AI agent penetration test: what a chatbot or LLM application pentest covers

An AI agent penetration test is an authorized, scoped attack against an assistant, chatbot or LLM application that reads data and acts through tools. It checks that hostile text slipped into an email, a document or a web page cannot trigger an action nobody approved. This page is written for the person who has to buy the test: it describes the content, the scope, the legal frame, the deliverables and the questions to ask. For the broader discipline, see the pillar on AI agent red teaming.

What does an AI agent penetration test cover?

It covers the full path between an untrusted piece of data and a sensitive action. The tester does not stop at the model’s refusal message: the goal is to find out what the agent actually does when it is manipulated.

The usual test families:

• Direct and indirect prompt injection: instructions hidden in an email, a PDF, a ticket, a product sheet or a web page the agent reads. See prompt injection and OWASP LLM01.
• Excessive agency: the agent can send an email, write to a CRM, trigger a refund or change an access right without human approval (OWASP LLM06, Excessive Agency).
• Data leakage through tools: a tool call exfiltrates information to an address chosen by the attacker, or the agent reveals another user’s data.
• System prompt leakage and secrets present in the context (LLM07).
• RAG source poisoning: a document added to the knowledge base changes the agent’s behavior (LLM04 and LLM08).
• Tools and MCP servers: poisoned tool descriptions, overly broad permissions, missing authentication. See MCP security.
• Tenant isolation: can one tenant reach another tenant’s conversations or documents?

Risk identifiers come from the OWASP Top 10 for LLM Applications 2025. The injection technique maps to MITRE ATLAS AML.T0051.

How does an AI agent pentest differ from a web pentest?

A web pentest tests deterministic code, while an agent pentest tests a system that makes decisions from text. The same message may work one time in three, so the tester repeats attempts, varies wording and documents a success rate rather than a single yes or no.

Three concrete differences:

• The input surface is everything the agent reads. A form field is an input, and so are a received email, a pull request comment or an indexed document.
• Impact is measured at the tools. An injection with no tool produces a bad answer. An injection with a mail or write tool produces an incident.
• Fixes are different in nature. You fix by reducing permissions, adding human approval for sensitive actions and filtering flows, and only rarely with a code patch.

The table below sets the two kinds of test side by side.

What does a classic web pentest still cover?

It remains necessary: the agent sits on a web application, APIs and infrastructure that have their own flaws. Authentication, access control, SQL injection, SSRF, exposed secrets and cloud configuration belong to a web or API pentest, and an agent test does not replace them.

In an agent test these topics are out of scope by default, unless they serve as a foothold to reach the agent. The two engagements complement each other. If your application already went through a web audit, the agent test covers what that audit did not look at: the model’s decision layer and its tools. For the difference between a passive audit and a real test, see passive audit vs pentest.

What scope should you prepare?

A good scope fits on one page. Before the discovery call, gather this list:

• The agent: name, use case, model used, access channels (chat, API, email, voice).
• The tools: complete list with their rights (read, write, send, pay, delete).
• MCP servers consumed or exposed, and how they authenticate.
• Data sources: RAG base, attachments, web pages, tickets, inbound emails.
• Authentication: how the agent knows the user, which tokens it carries, with which rights.
• Tenants: one customer or several, and how isolation is enforced.
• Test environment: staging or a dedicated instance, test accounts, a dummy dataset.
• Exclusions: production, denial of service, social engineering of your staff.

If you are unsure about the size of the agent, listing its tools is the simplest approach: their number and sensitivity set the testing effort.

The scoping list fits in this table, to fill in before the discovery call.

What rules of engagement should you set?

No test starts without written authorization from the system owner. In France, fraudulently accessing or remaining in an automated data processing system is an offence under articles 323-1 and following of the Code pénal, punishable by up to three years in prison and a €100,000 fine for simple fraudulent access, more if data is modified or the system is altered. Verbal consent is not enough.

The frame is settled in writing:

• A signed authorization from the system owner, with scope, dates and emergency contacts. If the agent is hosted or built by a third party, that party’s agreement may be needed.
• A test environment whenever possible, and never any modification of real production data.
• Dummy data: accounts and content created for the engagement, with no real personal data. If real data becomes readable, the tester notes the access, records it without copying it and stops.
• Confidentiality: the report is confidential and no data is kept after the engagement.
• Cleanup: test accounts, tokens and artifacts removed at the end.

This describes an engagement practice and is not legal advice. Have your counsel review the authorization letter if your situation is unusual.

What deliverables should you expect?

A report with evidence your team can replay. Each finding describes the hostile input used, the path the agent followed, the action obtained and the impact, with a reasoned severity.

The report usually contains:

• an executive summary readable without technical background;
• the list of findings with reproducible evidence;
• the mapping to the relevant OWASP LLM risks;
• prioritized remediation leads (tool permissions, human approval, filtering);
• the list of what held up, which is a deliverable in its own right.

A 30-minute debrief with your team is included. A re-test after fixes is available as an option. The approach is detailed on the method page.

How long does the engagement take?

The Agent Red Team Express takes five days for one agent. The timeline runs from the signed authorization to the delivered report, with scoping at the start and the debrief at the end. Work starts once the quote, the deposit and the written authorization are in place.

For a wider scope (several agents, MCP servers, several environments), duration depends on the quote. Also allow time on your side to provide test access.

How much does an AI agent penetration test cost?

The Agent Red Team Express costs €1,900, fixed price, for one agent in five days. It is always paid: there is no “nothing found, nothing paid” guarantee, because a report that documents what held up has value.

Beyond one agent, the Custom Red Team is quoted according to the number of agents, their complexity, the number of MCP servers and environments, and the re-test option. Details are on the pricing page. First contact is a free 30-minute discovery call.

How do you choose an AI agent testing provider?

Choose the one who can show its method, its evidence and its limits. The market is young, and a good provider answers these questions without detours:

• What methodology do you apply? It should cite frameworks (OWASP LLM Top 10 2025, MITRE ATLAS, OWASP MCP) and describe phases.
• Do you test tools and actions, or only the model’s replies? A test limited to jailbreaks does not measure real impact.
• How do you handle non-deterministic results? Expected answer: repeated attempts and success rates.
• What does the report contain? Ask for an anonymized excerpt of the structure.
• What are the rules of engagement? Written authorization, dummy data, no retention.
• How are false positives handled? A serious provider replays every finding before delivering it.
• What happens if nothing is found? The right answer is a report on what held up.

To gauge your own agent’s exposure before any contact, a quick check is available on the exposed agent page.