LLM Penetration Testing
LLM and AI penetration testing for the chatbots, agents, copilots and RAG systems you have already shipped. Senior-led, fully manual AI red teaming, tested against all ten categories of the OWASP LLM Top 10 2026 and the four phases of the OWASP GenAI Red Teaming Guide, then written up as findings your engineers can reproduce and your board can read.
- OWASP LLM Top 10 2026 and GenAI Red Teaming Guide aligned
- OSCE / OSCP / CREST certified, senior-led
- Fully manual testing, never a scan-and-send
- Australian owned, testing since 2015
Everyone is asking whether AI can do the testing. The exposure is the AI you already shipped.
Search for AI penetration testing and most of what comes back is about pointing a model at someone else's network. Can a model run the engagement for you? No. Meanwhile the assistant your team shipped last quarter reads untrusted input all day, carries a system prompt it assumes nobody will ever see, and calls tools with real permissions behind them. Firstly; it is reachable by anyone who can type. Second, it fails in ways your web application test was never built to look for, because the payload is a sentence rather than a request. OWASP put the 2026 edition's thesis in one line: stop trying to build a model that cannot be fooled, and build the system around it so that when the model is fooled, nothing important breaks. Finding out whether you did is manual work.
Every category in the OWASP LLM Top 10 2026, tested by hand.
Structured around the August 2026 edition and the OWASP AI Testing Guide, so coverage is referenced to published test IDs rather than described in the abstract. Where your system acts on its own we pair it with the OWASP Agentic Top 10, because OWASP is explicit that neither list covers that ground alone.
-
Prompt Injection
Direct, indirect and cross-modal. Instructions hidden in retrieved documents, images and audio, not only typed into the chat box. LLM01, AITG-APP-01 and 02.
-
Sensitive Information Disclosure
What the model gives away through its outputs: reasoning-channel content, training data, and the records it can reach. LLM02, AITG-APP-03.
-
Excessive Agency & Tool Abuse
What it can actually do once persuaded. Tool scope, permissions, and the downstream actions one sentence can trigger. LLM03, AITG-APP-06.
-
Hidden Context Exposure
System prompts, tool schemas and policy text assumed private in the context window. Renamed from System Prompt Leakage in 2026. LLM08, AITG-APP-07.
-
Supply Chain & Model Provenance
Models, adapters, plugins and packages that are not what they claim to be. LLM04, AITG-INF-01.
-
Data & Model Poisoning
Training, fine-tuning and embedding data, including the fine-tuning subversion added to the 2026 scope. LLM05, AITG-MOD-03.
-
RAG, Vector & Embedding Weaknesses
Retrieval poisoning, embedding manipulation and cross-tenant leakage in your vector store. LLM09, AITG-APP-08.
-
Output Handling, Consumption & Misinformation
Unsafe output passed downstream, resource and cost exhaustion, and confident wrong answers that drive real actions. LLM10, LLM06, LLM07.
Four phases, mapped to the OWASP GenAI Red Teaming Guide.
- 01
Scope & threat model
We agree the system boundary, the tools the model can reach, the data behind it and your acceptance criteria, then set safe testing windows.
- 02
Model evaluation
We go at the model first, before the application around it gets in the way. Jailbreaks, guardrail bypass, bias, and how it holds under adversarial input.
- 03
Implementation & system testing
We test the guardrails, prompts, retrieval pipeline, tool permissions and supply chain as deployed, not as the architecture diagram says.
- 04
Runtime testing, report & retest
We test how real users and connected systems can manipulate the live system, then report. After you remediate, we retest to confirm each fix holds.
Findings your engineers can reproduce and your board can read.
-
Prioritised findings
Every issue risk-rated by real business impact and ordered so you fix what matters first.
-
Reproducible prompt chains
The exact prompts, retrieved content and request sequences behind each finding. Evidence, not anecdotes about a model that once said something odd.
-
Remediation for engineers and ML teams
Fixes written for the people who own the guardrails, the retrieval pipeline and the tool permissions.
-
Executive summary
A plain-language overview for leadership, boards and clients asking whether the AI feature was tested.
-
Free remediation retest
We retest your fixes and confirm they hold, included with every engagement.
