# AI red teaming services for LLM apps, RAG and agents

Source: https://airedteamingservices.com/
Publisher: Excession Labs (airedteamingservices.com)
Last updated: 2026-11-09

AI red teaming and security assessments of LLM applications, RAG systems, AI agents and MCP tools by Excession Labs. Evidence, impact, fixes and retest.

AI red teaming by Excession Labs
Find what your AI application can be made to do
We test LLM applications, RAG systems and AI agents for the failures that matter to a business: leaking data, crossing access boundaries and taking actions nobody approved.
Scope an assessmentSee the example report
Testing starts only after written scope and authorization. No credentials or customer data through the form.

Lab example

1Untrusted content arrivesA customer opens a ticket. Its text contains hidden instructions for the assistant.
2Retrieval pulls it inAn agent asks the assistant to summarize open tickets. The ticket enters the model's context.
3The tool call follows the attackerThe assistant calls send_email with order data to an outside address.
4EvidenceTool-call log, prompt and output transcript. Succeeded in 4 of 20 attempts.
5Fix and retestOutbound email limited to the requester's own address and gated by approval. 0 of 20 after the fix.

What we assessWe test the whole path from input to action: what the model reads, which tools it can call, and whose permissions those tools use.

LLM and RAG applicationsAssistants, copilots and searchPrompt injection from users and from retrieved content, retrieval that ignores document permissions, sensitive data in answers, unsafe output rendering. LLM and RAG assessment
AI agentsSystems that take actionsTool permissions, whose credentials the agent uses, approval steps that can be skipped, and multi-step actions nobody intended. Agent assessment
MCP servers and clientsTools you build or adoptTool descriptions as untrusted input, token handling, authorization and servers that change after approval. MCP assessment
Enterprise reviewsEvidence for AI security questionnairesWhat buyers ask about AI features, and a report that answers with evidence. AI security reviews

What we look for
FailureExample
Data leakageA user in tenant A asks a question and the answer quotes tenant B's documents
Indirect prompt injectionA web page, email or ticket instructs the assistant to change its behavior
Unauthorized actionsAn agent issues a refund, sends email or changes a record the user could not change
Approval bypassA large action split into small ones that each skip the approval step
Output exfiltrationA rendered image link sends conversation data to an outside server
System prompt exposureInternal rules or codes in the prompt revealed to users

How we test a system that answers differently each timeA language model can give a different answer to the same input, so one success or one failure tells you little. We run each test case many times under recorded conditions and report how often it succeeded.

A threat model of your data, tools and users before testing
Test conditions recorded: model, settings, accounts, data and attempt count
Evidence: prompts, outputs, retrieved documents and tool-call logs
Business impact in plain words, not just a category name
Fixes that limit damage: permissions, filters, approvals, output handling
A retest with the same conditions after you fix

Our methodology

What an assessment can and cannot tell youAn assessment shows where your system is exposed today, how often each attack works, and which controls reduce the damage. It cannot prove that no attack will ever work. Prompt injection has no complete fix today, so a good design limits what a successful injection can reach.We map findings to the OWASP Top 10 for LLM Applications (the 2026 edition, with 2025 IDs alongside) so your team and your customers can compare results. Frameworks are a shared vocabulary, not a certificate.
When to test

Before you launch an AI feature to customers
Before you connect a new data source or tool
Before you let an agent act without a person approving
When an enterprise customer asks how you handle AI risks
After a model or prompt change that alters behavior

Scope an assessment

Guides

Prompt injectionPrompt injectionDirect and indirect injection, why it is not solved, and what limits the damage.
RAG and dataRAG securityRetrieval that respects permissions, and how to test it across tenants.
Agents and toolsMCP security risksTool poisoning, token handling and confused deputies in MCP.

All guides

## Questions

### What is AI red teaming?

AI red teaming is adversarial testing of an AI system to find how it can be made to behave in harmful or unintended ways. For a business application, that usually means testing whether the assistant or agent can leak data, cross access boundaries or take actions it should not. [What is AI red teaming?](/guides/what-is-ai-red-teaming/)

### Is this different from a normal penetration test?

Yes. A penetration test checks the application's code paths, such as access control and injection. An AI assessment tests how the model behaves with untrusted input, retrieved content and tools. Most AI products need both. The rest of the application can be tested at [penetrationtestservices.com](https://penetrationtestservices.com/).

### Can you make our assistant safe from prompt injection?

No one can. Model providers and security agencies describe prompt injection as an unsolved problem. We show where your system is exposed, measure how often attacks succeed, and recommend controls that limit the damage, such as narrower tool permissions and approval steps. Then we retest.

### What do you need from us?

A test environment, test accounts in at least two tenants or roles, a description of the data sources and tools the system uses, and a contact during testing. We agree access in writing. Do not send credentials or real customer data through the scoping form.

### Which frameworks do you map findings to?

We map findings to the OWASP Top 10 for LLM Applications 2026, with the 2025 IDs alongside because many reviewers still use them. Agent findings also map to the OWASP Top 10 for Agentic Applications. We reference MITRE ATLAS and the NIST AI Risk Management Framework where useful. Frameworks help readers compare results; they are not certifications. [Framework mapping](/frameworks/)