# AI Red Teaming Services > Find how your AI application can leak data, cross access boundaries or take actions it should not. Assessments of LLM apps, RAG systems, agents and MCP tools. AI Red Teaming Services is operated by Excession Labs (https://excessionlabs.ai). Contact: support@excessionlabs.ai. Excession Labs tests only systems whose owner has given written authorization. Every page is also available as Markdown: add `index.md` to the page URL. ## Key pages - [About AI Red Teaming Services](https://airedteamingservices.com/about/index.md): AI Red Teaming Services is run by Excession Labs, which builds AI tools for authorized security work and assesses LLM apps, RAG systems and agents. - [Contact us about AI security testing](https://airedteamingservices.com/contact/index.md): Contact AI Red Teaming Services about a security assessment of your LLM application, RAG system, AI agent or MCP server: use the scoping form or email us. - [AI red team report example: a support assistant assessment](https://airedteamingservices.com/example-report/index.md): AI red team report example: a lab assessment of a fictional support assistant with scope, threat model, six findings, transcripts, attempt counts and retests. - [AI security frameworks: OWASP, MITRE ATLAS and NIST mapping](https://airedteamingservices.com/frameworks/index.md): OWASP LLM Top 10 (2026 and 2025 IDs), OWASP agentic IDs, MITRE ATLAS techniques and NIST AI RMF mapped to AI security findings. None is a certification. - [AI security and red teaming guides](https://airedteamingservices.com/guides/index.md): Guides on AI red teaming, prompt injection, RAG security, AI agent permissions, MCP risks and frameworks such as the OWASP LLM Top 10 and MITRE ATLAS. - [AI red teaming services for LLM apps, RAG and agents](https://airedteamingservices.com/index.md): AI red teaming and security assessments of LLM applications, RAG systems, AI agents and MCP tools by Excession Labs. Evidence, impact, fixes and retest. - [AI red teaming methodology](https://airedteamingservices.com/methodology/index.md): AI red teaming methodology in eight steps: threat model, test plan, conditions, repeated attempts, evidence, impact, fixes and retest, with safety rules. - [Privacy notice](https://airedteamingservices.com/privacy/index.md): What AI Red Teaming Services collects when you visit or send a request, why, where it is stored, how long we keep it and how to contact Excession Labs about your data. - [Scope an AI security assessment](https://airedteamingservices.com/scoping/index.md): Describe your AI app, its data sources, tools and sensitive actions. We reply with follow-up questions and a proposed scope for an AI red teaming assessment. ## Services - [AI agent security assessment](https://airedteamingservices.com/ai-agent-security-assessment/index.md): AI agent security assessment: we test tool permissions, tool credentials, approval bypass, multi-step chains and memory, with evidence and a retest. - [AI security questionnaires: answering enterprise reviews of AI features](https://airedteamingservices.com/ai-security-questionnaires/index.md): AI security questionnaire themes enterprise buyers raise: data use, tenant isolation, prompt injection, approval, logging, and the evidence that answers each. - [LLM application security assessment](https://airedteamingservices.com/llm-application-security-assessment/index.md): LLM security assessment of your app or RAG system: we test prompt injection, tenant leaks, data exposure and output handling, and report evidence and fixes. - [MCP security assessment](https://airedteamingservices.com/mcp-security-assessment/index.md): MCP security assessment for servers and clients you build or adopt: tool poisoning, rug pulls, token handling, confused deputy and authorization checks. ## Guides - [Agent memory poisoning: how persistent AI memory gets attacked](https://airedteamingservices.com/guides/agent-memory-poisoning/index.md): Agent memory poisoning plants hostile text in an AI agent's long-term memory so it shapes later sessions. Two documented cases, an 8-step test plan and fixes. - [AI agent permissions: how to scope tools and credentials](https://airedteamingservices.com/guides/ai-agent-permissions/index.md): AI agent permissions: give each tool one task, one scoped credential and an approval rule. Includes a copyable permission matrix and a 7-step test plan. - [AI red teaming tools: open-source scanners and frameworks compared](https://airedteamingservices.com/guides/ai-red-teaming-tools/index.md): AI red teaming tools checked on their official repos on 9 Nov 2026: garak, PyRIT, promptfoo, DeepTeam, Giskard and Inspect, with license, use and limits. - [AI red teaming vs penetration testing: differences and when you need each](https://airedteamingservices.com/guides/ai-red-teaming-vs-penetration-testing/index.md): AI red teaming vs pentesting: compare target, method, proof and cost drivers, use the decision table to pick, and see one finding that needs both. - [Data exfiltration through markdown images in LLM apps](https://airedteamingservices.com/guides/data-exfiltration-through-markdown-images/index.md): LLM data exfiltration via markdown images: how a rendered image carries chat data out, five documented cases from 2023 to 2025, and the fixes