Prompt injection testing
Prompt injection is when text in a user message, a document or a web page gets an AI to ignore its instructions. We test your LLM app for direct and indirect injection, system prompt leaks and misuse of tools, then report each weakness with the exact input that triggered it.
What is prompt injection?
Prompt injection is an attack where crafted text makes an AI system follow the attacker's instructions instead of yours. It can come straight from a user, or hide inside content the AI reads, such as a document, email or web page. It’s listed first in the OWASP Top 10 for LLM applications.
What do you test for?
We try to override instructions, extract the system prompt, make the app reveal other users' data, trigger tools it shouldn’t use, and smuggle data out through links or images in replies. We cover direct input and indirect routes such as uploaded files, retrieved documents and web content.
- Overriding or ignoring the app instructions
- Extracting the system prompt
- Exposing other users' or internal data
- Triggering tools or actions that should be blocked
- Sending data out through links, images or tool calls
How do you test without breaking anything?
We agree scope and a safe environment first, use test accounts and test data, and keep a log of every attempt. Anything that could cause real harm, such as sending email or changing records, is tested against a sandbox or with the action disabled.
Will this prove my app is secure?
No test can prove that. Prompt injection can’t be fully prevented today, so the goal is to find the attacks that work against your app, measure how reliably, and show which defences reduce the risk. You get a repeatable test set to run after each change.
What does prompt injection testing cost?
Each project is quoted on its scope, so there’s no price list. The main cost drivers are how many entry points the app has, whether it reads outside content, how many tools it can call, how deep the testing goes, and whether you want retesting. Request a quote and we reply by email.
Key terms
Frequently asked questions
Is this a penetration test?
It’s a focused security test of the AI parts of your application. It doesn’t replace a full penetration test of your infrastructure.
Can you test an agent that reads email or web pages?
Yes. Indirect injection is where those systems are most exposed, so we place test content where the agent reads and watch what it does.
How is this different from a chatbot audit?
A chatbot audit measures quality: whether answers are right. Prompt injection testing measures resistance: whether someone can make the app misbehave on purpose.
Ready to find out what is breaking?
Tell us what you’re shipping. We reply by email, and quote each project on its scope.