AI & LLM Application Testing

Test the chatbots, copilots and AI features in your applications before attackers talk them into misbehaving.

Large language models are now built into customer service chatbots, internal assistants, document tools and agents that can take actions on a user's behalf. They bring a new kind of attack surface: the model can be instructed through the very text it reads, and what it says or does next can reach your data, your systems and your customers.

AI security is a Samurai Security speciality. We built Katana, our own AI testing platform, so we understand how AI systems are put together and how attackers now use AI themselves. Our consultants test applications with embedded AI for prompt injection, data leakage, insecure output handling and the rest of the OWASP Top 10 for LLM Applications, and then talk your team through what we found and how to fix it.

Discuss AI Application Testing

Get a Quote

Security camera against a building with metal slats

What Is AI and LLM Application Testing?

AI application testing is a penetration test of a system that uses a large language model or other AI component. We look at the whole application, not just the model: the prompts and system instructions, the data the model can retrieve, the tools and APIs it can call, how its output is used, and the conventional web and API security around it.

The aim is to find out whether a user, or content the AI reads, can make the system ignore its rules, reveal information it shouldn't, or take actions it was never meant to take, and to show you practical ways to stop it.

Group working on laptops around a table in a red-lit room

Why Test Applications That Use AI?

An LLM follows instructions written in natural language, and it cannot reliably tell your instructions apart from instructions hidden in a user's message, an uploaded file, an email or a web page it has been asked to summarise. If the model can read sensitive data or call tools, a successful prompt injection can turn into a data breach or an unauthorised action.

AI features are also often added quickly, on top of existing applications, with third-party models and plugins. Testing gives you evidence about how the system really behaves under attack, which helps you deploy AI with confidence and answer questions from customers, auditors and boards.

What We Test

Our testing is mapped to the OWASP Top 10 for LLM Applications and combined with conventional application and API testing.

Prompt injection and jailbreaks

Direct injection through chat and inputs, and indirect injection through documents, emails, web pages and other content the model processes, including attempts to override system instructions and safety controls.

Sensitive data leakage

Whether the application can be made to reveal its system prompt, other users' data, internal documents, credentials or personal information, including through retrieval-augmented generation (RAG) data stores.

Insecure output handling

Whether model output is trusted too much downstream, for example rendered as HTML or script, passed to databases or shells, or used to build requests to other systems.

Excessive agency and tool use

What an AI agent or assistant can do with the tools, plugins and API permissions it has been given, and whether an attacker can steer it into performing unintended actions.

Supply chain, data and model risks

Third-party models, plugins and integrations, how training or retrieval data could be poisoned, and how the application handles misinformation and over-reliance on model output.

Abuse, cost and availability

Unbounded consumption, such as prompts designed to run up costs or exhaust resources, together with rate limiting, logging and monitoring of AI features.

Our Approach

Door handle with a keypad lock on a wooden door

01

Scoping

We find out what the AI feature does, which model and platform it uses, what data it can see, which tools it can call and who its users are, and agree the scope and rules of engagement.

02

Project agreement

You receive a formal proposal setting out the scope, test approach, timings, access needed and the cost, at £1,350 per consultant day.

03

Testing

Our consultants combine manual adversarial testing of the AI behaviour with testing of the surrounding web application and APIs, so issues that span both are found. If we find a critical or high-risk issue, we contact you straight away.

04

Report and debrief

You receive a report that explains each finding in plain terms, shows the evidence and gives practical remediation, from prompt and guardrail changes to architectural controls. We then talk you through the report in a debrief.

05

Retesting

When fixes are in place we can re-verify them. Retesting is scoped to the number of findings to re-verify and quoted up front.

Why Choose Samurai Security?

AI is our speciality

We built Katana, our own AI testing platform, and replicate the tools and tactics AI-driven attackers use. We understand AI systems from the inside.

01

CREST-accredited penetration testing

AI testing is carried out by the same CREST-accredited team that tests web applications, APIs and infrastructure, so the conventional security around your AI is covered too.

02

Research-led

Our team has discovered and published more than 20 CVEs, and brings that research mindset to new technology.

03

AI risk and governance too

Beyond testing, we can assess the risks of the AI tools you adopt, including third-party AI applications, and help you set the policies and controls around their use.

04

Our Work

Aerial view of a residential housing estate

Strengthening Cybersecurity Resilience

“Samurai takes the time to understand our needs and helps us to be an enabler for Flagship Group’s mission. It’s always a pleasure to work with them and I’d recommend them to others.”

Enabling Remote Work for the NHS

“When I have a problem nobody else can solve, I call Samurai because I know that they’ll deliver what I need, every time, without fail.”

Incident Response Retainers To Enable Growth

“This partnership has allowed us to scale and grow with the confidence that we are protected from cyber threats around the clock.”

Client Testimonials

“Samurai takes the time to understand our needs and helps us to be an enabler for Flagship Group’s mission. It’s always a pleasure to work with them and I’d recommend them to others.”

“We were astonished by what Samurai’s Black Dragon assessment revealed, even though we thought we had everything covered. The findings spoke for themselves, and the team’s expertise and clarity were outstanding.”

"Samurai’s Black Dragon: Attack Surface Risk Assessment was exactly what we needed and something we’ve never seen done before. They turned it around quickly, highlighted risks that could have easily been overlooked, and gave us a clear roadmap for improvement."

Frequently Asked Questions

What is prompt injection?

Prompt injection is when an attacker gets their own instructions into the text an AI model processes, either by typing them directly or by hiding them in content such as a document, email or web page. If it works, the model may ignore its original rules, reveal data or take actions it shouldn't.

Do you test the model itself or the application?

The application. Most real-world risk comes from how a model is connected to data, tools and users, so we test the whole system: the AI behaviour, the data it can reach, the actions it can take and the web application and APIs around it.

Which AI platforms do you test?

We test applications built on commercial model APIs, open-source models and hosted AI platforms, including chatbots, copilots, RAG-based search and agents that call tools or APIs.

Do you follow the OWASP Top 10 for LLM Applications?

Yes. Our testing is mapped to the OWASP Top 10 for LLM Applications, alongside the OWASP guidance for web applications and APIs.

What is Katana?

Katana is Samurai Security's own AI testing platform. It runs like a pen testing team made of AI agents, and our consultants use it alongside human-led testing.