Senior-led security testing for AI-powered applications, agents, chatbots, RAG systems, and LLM-integrated workflows.
Working with Huntrix was smooth and productive. [They] delivered a risk assessment that was both actionable and easy to communicate across the organization.
Brian Kendzior
VP of AI, RIOS Intelligent Machines
Angelica Rivera
CEO, Colmex Construction
I had the pleasure of working closely with Miguel. He has an incredible amount of knowledge. I’d work with Miguel again in a heartbeat and would encourage you to if given the opportunity.
Joseph Noa
Vulnerability Analyst, Pentester
Franco Medrano
Software Engineer, Amazon
Dr. Smith
Owner, OPS Family Care
Broken Authorization
Data Leakage
Unsafe Tool Use
Prompt Injection
Weak Guardrails
AI features introduce risk in places traditional testing may not fully cover: prompts, model responses, retrieval systems, plugins, tools, agents, permissions, and downstream actions.
The risk is what the AI feature can access, reveal, trigger, modify, or trust.
Signal
What Happens
Impact
Broken Authorization
The AI feature retrieves or summarizes information the user should not access.
Existing access controls are weakened by the AI layer.
Data Leakage
Sensitive data appears in responses, retrieved context, logs, traces, or model outputs.
Customer data, internal data, or regulated information is be exposed.
Unsafe Tool Use
Agents or AI workflows call tools, APIs, or functions without enough validation.
The system performs unauthorized actions, modifies records, or triggers business-impacting workflows.
Prompt Injection
Users manipulate the model into ignoring instructions or following malicious ones.
The AI feature may expose data, bypass controls, or take actions outside the intended workflow.
Weak Guardrails
Safety rules work in simple cases but fail under adversarial or multi-step prompts.
Teams overestimate protection and ship features with fragile controls.
Data exposure visibility
Identify where sensitive information can leak through prompts, retrieval, logs, responses, or tool outputs.
Control validation
Test whether authorization, guardrails, system prompts, filters, and workflow controls hold up under pressure.
Abuse-case clarity
Understand how users, attackers, or insiders could manipulate the AI feature.
Product-specific risk context
Tie findings to your actual workflows, users, permissions, customer data, and business model.
Safer release decisions
Give product and engineering teams clearer evidence before launching or expanding AI features.
Remediation direction
Turn AI security findings into practical engineering work.
Product and engineering leaders building AI-powered features
SaaS teams adding copilots, assistants, summarization, or automation
Teams preparing for customer security reviews involving AI functionality
Teams building AI agents that call tools, APIs, or business workflows
Companies using RAG over customer, internal, or sensitive data
Training data exposure
Excessive agency
AI Supply Chain Vulnerabilities
Insecure Output Handling
Insecure plugin, function, or tool use
Prompt injections (Direct & Indirect)
Authentication and session management
Authorization and access control
Business logic flaws
Account takeover paths
Input validation and injection risks
Sensitive data exposure
File upload and content handling
Workflow bypasses
Transaction and state manipulation
Client-side and server-side security issues
OWASP Top 10 coverage
Application-specific attack paths
Professional cybersecurity services
We learn the application, user roles, sensitive workflows, business goals, timeline, and compliance needs.
We identify the areas most likely to create meaningful impact: customer data, payments, admin actions, permissions, integrations, authentication flows, and high-value workflows.
Senior testers assess the application using real attacker techniques, not just automated scanning.
When useful, we use AI and automation to accelerate coverage and test ideation. Human judgment stays in control.
We test broken assumptions, privilege abuse, workflow bypasses, state manipulation, and edge cases that require human reasoning.
We validate findings, remove noise, prioritize by impact, and explain why each issue matters.
Findings can move into Jira, Notion, ServiceNow, or the workflow your team already uses.
We confirm fixes, update statuses, and help your team prove remediation.
Continuous Testing
For teams shipping often and needing recurring assessment instead of a once-a-year snapshot.
Manual Pentest
For teams that need depth, business logic assessment, and human attacker simulation.
AI-Enhanced Pentest
For teams that want efficient coverage and accelerated test planning, with senior testers still in control.
Hybrid Testing
For teams that want manual depth supported by targeted automation and AI-enhanced workflows.
You can expect the following from our team:
Professional cybersecurity services
No.
Risk Score
Finding
1
Resolved
Missing Authentication on Internal API Route
2
Critical
Unauthenticated API Data Exposure
3
Critical
Hardcoded CI/CD Deployment Token Allowed Unauthorized Pipeline Access
4
Critical
Prompt Injection Enabled Unauthorized Retrieval of Private User Data
5
High
AI Assistant Failed to Enforce Tenant Boundaries During Retrieval-Augmented Responses
6
High
Session Tokens Remained Valid After Logout
7
High
Stored Cross-Site Scripting Allowed Script Execution in Administrative User Sessions
8
Medium
Missing Rate Limiting on Login API Supports Password Spraying
9
Medium
Missing CI/CD Dependency Vulnerability Gates
10
Low
Security Headers Missing from Web Application Responses
Critical
async function testPublicEndpoint() {
const response = await fetch("https://api.example.com/api/accounts/users", {
method: "GET",
headers: {
"Accept": "application/json"
// No Authorization header included
}
});
const data = await response.json();
...
console.table(data.slice(0, 3).map(user => ({
id: user.id,
username: user.userName,
email: user.email,
role: user.roles?.[0]
})));
}
testPublicEndpoint();
Huntrix gives your team direct access to senior security practitioners without the slow, expensive bureocratic layers that often make consulting painful, bloated and expensive for no reason.
