Prompt injection
We test whether instructions in documents, web pages or messages can redirect the assistant, disclose information or trigger unauthorised actions.
AI APPLICATION SECURITYTest what your AI
Test what your AI
can reach.
Your assistant can read documents, call APIs and act for users. We test whether those capabilities respect the permissions and approvals your product relies on.
WHERE THE RISK SITSThe model is one part.
The model is one part.
The permissions are everywhere.
We follow data and actions through the application, retrieval layer and connected tools.
Retrieval & tenant boundaries
Does each user receive only documents they can read? We compare users, organisations, retrieved content and citations, including changes to document permissions.
Agents, tools & MCP
Can an agent use an overprivileged tool, substitute an object identifier or bypass an approval? Where MCP is in scope, we examine exposed tools, authentication and downstream permissions.
Output & downstream use
What happens when generated content becomes HTML, a database query or input to another service? We test the application controls at the point of use.
Memory & shared context
Can one user’s uploaded content affect another user’s answers or expose stored information? We agree the memory and knowledge-management paths that need testing.
Underlying application controls
We test the chat API’s authentication, object-level authorisation, session revocation and file handling within the agreed scope.
Start with the permission model
We document each test user’s permissions, trusted content and approval requirements. Testing compares the expected access decisions with the data returned and actions performed.
How a result becomes a finding
Evidence records the input, account role, configuration and observed result. Application logs confirm any reported action, and repeated tests record inconsistent behaviour.
What we need from you
Architecture and provider details, the features and integrations in scope, accounts with different roles and organisations, and synthetic records with a clear access policy. For tool actions, agree safe objects, spending limits, stop conditions and logging.
What you receive
A coverage record, validated findings with reproduction steps, practical changes to retrieval or tool permissions, and retest criteria. Untested paths, missing access and model-dependent behaviour are stated. We agree how prompts, documents and logs may be handled, including any external AI services.
Assessment coverage
The report lists the features, model configuration and integrations tested. Changes to prompts, models, knowledge sources or permissions may require follow-up checks. Model training and regulatory certification need a separate scope.
TECHNICAL REFERENCESMap the risks
Map the risks
to your architecture.
OWASP guidance on application permissions, agent behaviour and prompt injection.
Let's talk scopeWhat do you
What do you
need tested?
Tell us about your application, infrastructure or upcoming deadline. We’ll work through the scope with you and put together a proposal.
ping [at] azacus.io ↗Prefer a call? 0131 287 7869
Please don’t include credentials or sensitive testing data here.