AI & LLM penetration testing

An LLM pentest is more than a web app scan. The model, its context window, the retrieval layer and the tools it can call are all attack surface. These are the classes I work through on every engagement, adapted to what your application actually does.

• LLM-01

  Prompt injection

  Direct and indirect injection that overrides instructions, hijacks tools, or smuggles attacker content in through retrieved documents and third-party data.

• LLM-02

  Jailbreaks & guardrail bypass

  Breaking safety, policy and system constraints to force disallowed output, or actions the application was built to refuse.

• LLM-03

  System-prompt & data leakage

  Recovering hidden system prompts, keys and other users' data from the context window, history and the RAG store.

• LLM-04

  RAG access-control bypass

  Reaching documents, tenants and records the current user should never see, through weaknesses in the retrieval layer.

• LLM-05

  Excessive agency & tool abuse

  Driving agents to call tools, APIs and functions they shouldn't — or with parameters they shouldn't — to reach real systems.

• LLM-06

  Insecure output handling

  Turning unchecked model output into XSS, SSRF, SQL injection or command execution in the systems downstream of it.

• LLM-07

  Model & data extraction

  Membership inference, model inversion and training-data recovery, where those are in scope for your deployment.

• LLM-08

  AI supply chain

  Risks in the base models, plugins, extensions and third-party AI components wired into the application.

Mapped to the OWASP Top 10 for LLM Applications and MITRE ATLAS.

1. 01

   Scope & threat model

   We agree the targets, the data that matters, and what 'bad' looks like for your product — so the test chases real risk, not a checklist.

2. 02

   Manual adversarial testing

   Hands-on attack chains, not just an automated scanner. The findings that come from thinking like the attacker, not from a signature.

3. 03

   Reproducible proof

   Every finding ships with the exact prompts and steps to reproduce it, so your engineers can see it fail for themselves.

4. 04

   Risk-ranked report

   Findings ranked by real business impact, each with concrete, prioritised remediation guidance.

5. 05

   Fix & retest

   I work through the fixes with your team, then retest to confirm they hold and nothing regressed.

• A risk-ranked report with evidence behind every finding
• A reproducible proof-of-concept for each issue
• Clear, prioritised remediation guidance your engineers can action
• A free retest once the fixes are in
• A readout call with the people doing the work

• OWASP Top 10 for LLM Applications
• MITRE ATLAS
• OWASP ASVS
• OWASP WSTG

I'm a Certified AppSec Practitioner and have closed 50+ vulnerabilities at Invygo while running its microservices in production, alongside bug-bounty work since 2020 for companies including Apple and TrendMicro. AI testing sits on top of that application-security foundation — the model is rarely the only thing that breaks.

What is LLM penetration testing?

A security assessment of an application built on large language models — chatbots, copilots, RAG systems and autonomous agents. It simulates real attacks against the model and everything wired around it: prompts, the retrieval layer, tools and the systems that consume the model's output.

How is it different from a normal application pentest?

A conventional pentest targets code and infrastructure. An LLM pentest adds the model's own failure modes — prompt injection, jailbreaks, data leakage, RAG access-control bypass and excessive agency — which a standard scanner cannot reach. I test both layers, because the model is rarely the only thing that breaks.

Can you test RAG systems and AI agents?

Yes. RAG pipelines and tool-using agents are where most of the real risk lives — indirect prompt injection through retrieved content, cross-tenant document access, and agents taking actions or calling APIs they shouldn't. These are a core part of every engagement.

Do you work with companies in Morocco?

Yes. I'm an application security engineer based in Morocco, available on-site across the country and remote for clients anywhere. Reporting can be delivered in English or French.

Which standards and methodology do you follow?

Testing is grounded in the OWASP Top 10 for LLM Applications and MITRE ATLAS, with manual adversarial testing alongside automation. Every finding comes with a reproducible proof-of-concept and prioritised remediation guidance.

What do I get at the end of the engagement?

A risk-ranked report with evidence and a reproducible proof-of-concept for every finding, clear remediation guidance, a readout call with your engineers, and a free retest once the fixes are in.