AI red teaming for LLM apps, RAG and agents
AI red teaming from Excession Labs, a security lab. We test your LLM application, RAG system or AI agent for the failures that matter to a business: leaking data, crossing access boundaries and taking actions nobody approved. You receive a written report with evidence, fixes and an example you can read first.
A customer opens a ticket. Its text contains hidden instructions for the assistant.
An agent asks the assistant to summarize open tickets. The ticket enters the model's context.
The assistant calls send_email with order data to an outside address.
Tool-call log, prompt and output transcript. Succeeded in 4 of 20 attempts.
Outbound email limited to the requester's own address and gated by approval. 0 of 20 after the fix.
What we assess#
We test the whole path from input to action: what the model reads, which tools it can call, and whose permissions those tools use.
LLM and RAG applications#
Assistants, copilots and search. Prompt injection from users and from retrieved content, retrieval that ignores document permissions, sensitive data in answers, unsafe output rendering. LLM and RAG assessment
AI agents#
Systems that take actions. Tool permissions, whose credentials the agent uses, approval steps that can be skipped, and multi-step actions nobody intended. Agent assessment
MCP servers and clients#
Tools you build or adopt. Tool descriptions as untrusted input, token handling, authorization and servers that change after approval. MCP assessment
Enterprise reviews#
Evidence for AI security questionnaires. What buyers ask about AI features, and a report that answers with evidence. AI security reviews
What you receive and how scoping works#
Every assessment is a scoped, authorized test with a written report. Prices are quoted after scoping, and we do not publish a price list.
Written report#
HTML, PDF and Markdown, with evidence for each finding, a four-level severity scale (Critical, High, Medium, Low), the controls that held and a section for open questions. Read the example report
Scoping#
A short call, then a written scope and proposal. We test only with written authorization from the system owner. Scope an assessment
Retest#
We can retest fixed findings under the same recorded conditions.
What we need from you#
A test environment, test accounts in at least two tenants or roles, and a description of the data sources and tools the system uses.
| Service page | Search it matches |
|---|---|
| LLM security assessment | LLM penetration testing for chat assistants, copilots and RAG |
| AI agent security assessment | AI agent red teaming: tool permissions, credentials and approval steps |
| MCP security testing | MCP servers and clients, tool poisoning and authorization |
What we look for#
| Failure | Example |
|---|---|
| Data leakage | A user in tenant A asks a question and the answer quotes tenant B's documents |
| Indirect prompt injection | A web page, email or ticket instructs the assistant to change its behavior |
| Unauthorized actions | An agent issues a refund, sends email or changes a record the user could not change |
| Approval bypass | A large action split into small ones that each skip the approval step |
| Output exfiltration | A rendered image link sends conversation data to an outside server |
| System prompt exposure | Internal rules or codes in the prompt revealed to users |
A language model can give a different answer to the same input, so one success or one failure tells you little. We run each test case many times under recorded conditions and report how often it succeeded. No assessment can prove that no attack will ever work, and prompt injection has no complete fix today, so a good design limits what a successful injection can reach.
What the report records#
- A threat model of your data, tools and users before testing
- Test conditions recorded: model, settings, accounts, data and attempt count
- Evidence: prompts, outputs, retrieved documents and tool-call logs
- Business impact in plain words, not just a category name
- Fixes that limit damage: permissions, filters, approvals, output handling
- A retest with the same conditions after you fix
Findings map to the OWASP Top 10 for LLM Applications (the 2026 edition, with 2025 IDs alongside). Frameworks are a shared vocabulary, not a certificate. Methodology
When to test#
- Before you launch an AI feature to customers
- Before you connect a new data source or tool
- Before you let an agent act without a person approving
- When an enterprise customer asks how you handle AI risks
- After a model or prompt change that alters behavior
Questions
What is AI red teaming?
AI red teaming is adversarial testing of an AI system to find how it can be made to behave in harmful or unintended ways. For a business application, that usually means testing whether the assistant or agent can leak data, cross access boundaries or take actions it should not. What is AI red teaming?
Is this different from a normal penetration test?
Yes. A penetration test checks the application's code paths, such as access control and injection. An AI assessment tests how the model behaves with untrusted input, retrieved content and tools. Most AI products need both. The rest of the application can be tested at penetrationtestservices.com.
Can you make our assistant safe from prompt injection?
No one can. Model providers and security agencies describe prompt injection as an unsolved problem. We show where your system is exposed, measure how often attacks succeed, and recommend controls that limit the damage, such as narrower tool permissions and approval steps. Then we retest.
What do you need from us?
A test environment, test accounts in at least two tenants or roles, a description of the data sources and tools the system uses, and a contact during testing. We agree access in writing. Do not send credentials or real customer data through the scoping form.
Which frameworks do you map findings to?
We map findings to the OWASP Top 10 for LLM Applications 2026, with the 2025 IDs alongside because many reviewers still use them. Agent findings also map to the OWASP Top 10 for Agentic Applications. We reference MITRE ATLAS and the NIST AI Risk Management Framework where useful. Frameworks help readers compare results; they are not certifications. Framework mapping
Shipping an AI feature or agent?
Describe the system, the data it reads and the actions it can take. We reply with questions and a proposed scope.