We treat the LLM as an untrusted component in the application stack, not as a black box. Testing focuses on how user input reaches the model, how model output is handled downstream, and whether the boundary between the application and the LLM provider is properly enforced. We probe prompt construction logic, test system prompt confidentiality, and evaluate whether the application trusts model output in ways it shouldn't.

RAG systems introduce two attack surfaces that LLM-only integrations don't have: the document ingestion pipeline and the vector retrieval layer. We test both. On ingestion, we evaluate whether malicious content embedded in source documents can influence model behavior at query time. On retrieval, we test whether users can manipulate queries to surface documents they shouldn't have access to, and whether the retrieval results respect tenant or role boundaries. We also evaluate how the application handles conflicting or adversarially crafted retrieved chunks.

MCP dramatically expands what an AI system can do - and therefore what it can be made to do. We test MCP servers as network-exposed services with their own attack surface, evaluate tool definitions for overly permissive capability declarations, and assess whether the host application enforces meaningful human-in-the-loop controls before executing sensitive tools. We also test for prompt injection paths that could cause an LLM client to invoke MCP tools without user intent.

Agents operate with greater autonomy, longer task horizons, and more real-world side effects than single-turn LLM calls. Testing focuses on whether agents can be diverted from their intended task, whether they enforce scope boundaries across multi-step workflows, and whether their actions are reversible when something goes wrong. We simulate adversarial inputs at each step in multi-agent pipelines and evaluate whether orchestrator-to-subagent trust is properly scoped.