10 for Agentic Applications 2026, entry by entry
The agentic list covers what an agent does across many steps, where the LLM list covers a single model response. Three of its ten are tested, two where they apply, and five are outside a penetration test of one application.
| Entry | In this test | What that means |
|---|---|---|
| ASI01: Agent Goal Hijack | Tested | Injected instructions that redirect what the agent is trying to do. |
| ASI02: Tool Misuse and Exploitation | Tested | Legitimate tools called with harmful arguments, or in a harmful order. |
| ASI03: Identity and Privilege Abuse | Tested | The agent acting with more authority than the person it acts for, and tokens used beyond the purpose they were issued for. |
| ASI04: Agentic Supply Chain Vulnerabilities | Not covered | Third-party agents, tools and MCP servers you connect but do not control. |
| ASI05: Unexpected Code Execution (RCE) | Where it applies | Where model output reaches an interpreter or a shell, tested as output handling. |
| ASI06: Memory & Context Poisoning | Where it applies | Where the agent stores what it reads and reads it back later, a planted instruction is tested as indirect injection. |
| ASI07: Insecure Inter-Agent Communication | Not covered | Messages passed between several cooperating agents. |
| ASI08: Cascading Failures | Not covered | How one fault spreads across a system of agents. |
| ASI09: Human-Agent Trust Exploitation | Not covered | An agent manipulating the people who rely on it. |
| ASI10: Rogue Agents | Not covered | Agents that drift from their purpose without an attacker driving them. |
- OWASP GenAI Security Project, OWASP Top 10 for LLM Applications 2025, published 17 November 2024.
- OWASP GenAI Security Project, Agentic Security Initiative, OWASP Top 10 for Agentic Applications 2026, Version 2026, published 9 December 2025.
- Both read on 24 October 2026.
What this test does not cover
Said once, at the start, so nobody discovers a boundary at delivery.
- The model itself: jailbreak research on foundation models and their own guardrails. A jailbreak matters to this test when it lets a user reach something your application should have refused.
- Attacks on training or fine-tuning data
- Accuracy, bias and misinformation in the model's answers
- The model provider's infrastructure, and third-party agents, plugins or MCP servers you do not control
- Systems of many cooperating agents: their messages to each other and how faults spread between them
- Mobile apps, internal corporate networks and physical security
Social engineering and red-team engagements are offered as separate engagements, scoped and quoted individually. The fixed-price web and API penetration test does not include them.
The agents we run ourselves
We run an AI assistant and a public MCP endpoint on this site, and we publish Wyrm, a memory server for AI coding agents. Three of the defences we use on them, as the code and the published record describe them.
The model never reads the page it scanned
Our assistant can run the free website scan. The scan hands the model only a grade, a score and the top fixes, never the scanned page’s content, so a hostile page cannot pass instructions to the model through the result.
Limits that hold for a whole session
An MCP session can call a tool many times, so a per-request limit would not hold. On our MCP endpoint the scan and contact tools are capped per IP address, in a store every server instance shares. The detail is on the MCP server security testing page.
Untrusted memory never reaches the agent’s brief
Wyrm marks every memory with where it came from (the operator, an agent, an import, or an untrusted source) and withholds untrusted content from the briefs an agent reads. In its 8.0.1 red-team, 622 jailbreak payloads from the garak corpus made 0 escapes from the untrusted lane, by construction, and its detector flagged 80.7% of the rest with 0 false positives on ordinary prose. The red-team is kept in Wyrm’s automated checks as a gate. Every Wyrm figure, with its file and commit
Scope and price
An agent inside one web application and its API is tested within our fixed-price web and API penetration test: up to three hostnames and two user roles, the report in 5 to 7 days, a signed attestation letter and a free re-test. An agent with many tools, several MCP servers or more roles is a larger scope, and we quote it in writing before anything starts.
Not ready for a test? The free website scan reads your public surface in about a minute. If your agent works through an API, see what we test there in API penetration testing.
Questions about AI agent testing
What is AI agent security testing?
It is a penetration test of an application that contains an AI agent, aimed at what the agent can be made to do: follow instructions planted in what it reads, call tools above the user's role, return another customer's data, leak a secret, or run up cost. The weakness is almost never the model alone. It is the permissions, data and tools the application hands it.
What is the difference between direct and indirect prompt injection?
Direct injection is typed by the user talking to the agent. Indirect injection arrives inside content the agent reads on someone's behalf: a document, an email, a web page, a search result or a tool's output. The person harmed by indirect injection is usually not the person who planted it, which is why it is tested on its own.
Do you test the AI model itself?
No. We test what your application lets the model do: the tools, data and permissions around it. Jailbreak research on foundation models, safety evaluations of a model's own guardrails, and attacks on training data are not part of this test.
Which frameworks do the findings map to?
Each finding names its entry in the OWASP Top 10 for LLM Applications 2025 or the OWASP Top 10 for Agentic Applications 2026, and, where the weakness sits in the API, the OWASP API Security Top 10 (2023). Findings on MCP servers also cite the MCP specification's security requirements.
How much does AI agent security testing cost?
When the agent sits inside one web application and its API, it is tested within our fixed-price web and API penetration test: $4,000, with the same report, attestation letter and free re-test. An agent with many tools, several MCP servers or more than two user roles is a larger scope, and it is quoted before we start. All prices are on the pricing page.
What do you need from us before the test?
Written authorisation; the scope (the application, its API and up to three hostnames); one test account for each of two user roles, with a note of what each may reach; a list of the agent's tools and the MCP servers it calls; and a way to place test documents or pages the agent will read. Staging or production is your choice, and the test is non-destructive either way.
How long does it take?
The same as our web and API test: the report in 5 to 7 days from kickoff, then a free re-test of your fixes up to day 30.
Can you test an agent that calls MCP servers?
Yes, where the servers are yours, or you have their owner’s written authorisation. The MCP servers an agent calls are part of its attack surface, and we test their authorisation, tenancy, token handling and what they hand back to the model. The detail is on our MCP server security testing page.
Tell us what your agent can reach
Email ryan@ghosts.lk or message +94 71 055 5055 on WhatsApp. Ryan replies within 24 hours. Working hours are Monday to Friday, 09:00 to 18:00 Colombo time (UTC+5:30).
Book a testRead the example report Book a 15-minute call Buying for a company? Procurement details