Most teams ship an AI chatbot without ever testing it against prompt injection.
If your assistant reads e-mails, documents, web pages or tickets and can call tools, a stranger who writes to it can try to steer it. I test your chatbot or agent for prompt injection, jailbreaks, data exfiltration and tool misuse — and hand you a report with evidence and concrete fixes.
Get a free mini-scan See pricingWhat goes wrong
- Indirect prompt injection. An instruction hidden in an e-mail, PDF, web page or support ticket your agent reads gets executed as if you had typed it.
- Data exfiltration. The assistant is talked into forwarding customer data, order history or internal configuration to an outside address.
- Tool misuse. An agent with access to e-mail, refunds, payments or record deletion performs those actions with attacker-supplied arguments.
- System-prompt & secret leakage. The hidden instructions — and anything careless left in them, like API keys — are coaxed out.
- Jailbreaks. Safety and scope rules are overridden, so the bot answers off-topic or produces content it was meant to refuse.
Detection-only filters are not enough: in a public benchmark, prompt-injection detectors that scored 0.96–0.98 F1 on one dataset dropped to 0.37–0.70 on another. You need to test the actual behaviour.
Offers
Mini-scan
- 10–15 representative attack probes
- Run against one chatbot or endpoint
- 1-page summary of what passed and what did not
- No obligation
Full audit
- Full attack library across all categories
- Multi-turn and indirect-injection scenarios
- PDF report: severity table, per-finding evidence, remediation
- 30-minute walkthrough call
Monthly monitoring
- Re-run the suite on a schedule
- Catch regressions when prompts or models change
- New attack cases added as they emerge
- Short monthly report
Final price depends on the number of endpoints, tool access and how much setup help you need. The mini-scan is always free.
Why me
I build open-source defences against exactly this class of attack. My project
ProvGuard
takes an information-flow approach: instead of guessing whether text is malicious, it checks
which source supplied each sensitive argument, so a recipient or amount that only appears in an
e-mail cannot drive a send_email or transfer_money call.
ProvGuard is evaluated on AgentDojo (ETH Zürich), by deterministically replaying its reference task solutions through the policy — no model in the loop, so the numbers are reproducible:
| AgentDojo suite | Attacks stopped |
|---|---|
| Banking | 144 / 144 (100%) |
| Slack | 97 / 105 (92%) |
| Workspace | 200 / 240 (83%) |
| Travel | 79 / 120 (66%) |
These figures measure ProvGuard's policy on AgentDojo's reference trajectories, not your system. They are shown to explain the approach and depth behind the audit — your audit reports only what is found on your system. The four policies were written from tool signatures before any attack was seen. Details and limitations are in the ProvGuard README.
What gets tested
Findings are mapped to the OWASP Top 10 for LLM Applications (2025), so they are easy to hand to a security or compliance team.
Because model replies vary from run to run, each test is repeated and the report shows how many attempts succeeded, not just a single pass or fail. After you apply fixes, the same tests can be re-run and compared before and after.
See what the report looks like
Every audit ends with a written report: executive summary, severity table, the evidence for each finding, and concrete remediation.
The sample is generated against a deliberately naive local mock chatbot, not a real company's system.
How it works
Questions
Do you need access to my code or data?
No. The tests talk to the assistant the way any user would: through its chat endpoint or API. I do not need your source code, and I ask for test accounts, never real customer data.
Could testing break or harm my system?
The probes are ordinary messages. Tracking markers are random and any "attacker" address uses a reserved name that resolves nowhere, so no real data goes to a real third party. If your assistant can take real actions, we agree on a staging copy or test accounts first.
What if you find nothing?
Then the report says so and lists what was covered. A clean run is useful evidence, but it is not proof of safety: it only covers the tests that were run.
Can you re-test after we fix things?
Yes. The same tests can be re-run and compared with the first run, so you can see what was fixed and whether anything regressed. Ask about it when you book.
Is the mini-scan really free?
Yes: 10-15 representative probes against one assistant and a one-page summary. No obligation, and nothing runs until you have authorized it in writing.
Will you share my results?
No. Your report is yours. I would only mention your company as a reference if you explicitly agree to it.
Request a free mini-scan
Tell me about the assistant you want tested. I will reply with next steps and a short authorization form — I only test systems once their owner has given written permission.