Skip to content

Test · AI Red Teaming

Find out what one poisoned document can make your agent do.

We attack your models, agents, retrieval pipelines and MCP tool chains like a real adversary, prove the impact, then retest the guardrails until the chain is broken.

Talk to an expert See a sample report
Typical length
2–4 weeks
Mapped to
OWASP LLM Top 10 (2025), MITRE ATLAS
Scope
Models, agents, RAG, MCP servers

Simulated environment, real workflow.

Scope

What we cover.

Pick what matters for this engagement. We help you scope it in the first call.

Prompt injection

Direct and indirect injection through documents, web pages, email, tickets and tool output. OWASP LLM01, ATLAS AML.T0051.

Agent and tool misuse

Excessive agency, unsafe tool chaining and confused-deputy calls: what can an injected instruction make the agent do? LLM06.

MCP and tool permissions

Every MCP server and tool your agents can reach: scopes, tokens, tool descriptions and approval prompts.

Data and prompt leakage

System prompt extraction, sensitive data in replies and cross-tenant retrieval. LLM02, LLM07.

RAG and memory poisoning

Poisoned sources, access control on retrieved content, embedding stores and long-term agent memory. LLM04, LLM08.

Model supply chain

Third-party models, adapters, plugins and the pipeline that ships them. LLM03, ATLAS AML.T0010.

Methodology

How the engagement runs.

  1. 01

    Recon

    Inventory models, agents, tools, data sources and who can reach them. Map where untrusted text enters.

  2. 02

    Inject

    Direct and indirect injection, jailbreaks and context manipulation, manual first, tooling for coverage.

  3. 03

    Abuse tools

    Chain injections into tool and MCP calls to reach real actions: refunds, writes, emails, deletes.

  4. 04

    Exfiltrate

    Prove what data leaves: prompts, retrieved documents, other users' records, secrets in tool output.

  5. 05

    Retest

    Guardrails go in, we replay every chain, and each finding is mapped to the governance control it evidences.

Every chain is replayed after the fix.

We keep the exact transcript that broke your agent and run it again against the guardrail. You see the call blocked, not a promise that it would be.

Example transcript

Named offering

MCP & Agent Tool-Permission Review

A fixed-scope review of every MCP server and tool your agents can call: who installed it, what it can touch, and what a single injected instruction could make it do.

Agents now reach email, code, tickets and payments through MCP servers that someone installed in a minute. Most teams can't say which tools an agent can call, with whose token. We can, in writing, before an attacker finds out.

Talk to an expert See a sample report

What we check

  • Inventory of MCP servers, tools and their sources
  • OAuth scopes, tokens and secrets per tool
  • Tool description poisoning and tool shadowing
  • Least privilege per tool and per user
  • Human approval for destructive or costly calls
  • Tool output treated as untrusted input
  • Logging of every tool call to your SOC

Length

1–2 weeks

Price

Fixed fee

Output

Permission matrix + fixes

Deliverables

What you walk away with.

Written for the engineers who fix things and the leaders who fund them.

  • Named lead for the whole engagement
  • Critical issues flagged the same day
  • Retest included
How we work
01

AI red-team report

Every chain with transcripts, impact, OWASP LLM and ATLAS mapping, and a specific guardrail fix.

02

Tool-permission matrix

Each agent, tool and MCP server with its scopes, what it should be allowed to do, and the gap.

03

Control mapping

Each finding mapped to ISO/IEC 42001, NIST AI RMF and EU AI Act controls, ready for the audit file.

04

Retest and detections

Replayed chains after the fix, plus detection ideas for your SOC to watch for the same pattern.

FAQ

Questions we hear most.

Do you test third-party models or only our own?

Both. We test how your product uses a model, whether a vendor hosts it or you do.

What about agents that call tools or MCP servers?

That is usually where the highest risk sits. We test what an injected instruction can make each tool do, and review the permissions behind it.

Is automated red-teaming enough?

It is useful for coverage, but the serious chains we find usually need a human to spot them. We use both.

Will testing touch production data?

Only if you agree to it. We prefer a staging copy with the same tools and permissions, and use canary data to prove leakage.

Related

Often paired with.

AI Governance

ISO/IEC 42001, NIST AI RMF and EU AI Act readiness, built on one control set and real test evidence.

Explore

Secure AI Adoption

Roll out copilots, agents and AI tools with policy, data controls and an architecture that holds.

Explore

Penetration Testing

Web, API, mobile, network and cloud testing with reproducible findings and a retest.

Explore

Scope your AI Red Teaming engagement.

A 30-minute call with a senior practitioner. You leave with a scope, a timeline and a fixed quote.

Scope an engagement See a sample report