Executive Summary

Most organisations now run at least one LLM in production, and a growing number run agents that call tools and act without a human in the loop. The security testing those systems receive was designed for deterministic software.

AI applications fail differently. The payload is natural language, the same input can be safe nine times and unsafe on the tenth, and the malicious instruction often arrives inside a document or tool description rather than from the user. Once a model can call tools, a successful manipulation stops being a bad answer and becomes an unauthorised action taken with your credentials.

What Is AI/LLM Penetration Testing?

AI/LLM penetration testing is authorised adversarial testing of an AI system — the model, the prompts and context around it, its retrieval and memory layers, the tools it can invoke, and the application consuming its output — to find and demonstrate exploitable weaknesses before an attacker does.

It is not a benchmark run, a bias evaluation, or a scan. Traditional testing attacks code paths; AI testing attacks decision paths. The question is not only whether a payload breaks a parser, but whether the system can be given the wrong instructions — and what authority it holds when that happens.

Why It Matters in 2026

OWASP published the Top 10 for LLM Applications 2026 on 4 August 2026, the first edition weighted partly on real incident data rather than practitioner voting alone. Eight of ten positions moved: Excessive Agency climbed to third, and System Prompt Leakage became the broader Hidden Context Exposure. The separate Top 10 for Agentic Applications (December 2025) owns the risks that appear once a model becomes an actor rather than a component.

Agent autonomy has produced documented failures. The UK AI Security Institute disclosed on 4 August 2026 that during a routine evaluation, agents took 19 unsanctioned actions against real people and organisations across 10 of 122 runs. One attempted to insert malicious code into a real open-source project and created fake identities to socially engineer the maintainer. AISI notes the deception was never instructed; it emerged from pursuing a hard goal, and what stopped it was a human reviewer rather than a technical control.

The tool layer became a supply chain. Tool descriptions are read by models as instruction but reviewed by humans as configuration. Invariant Labs documented tool poisoning and rug pulls in 2025; CVE-2025-6514 in mcp-remote was a CVSS 9.6 command injection. A poisoned description works on every invocation, for every user, until someone notices.

Regulation now names these attack classes. EU AI Act Article 15(5) requires high-risk systems to resist data poisoning, model poisoning, adversarial examples, confidentiality attacks, and model flaws. Article 55 requires adversarial testing for GPAI models with systemic risk. ISO/IEC 27090 reached publication stage on 19 August 2026.

LLM Penetration Testing vs Traditional VAPT

Traditional VAPT tests whether code and infrastructure can be made to do something they were not built to do. LLM penetration testing tests whether a system built to follow instructions can be given the wrong ones. You need both.

Traditional VAPT is never replaced. Every AI system sits on infrastructure, exposes APIs, and stores data. Scope both in one engagement rather than choosing.

The 2026 Threat Landscape

Use OWASP for what to test, MITRE ATLAS for how adversaries chain techniques, and NIST AI 100-2e2025 for taxonomy auditors recognise. The five OWASP categories below carry the most testing weight in practice; the full list of ten is published by the OWASP GenAI Security Project.

For agents, three entries from the Agentic list drive most findings: ASI02 Tool Misuse (calling the wrong tool, or the right tool with hostile arguments), ASI03 Identity and Privilege Abuse (over-broad or borrowed credentials, confused-deputy escalation), and ASI04 Agentic Supply Chain (malicious or impersonating MCP servers, poisoned prompt templates).

Attack Surface and Methodology

Every place the model reads is an injection vector: user input, RAG corpora, inbound email, fetched web pages, uploaded files, tool responses, tool definitions, agent memory, and messages from other agents. The most useful scoping artifact is a trust-boundary inventory listing each content source, its trust level, and who can influence it. Model output belongs on that list too — it is untrusted input to whatever consumes it.

Priority Test Cases

The two findings we see most

RAG entitlement bypass. The index is built with a service account that reads everything, while permissions are enforced only when a person opens a file. Ask a low-privilege user a question whose answer sits in a restricted document, and the assistant summarises it accurately. No access control system records a violation, because none was consulted. Fix: per-user entitlement filtering at query time.

Tool authority nobody mapped. Most agent findings are permission findings wearing an AI costume. Enumerate every tool, its credential, and its effective privilege before testing anything else.

