AI services
AI security testing
We try to break your AI agent or chatbot the way an attacker would, fix what we find and test it again.
In short
AI security testing checks whether someone can trick your AI agent or chatbot into leaking data or doing something it shouldn't. We test for prompt injection, loose tool permissions, exposed secrets and risky MCP servers, then fix what we find and test again. A review takes one to three weeks and is quoted after a short call.
Your agent reads text from strangers. We find out what it does with it.
An AI agent reads emails, tickets, web pages and uploaded files, and some of that text is written by people you'll never meet. Prompt injection is when that text carries instructions and the model follows them. OWASP ranks it as the top risk for apps built on language models.
The risk grows with every tool you add. A chatbot that can only reply can embarrass you. An agent that can send email, refund orders or query your database can do real damage. We test your system the way an attacker would, on a copy of it, then close the gaps with permissions, approval steps and code. A stricter prompt is the last line of defence, never the first.
Is this for you?
You'll get the most out of this if
- Your agent reads emails, files or web pages from outside the company
- Your AI can send, pay, delete or change records
- You've connected MCP servers and nobody has checked what they can reach
- A customer's security team has sent you a questionnaire about your AI
Deliverables
What you walk away with
- 01
A map of what the AI can reach
Every tool, data source and MCP server it touches, and what an attacker could do through each one.
- 02
Attack tests on a copy of your system
Prompt injection through every way text gets in, attempts to pull out data or the system prompt, and tries at making tools act outside their job.
- 03
Fixes you can see in the code
Tighter tool permissions, approval steps for risky actions, outside text handled as data, and secrets moved where the model can't reach them.
- 04
Tests that stay
Every attack becomes a test that runs before each release, so a new prompt or model can't quietly reopen a hole.
Timeline
How the project runs
Typical timings for a first live version. We confirm yours in writing after discovery.
Days 1 to 3
Map
What the AI can read, what it can do, and who could get text in front of it.
Weeks 1 to 2
Attack
Hand-written attacks for your tools, plus automated runs of known patterns, all on a staging copy.
Weeks 2 to 3
Fix
The fixes, done by us or with your engineers, starting with whatever could do the most damage.
Final days
Re-test
Every attack run again until it fails, and the tests handed over for future releases.
Usual stackOWASP LLM Top 10, Prompt injection tests, Red teaming, promptfoo, MCP, OAuth 2.1, Claude, OpenAI, LangGraph, Python, Node.js
Why a small studio
The person who scopes your project is the one who builds it, and the one who picks up when it breaks at 2am.
- The founder is on your project
- Hussain leads every build himself. You won't brief an account manager who briefs a developer who briefs someone else.
- Three people, the output of ten
- We build with Claude, Codex and our own agent tooling every day. A small senior team now covers what used to need a department.
- We stay after launch
- Evals before every release, a log of each AI decision, cost limits and someone on call. Month six matters more to us than demo day.
- Your repo, your cloud
- The code sits in your GitHub and runs in your AWS, GCP or Azure account from the first commit, on tools your next hire already knows.
- Projects shipped
- 115
- since 2014
- Clients served
- 53
- US, UK, EU, Middle East, APAC
- Average rating
- 5.0
- 113 of 113 rated jobs
- Years shipping software
- 18
- the founder, since 2008
FAQ
Questions people ask
What is prompt injection?
It's when text the AI reads contains instructions, and the AI follows them instead of yours. The text can hide in an email, a web page, a PDF or a support ticket. OWASP lists it as the top risk for apps built on large language models.
Can a better system prompt fix it?
It helps a little. A prompt that says "never do this" can be talked around. The fixes that hold sit outside the model: limit what each tool can do, ask a person before risky actions, and keep secrets where the model can't reach them.
Do you test MCP servers too?
Yes, including ones we didn't build. MCP servers decide what the AI can read and change, so they're often where the real risk sits. We check sign-in, permissions and what each tool actually does.
Will you test on our live system?
Only if you ask us to. We normally work on a staging copy, so nothing real gets sent, deleted or charged.
How much does AI security testing cost?
We quote after a short call, based on how many AI features, agents and tools are in scope. A chatbot with no tools is a quick review. An agent with several tools and MCP servers takes longer.
What do you need from us?
Access to a test copy of the system, a list of the tools and data the AI can reach, and someone who can approve fixes.
Keep exploring
Goes well with
- AI agentsAgents that read what comes in, decide what to do and do it, with a person in the loop where it matters.
- MCP serversMCP servers that let Claude, ChatGPT, Cursor and your own agents use your systems, with sign-in, permissions and a log of every call.
- AI consultingA senior AI engineer embedded with your team to find the work worth automating, build it and stay until it runs.
Start here
Let's scope yours.
Send a few lines about the workflow or product. You'll hear back from Hussain within a working day with questions, a rough shape and a ballpark.