AI & LLM pentesting is security testing for applications that use large language models, AI agents, chatbots, copilots, RAG systems, or AI-powered workflows. The objective is to answer whether AI features can be manipulated, abused, or used to expose sensitive data, bypass controls, trigger unsafe actions, or create business risk. Unlike basic prompt testing, AI & LLM pentesting looks at the full system around the model: the application, users, permissions, data sources, prompts, tools, APIs, logs, and business workflows.
Huntrix can test AI-powered systems such as:
We don’t focus solely on the model or AI component, but also on contextual systems around it, which interacts with real business logic.
AI features introduce risks that traditional application testing may not fully cover.
The model may process untrusted input, retrieve sensitive data, call tools, trigger workflows, or produce output that a downstream systems trusts.
That creates new opportunities for attackers to abuse systems that use AI technology. In our experience, a user may not need to break the application directly like in a Web Application Pentest. They may be able to manipulate AI features into exposing data, bypassing controls, or performing actions the product never intended. So while traditional web application testing is relevant, AI requires a deeper level of specialization. We pride ourselves with the expertise in our team and it is a reason why we offer LLM testing to our clients.
The most common AI application risks include prompt injections (direct and indirect), sensitive data exposure, weak authorization, and cross-tenant data leakage to name a few.
These issues typically stem from implementation misconfigurations in development processes. The highest-risk issues usually appear when the AI feature has access to sensitive data, internal systems, customer records, privileged workflows, or business-critical actions.
RAG systems can leak sensitive data when any of the following are not designed carefully:
A user may ask a question that causes the system to retrieve information they should not access. The model may then summarize, quote, infer, or expose that information in the response.
Common risk areas include poor isolation and authorization boundaries.
Huntrix can test RAG systems. Our RAG testing looks at how the AI features retrieves, use, and expose information from connected data sources.
Common risks include sensitive data leakage, cross-tenant data exposure, weak access controls, unsafe retrieval behavior, poisoned knowledge sources, and responses that reveal information the user should not access.
RAG security depends heavily on permissions, data boundaries, retrieval design, and how the model uses retrieved context.
Traditional web application pentesting focuses on vulnerabilities in the application, such as authentication issues, broken authorization, injection flaws, session weaknesses, sensitive data exposure, and business logic flaws.
AI pentesting focuses on the new risks introduced by AI features, such as prompt injection, indirect prompt injection, unsafe tool use, RAG data leakage, model behavior manipulation, excessive agency, guardrail bypass, and AI workflow abuse.
In practice, the two often overlap. AI security still depends on strong application security, access control, data handling, logging, validation, and product-specific business logic.
AI agents and tool-enabled workflows are risky because these systems can do more than generate text. In our experience, most agents have a combination of these capabilities:
We identify in 90% of cases that the risk comes from excessive trust. If the system allows the model to decide when and how to use tools without strong human validation (like permission checks, approval steps, or action limits), then an attacker may be able to manipulate the AI into doing something unsafe. That is why we strongly believe in the concept of human-in-the-loop when it comes to AI system design. Like a modern aircraft, autopilot features can do most of the heavy lifting, but you still need a pilot on board to direct the aircraft in the right direction.
AI & LLM testing can include applications built with commercial model providers, cloud-hosted model services, or open-source model integrations.
Common environments may include:
The model provider is one part of the risk. The larger part is how integrated AI features connect to your application, data, users, prompts, tools, permissions, and workflows. This is a key focus for us in our testing methodology.
Huntrix approaches data leakage testing by first understanding how the AI application works and what types of sensitive data matter most to the business.
We then explore the system the way an attacker would, looking for where sensitive information might surface across prompts, responses, retrieved context, logs, traces, chat history, tool outputs, and model-generated summaries.
This includes testing both obvious and non-obvious paths such as context handling, retrieval behavior, error traces, and internal system interactions.
Because AI systems are non-deterministic, we revisit areas multiple times, vary inputs, and test how memory, token limits, and repeated interactions can influence outcomes.
We also evaluate how guardrails can be bypassed and how layered systems, including multiple models used for filtering or refining responses, may introduce additional leakage paths.
Our goal is to identify both direct and indirect exposure, including cases where the model summarizes, infers, or combines sensitive information from different sources.
Huntrix tests whether the AI systems respects the same permission boundaries as the rest of the application by actively attempting to bypass those controls through realistic user interactions.
This includes testing whether users can access, retrieve, summarize, or act on information outside their role, account, or tenant.
We do this by manipulating prompts, abusing retrieval logic, chaining interactions, or leveraging tool and agent behavior.
We also evaluate how permissions are enforced across the full AI workflow, including prompt construction, retrieval layers, tool execution, and response generation, to identify where authorization checks may be missing, inconsistent, or bypassable.
This is especially important for SaaS platforms, internal copilots, customer support assistants, RAG systems, and AI features connected to private or multi-tenant data.
👋 Hey, looking forward to meeting you!
Let's get started
By providing your information, you consent to us contacting you by email regarding the data provided. We do not sell your personal information, and you can withdraw consent at any time. By submitting this form, you agree to our Privacy Policy and Terms of Service.
Get a Quote
👋 Hey, tell us more about what tests you need!
You can select multiple options depending on your needs.
By providing your information, you consent to us contacting you by email or phone regarding the data provided. We do not sell your personal information, and you can withdraw consent at any time. By submitting this form, you agree to our Privacy Policy and Terms of Service.