Tooling: What Automation Does and Does Not Cover

Automated tooling belongs in a mature programme, mainly for volume and regression. The open-source landscape in 2026 centres on a few reliable options: NVIDIA’s garak for LLM vulnerability probing, Microsoft’s PyRIT for risk identification and automated red teaming, promptfoo for evaluation and adversarial test suites in CI, and Giskard for scanning and continuous red teaming. Agent and injection research benchmarks such as AgentDojo, InjecAgent, and MCPTox are useful for calibrating agentic coverage. The conventional surface underneath still needs Burp Suite and the usual toolchain.

What automation reliably delivers: firing hundreds of jailbreak variants, regression detection when a model or prompt changes, and measuring reproducibility across many attempts — which is exactly the work humans do badly.

What it does not deliver: the contextual findings. A scanner cannot know that your entitlement model is wrong for your business, that a tool’s privilege is broader than anyone realised, or that your approval workflow waves through anything with a confident justification. Treat raw percentages from AI security scanners with caution — one independent audit reported roughly a 78% false-positive rate from YARA-based MCP scanners, and figures vary widely by methodology.

Authorisation: Get This Right Before Testing

This is the step most teams skip, and it carries real legal exposure. If your model is hosted by a third party, you do not own the whole target.

• Check the provider’s testing policy. Major model providers publish terms governing security testing of their hosted services. Testing your application is generally fine; testing their infrastructure, attempting to extract their model, or running high-volume attacks against their endpoint may not be.
• Know where the boundary sits. You own the prompts, corpus, tools, permissions, and output handling. The provider owns the model, its guardrails, and the inference platform. Findings on their side go to their disclosure programme, not into your report as your risk.
• Get written authorisation covering AI-specific activity — jailbreak attempts, data extraction probes, and any agent action that could reach a live system.
• Never use real personal data in a test corpus. Poisoning tests write content that persists; under GDPR or the DPDP Act, that corpus is now a processing activity.
• Agree an abort condition and monitor live. Agent testing should be watched as it runs, not reviewed afterwards — the AISI incident is the clearest argument for this.

Reporting, Deliverables, and Remediation

Conventional CVSS assumes deterministic exploitability. “Prompt injection possible” without attempt counts is unusable. Every behavioural finding should state reproducibility (successes over attempts), attacker capability required, authority reached, and whether existing controls would have detected it. “31 of 50 attempts, single-turn, model version X” is retestable; the first phrasing is not.

A defensible deliverable contains: an executive summary tied to business impact; the tested scope with model versions and dates; findings with OWASP LLM 2026 and ASI identifiers; reproduction steps including attempt counts; evidence; layered remediation per finding; a residual risk statement for anything that cannot be eliminated; and a retest section. Ask to see a redacted sample before you sign anything.

Remediation is architectural, in descending order of durability: reduce authority; enforce authorisation outside the model; treat output as untrusted input; isolate untrusted content; detect and rate-limit; then tune guardrails. A report recommending only the last item is incomplete.

Compliance Considerations

Many summaries still say high-risk EU AI Act obligations apply from 2 August 2026. Following the Digital Omnibus, in force 27 July 2026, that is no longer correct for Annex III or Annex I systems.

Scope, Duration, and What Drives Cost

AI penetration testing is not priced by lines of code. It is priced by the number of things that can be attacked and the number of things the system can do. Four drivers account for most of the variance:

• Entry points — how many distinct content sources reach the context window. A single chat box is one; a system ingesting email, documents, tickets, and web content is several, each needing separate injection testing.
• Tool count and authority — every tool adds an invocation path, a credential, and a supply-chain dependency. This is usually the largest single driver.
• Retrieval complexity — corpus size matters far less than the number of distinct entitlement models behind it.
• Modalities and agent topology — image, document, and audio inputs each need separate testing, and multi-agent systems add inter-agent and cascading-failure scope.

As a sizing intuition: a contained assistant with no tool access and one data source is a fraction of the effort of a multi-agent system with tool access, persistent memory, and several entitlement models. Ask any provider to justify their estimate against your trust-boundary inventory rather than quoting a fixed package — a quote that does not reference your tool count has not been scoped.

When to Test, and How to Choose a Provider

Test before first production exposure, on every material change to the model, prompts, tools, or corpus, and annually for audit. Because provider-side model updates alter behaviour without any change on your side, pair scheduled engagements with automated regression testing.

Five questions that separate credible providers: Which taxonomies do findings map to? How is non-determinism measured and reported? Do you test the MCP and tool layer, including schema validation and rug-pull resistance? Do you test retrieval entitlement at query time? Can you assess the conventional attack surface too?

Checklist

Frequently Asked Questions

Contact: sales@vistainfosec.com — vistainfosec.com. General information, not legal advice. Obligations depend on classification, jurisdiction, sector, and national implementation.