that close it. - [EU AI Act red teaming: what the Act says about adversarial testing](https://airedteamingservices.com/guides/eu-ai-act-red-teaming/index.md): EU AI Act red teaming: which articles cover adversarial testing (Art. 55, 15, 9), who each binds, and the application dates after the 2026 Digital Omnibus. - [Excessive agency in LLM apps: causes, tests and fixes](https://airedteamingservices.com/guides/excessive-agency/index.md): Excessive agency lets an LLM app take damaging actions on bad model output. Covers the three root causes, a tool review table, a test method and OWASP's fixes. - [How to scope an AI red team engagement: questions, access and stop conditions](https://airedteamingservices.com/guides/how-to-scope-an-ai-red-team/index.md): How to scope an AI red team engagement: eight questions on purpose, users, models, data, tools and environments, plus test data, rules and stop conditions. - [Human approval bypass in AI agents: how confirmations fail](https://airedteamingservices.com/guides/human-approval-bypass/index.md): Human approval bypass in AI agents: why confirmations fail (approval fatigue, vague prompts, trigger words, Always Allow) and a 14-row approval UX test table. - [Indirect prompt injection: sources, real cases and how to test for it](https://airedteamingservices.com/guides/indirect-prompt-injection/index.md): Indirect prompt injection hides instructions in content an LLM reads. A source inventory, real cases (Slack AI, GitHub MCP, EchoLeak) and a test plan. - [Jailbreak vs prompt injection: the difference and why it matters](https://airedteamingservices.com/guides/jailbreak-vs-prompt-injection/index.md): Jailbreak vs prompt injection: a jailbreak attacks a model's safety training, prompt injection attacks the app around it. Comparison table, tests and defenses. - [MCP security risks: tool poisoning, confused deputy and token passthrough](https://airedteamingservices.com/guides/mcp-security-risks/index.md): MCP security risks and what the official spec says about each: tool poisoning, confused deputy, token passthrough. Includes a 22-point server review checklist. - [MITRE ATLAS: the attack matrix for AI systems, with technique IDs](https://airedteamingservices.com/guides/mitre-atlas/index.md): MITRE ATLAS explained: how it differs from ATT&CK and the OWASP LLM Top 10, with a table of LLM, RAG and agent technique IDs checked in release v2026.10. - [NIST AI RMF and red teaming: what AI 100-1 and AI 600-1 say](https://airedteamingservices.com/guides/nist-ai-rmf-and-red-teaming/index.md): NIST AI RMF red teaming: what AI RMF 1.0 and the Generative AI Profile (AI 600-1) say, with suggested action IDs mapped to Govern, Map, Measure and Manage. - [OWASP Top 10 for Agentic Applications: ASI01 to ASI10 and how to test them](https://airedteamingservices.com/guides/owasp-agentic-ai-threats/index.md): OWASP agentic AI threats: the Top 10 for Agentic Applications (ASI01 to ASI10) with each ID, the earlier OWASP threat model, and a test question per risk. - [OWASP Top 10 for LLM Applications: the 2026 list, 2025 mapping and how to test each risk](https://airedteamingservices.com/guides/owasp-top-10-for-llm-applications/index.md): OWASP Top 10 for LLM Applications: exact IDs and names for the 2026 and 2025 lists, a 2025-to-2026 mapping, and a tester's check for each risk. - [Prompt injection: what it is, how testers find it and how to reduce it](https://airedteamingservices.com/guides/prompt-injection/index.md): Prompt injection makes an LLM app follow instructions that should be data. See direct and indirect types, 10 test cases with evidence to capture, and fixes. - [RAG security: how to test retrieval authorization and poisoning](https://airedteamingservices.com/guides/rag-security/index.md): RAG security means the retriever enforces who may read each document. See the main risks and a 12-row, two-tenant test matrix for retrieval access. - [System prompt leakage: why secrets in prompts fail and how to test for it](https://airedteamingservices.com/guides/system-prompt-leakage/index.md): System prompt leakage exposes hidden instructions, tool schemas and secrets. Read the OWASP LLM07:2025 and LLM08:2026 wording, an 8-row test table and fixes. - [Testing customer support chatbots: security and policy test plan](https://airedteamingservices.com/guides/testing-customer-support-chatbots/index.md): Chatbot security testing for customer support bots: 24 test cases with pass conditions for refund promises (Moffatt v. Air Canada), leaks, handoff and tools. - [What is AI red teaming? Definition, scope and what testers deliver](https://airedteamingservices.com/guides/what-is-ai-red-teaming/index.md): What is AI red teaming? The NIST definition, a six-layer scope map for LLM apps and agents, a sample test, and how it differs from safety evals and pentests. ## Related Excession Labs sites - [penetrationtestservices.com](https://penetrationtestservices.com/llms.txt): Web application, API and SaaS penetration testing - [aipentestservices.com](https://aipentestservices.com/llms.txt): AI-assisted penetration testing with human review - [pentestcompare.com](https://pentestcompare.com/llms.txt): Sourced comparison of pentest providers ## Optional - [Full text of this site](https://airedteamingservices.com/llms-full.txt)