AI application security
AI features such as chatbots, RAG and agents need a different security test from a web app. See why, and where Excession Labs scopes AI system assessments.
Short answer
A web or API pentest tests code paths and access control. An AI feature adds a model that reads untrusted text and may call tools. That needs a different test. Excession Labs scopes assessments of LLM apps, RAG and agents on a separate site, AI Red Teaming Services. Use the standard web test for the rest of your product.
You added a chatbot, a copilot or an agent to your product, and customers now ask about it in security reviews. A normal penetration test does not answer their questions.
Why do AI features need a different test?#
A web app does what its code says. An AI feature does what a model decides after reading text, which may come from a user, a document, a web page or a tool result. Hostile text can push the model to leak data, ignore rules or call a tool it should not.
Three things change. Untrusted text becomes instructions, so a hostile sentence in a retrieved document can change the model's behavior. Retrieval has its own access rules, and a search index may return a document that the current user must not see. Tools act with real permissions, so an agent that can send email or edit records turns a bad answer into a bad action.
The standard test still applies. Sign-in, access control and API checks stay in scope, and many AI-feature leaks end up there. Our web application and API pages cover that layer.
Where do you go for the AI part?#
Excession Labs scopes assessments of AI systems on a separate site: AI Red Teaming Services. It covers LLM and RAG applications, agents and MCP tools.
| Your situation | Start with |
|---|---|
| A normal product with an AI feature added | The web and API test, then an AI assessment of the feature |
| Multi-tenant SaaS with AI search over customer data | SaaS testing for tenant isolation, then an AI assessment of retrieval |
| An agent with tools and credentials | An AI assessment |
| A customer asking about AI security | Customer security review, then the AI assessment |
We do not claim past AI red-team engagements or results on these pages. We scope each AI assessment in writing with you.
What do you need to bring?#
- A short description of the AI feature, its model provider and its tools.
- The data sources it reads, and who may see each one.
- Test accounts, with at least two tenants if the product is multi-tenant.
- Written authorization from the system owner.
Request a pentest for the web and API layer, or scope the AI assessment at airedteamingservices.com.
Questions
Does a web app pentest cover my chatbot?
It covers the web and API layer around the chatbot: sign-in, access control and the endpoints it calls. It does not test how the model responds to hostile text or how it uses tools. That needs an assessment built for AI systems.
Which test do I need first?
Start with the web and API test if the AI feature sits inside a normal product. Then scope the AI assessment for the feature itself. If the AI system is the product, begin with the AI assessment.
Can prompt injection be fully prevented?
No. It cannot be fully prevented today. Teams reduce the impact by limiting what the model can do, restricting tool permissions and checking outputs. An assessment shows which of those limits hold in your system.
Sources
- OWASP Top 10:2025 (checked 9 November 2026)
Need a pentest you can act on?
Tell us what you need tested and why. We reply to agree scope, and testing starts only after written authorization.