-
Attestation letter
A summary letter you can share with customers, partners and auditors on request.
Evidence for the assurance work you already have to do.
OWASP tells you how to test it. The ACSC tells you why it matters. Australian government guidance tells you to test it and document the result. One engagement produces evidence for all three.
| Framework | How this engagement maps |
|---|---|
| OWASP LLM Top 10 2026 | Structured around all ten categories of the August 2026 edition, including the cross-modal prompt injection and hidden context exposure added that year. |
| OWASP GenAI Red Teaming Guide | The engagement follows the guide's four-phase blueprint: model, implementation, system and runtime. |
| OWASP AITG and AISVS | Coverage referenced to published test IDs such as AITG-APP-01 for prompt injection, and findings mapped to the AI Security Verification Standard. What was tested is verifiable rather than asserted. |
| Guidance for AI Adoption, practice 5 | Australia's National AI Centre asks organisations to test and monitor AI systems, and for higher-risk systems to obtain an independent review of testing methodology and results. This is that review. It supersedes VAISS Guardrail 4, which asked for the same thing. |
| ACSC agentic AI guidance | Reflects the May 2026 guidance co-authored by ASD's ACSC on adopting agentic AI without granting broad or unrestricted access. |
| NIST AI RMF, MITRE ATLAS, Essential Eight | Findings map to the frameworks the 2026 Top 10 pins as references. The National AI Centre also directs the Essential Eight at AI systems. |
What teams ask before an LLM test.
How is this different from a standard penetration test?
A standard penetration test attacks code and infrastructure. This attacks a system that takes instructions in plain language and acts on them. The payload is a sentence, the vulnerability is often the model doing exactly what it was asked, and the impact depends on which tools it can reach. We still test the application and API around it, but the model, the retrieval pipeline, the system prompt and the tool permissions are the new surface.
What is the difference between AI penetration testing and LLM penetration testing?
They are used interchangeably and we deliver both under this service. LLM penetration testing is the narrower term: the language model and the application built around it. AI penetration testing is the broader one, adding the data and fine-tuning pipeline, the vector store and the infrastructure the model runs on. You will also see the same work called AI red teaming, after the OWASP GenAI Red Teaming Guide our methodology follows. Testing a chatbot, an agent or a RAG system, the scope is the same either way.
Can AI do the penetration testing instead?
No. Tools generate and replay attack strings quickly, and we use them where they help. But the findings that matter come from chaining a small flaw into a real consequence, and that needs someone who understands your business and what the model is allowed to touch. A tool cannot tell you a support bot can be talked into issuing a refund. It has no idea what a refund costs you.
What can you test? Chatbots, RAG systems, agents, copilots?
Customer-facing chatbots and support assistants, retrieval-augmented generation over your own documents, internal copilots wired into business systems, and agents with tool access that can act on their own. Commercial models behind an API, self-hosted open models, and anything you have fine-tuned. Scope follows what the system can reach, not what it is called.
Is it safe to test against production?
Yes, within agreed rules of engagement. We commonly test staging to keep real customer data out of it. Where production testing is necessary we agree boundaries first, avoid destructive actions by default, and coordinate anything higher risk in advance. Tool-enabled agents need particular care, because the point is proving what one can be made to do.
How long does an LLM penetration test take?
Most engagements run one to two weeks, depending on how many interfaces the system exposes, whether it retrieves your own documents, and how many tools it can call. An agent with broad tool access takes longer than a single chatbot. We confirm timing at scoping.
Can we use the report for compliance and client assurance?
Yes. Australia's Guidance for AI Adoption asks organisations to document testing to support external audits and oversight, and for higher-risk systems to obtain an independent review of testing methodology and results. The report and optional attestation letter are written for that, and for the clients, boards and insurers asking whether your AI feature was tested by someone outside the team that built it.
Do you provide AI penetration testing across Australia?
Yes. LLM and AI penetration testing is delivered remotely Australia-wide from our Sydney base. See penetration testing across Australia for coverage, methodology and the engagement process.
Get a scoping call for your AI system.
A senior tester scopes the right engagement and sends a fixed quote. No automated sales funnel, no obligation.