Red-teaming, detection, and hardening for LLM-powered systems
As LLM-powered features enter production - RAG pipelines, AI agents, chatbots, document processors - they introduce a class of vulnerabilities that traditional penetration testing misses entirely. Prompt injection, where untrusted input hijacks model behavior, can cause AI agents to exfiltrate data, execute unauthorized tool calls, or expose system prompts. Indirect injection through retrieved documents is particularly dangerous in RAG systems: a malicious document in the knowledge base can silently redirect the agent's behavior for any user who triggers a retrieval that includes it. Most security teams have no framework for assessing these risks, and most AI product teams have never been red-teamed.
We deliver a structured three-phase assessment. Phase 1 - attack surface mapping: catalogue all LLM inputs (user messages, retrieved documents, tool call results, API responses, memory/context), trace data flows, identify trust boundaries. Phase 2 - red-team attack suite: systematic testing across 12+ attack categories including direct prompt injection, indirect injection via RAG corpus, jailbreak techniques (role-play, context injection, token manipulation), model inversion attempts, and output-based data exfiltration. Phase 3 - hardening and remediation: implementing input/output sanitization layers, system prompt hardening (few-shot robustness, instruction hierarchy enforcement), model output classifiers for anomaly detection, privilege separation in agent tool call scopes, and rate-limit tripwires for anomalous usage patterns. We also offer a monitoring plugin that wraps existing LLM API calls and flags anomalous completions in real time, deployable without modifying core application logic.
Delivered assessments for two AI product companies. In one case, discovered an indirect injection vulnerability via customer support ticket ingestion that would have allowed exfiltration of other users' ticket contents. In the second, found a jailbreak path through the system's document summarizer that bypassed content filtering. Both remediations were implemented within a week of report delivery.
1-2 weeks
We take on a small number of new engagements per quarter. If this matches your problem, let's talk.
Get in touch