# AI security and red teaming guides Source: https://airedteamingservices.com/guides/ Publisher: Excession Labs (airedteamingservices.com) Last updated: 2026-11-09 Guides on AI red teaming, prompt injection, RAG security, AI agent permissions, MCP risks and frameworks such as the OWASP LLM Top 10 and MITRE ATLAS. Practical guides for teams that build with LLMs, retrieval and agents. Each one explains a risk, shows how testers check for it, and lists fixes that limit the damage. Facts carry their sources and the date we checked them. - [Agent memory poisoning: how persistent AI memory gets attacked](https://airedteamingservices.com/guides/agent-memory-poisoning/): Agent memory poisoning plants hostile text in an AI agent's long-term memory so it shapes later sessions. Two documented cases, an 8-step test plan and fixes. - [AI agent permissions: how to scope tools and credentials](https://airedteamingservices.com/guides/ai-agent-permissions/): AI agent permissions: give each tool one task, one scoped credential and an approval rule. Includes a copyable permission matrix and a 7-step test plan. - [AI red teaming tools: open-source scanners and frameworks compared](https://airedteamingservices.com/guides/ai-red-teaming-tools/): AI red teaming tools checked on their official repos on 9 Nov 2026: garak, PyRIT, promptfoo, DeepTeam, Giskard and Inspect, with license, use and limits. - [AI red teaming vs penetration testing: differences and when you need each](https://airedteamingservices.com/guides/ai-red-teaming-vs-penetration-testing/): AI red teaming vs pentesting: compare target, method, proof and cost drivers, use the decision table to pick, and see one finding that needs both. - [Data exfiltration through markdown images in LLM apps](https://airedteamingservices.com/guides/data-exfiltration-through-markdown-images/): LLM data exfiltration via markdown images: how a rendered image carries chat data out, five documented cases from 2023 to 2025, and the fixes that close it. - [EU AI Act red teaming: what the Act says about adversarial testing](https://airedteamingservices.com/guides/eu-ai-act-red-teaming/): EU AI Act red teaming: which articles cover adversarial testing (Art. 55, 15, 9), who each binds, and the application dates after the 2026 Digital Omnibus. - [Excessive agency in LLM apps: causes, tests and fixes](https://airedteamingservices.com/guides/excessive-agency/): Excessive agency lets an LLM app take damaging actions on bad model output. Covers the three root causes, a tool review table, a test method and OWASP's fixes. - [How to scope an AI red team engagement: questions, access and stop conditions](https://airedteamingservices.com/guides/how-to-scope-an-ai-red-team/): How to scope an AI red team engagement: eight questions on purpose, users, models, data, tools and environments, plus test data, rules and stop conditions. - [Human approval bypass in AI agents: how confirmations fail](https://airedteamingservices.com/guides/human-approval-bypass/): Human approval bypass in AI agents: why confirmations fail (approval fatigue, vague prompts, trigger words, Always Allow) and a 14-row approval UX test table. - [Indirect prompt injection: sources, real cases and how to test for it](https://airedteamingservices.com/guides/indirect-prompt-injection/): Indirect prompt injection hides instructions in content an LLM reads. A source inventory, real cases (Slack AI, GitHub MCP, EchoLeak) and a test plan. - [Jailbreak vs prompt injection: the difference and why it matters](https://airedteamingservices.com/guides/jailbreak-vs-prompt-injection/): Jailbreak vs prompt injection: a jailbreak attacks a model's safety training, prompt injection attacks the app around it. Comparison table, tests and defenses. - [MCP security risks: tool poisoning, confused deputy and token passthrough](https://airedteamingservices.com/guides/mcp-security-risks/): MCP security risks and what the official spec says about each: tool poisoning, confused deputy, token passthrough. Includes a 22-point server review checklist. - [MITRE ATLAS: the attack matrix for AI systems, with technique IDs](https://airedteamingservices.com/guides/mitre-atlas/): MITRE ATLAS explained: how it differs from ATT&CK and the OWASP LLM Top 10, with a table of LLM, RAG and agent technique IDs checked in release v2026.10. - [NIST AI RMF and red teaming: what AI 100-1 and AI 600-1 say](https://airedteamingservices.com/guides/nist-ai-rmf-and-red-teaming/): NIST AI RMF red teaming: what AI RMF 1.0 and the Generative AI Profile (AI 600-1) say, with suggested action IDs mapped to Govern, Map, Measure and Manage. - [OWASP Top 10 for Agentic Applications: ASI01 to ASI10 and how to test them](https://airedteamingservices.com/guides/owasp-agentic-ai-threats/): OWASP agentic AI threats: the Top 10 for Agentic Applications (ASI01 to ASI10) with each ID, the earlier OWASP threat model, and a test question per risk. - [OWASP Top 10 for LLM Applications: the 2026 list, 2025 mapping and how to test each risk](https://airedteamingservices.com/guides/owasp-top-10-for-llm-applications/): OWASP Top 10 for LLM Applications: exact IDs and names for the 2026 and 2025 lists, a 2025-to-2026 mapping, and a tester's check for each risk. - [Prompt injection: what it is, how testers find it and how to reduce it](https://airedteamingservices.com/guides/prompt-injection/): Prompt injection makes an LLM app follow instructions that should be data. See direct and indirect types, 10 test cases with evidence to capture, and fixes. - [RAG security: how to test retrieval authorization and poisoning](https://airedteamingservices.com/guides/rag-security/): RAG security means the retriever enforces who may read each document. See the main risks and a 12-row, two-tenant test matrix for retrieval access. - [System prompt leakage: why secrets in prompts fail and how to test for it](https://airedteamingservices.com/guides/system-prompt-leakage/): System prompt leakage exposes hidden instructions, tool schemas and secrets. Read the OWASP LLM07:2025 and LLM08:2026 wording, an 8-row test table and fixes. - [Testing customer support chatbots: security and policy test plan](https://airedteamingservices.com/guides/testing-customer-support-chatbots/): Chatbot security testing for customer support bots: 24 test cases with pass conditions for refund promises (Moffatt v. Air Canada), leaks, handoff and tools. - [What is AI red teaming? Definition, scope and what testers deliver](https://airedteamingservices.com/guides/what-is-ai-red-teaming/): What is AI red teaming? The NIST definition, a six-layer scope map for LLM apps and agents, a sample test, and how it differs from safety evals and pentests.