Untrusted input
Prompt-injection scenarios through user input, retrieved content and connected sources.
AI applications · Agents · Retrieval
Your AI can act.
What can it reach?
Connecting an AI feature to business data or tools creates decisions a model should never make alone. Test the application’s permissions, data boundaries and approval controls before you expand access.
BW / ILLUSTRATIVE SCOPE
01UNTRUSTED INPUT
02AI APPLICATION
03DATA / TOOL BOUNDARY
AUTHORIZE / TEST / VERIFY
AI-assisted. Human-validated.Authorized scope. Actionable evidence.
01 / THE DECISION POINT
New capability. New trust boundaries.
An internal assistant becomes customer-facing. A retrieval system gains access to private documents. An agent gets permission to take action. Each change deserves a concrete review of what untrusted input could cause the application to do.
- Preparing to launch an AI assistant or customer-facing AI feature
- Connecting retrieval to private, user-specific or tenant-specific data
- Giving an agent access to business tools or consequential actions
02 / ASSESSMENT FOCUS
Test the system around the model.
Data boundaries
Retrieval authorization, cross-user separation and sensitive information exposure.
Tool permissions
Action limits, human approvals and the consequences of model-directed tool use.
Evidence your team can use.
- A documented set of threat scenarios and agreed application boundaries
- Validated findings with reproduction steps and observed impact
- Recommendations for permissions, data access and approval controls
- Coverage limitations and a prioritized plan to verify remediation
Clear limits. Agreed upfront.
This is an application-level assessment, not a model safety certification. Model training, broad model-behavior evaluations, unrestricted autonomous testing and third-party systems require separate scope. Authorization, test data, permitted actions and stop conditions are agreed first.
No testing is performed through this website. Delivery capability, commercial terms and deliverables must be confirmed before an engagement.
Before we begin.
Can you guarantee protection against prompt injection?
No. The goal is to identify and validate weaknesses in a defined application and improve its controls. No assessment can guarantee protection against every possible input or future model behavior.
Our model provider has safeguards. Why review the application?
The application determines which data is retrieved, which tools are available and which actions require approval. These integration choices need to be assessed in their own context, alongside the model’s behavior.
Do we need a finished product?
An architecture review can help frame risks before launch. Hands-on testing needs an accessible implementation and representative permissions, tools and test data. The appropriate work is agreed during scoping.
Will you send our production data to AI tools?
Data handling and any use of external tools or AI services must be agreed before the engagement. Do not send sensitive data in the initial enquiry. Representative synthetic test data can reduce exposure.
What should we provide to scope the review?
Describe the use case, model integrations, data sources, user roles, available tools and consequential actions. Include the intended launch date and any existing approval controls. Fees, access and deliverables are confirmed in the proposal.
Your conventional infrastructure, too.
Your business does not need to use AI to be targeted by attackers who do. Assess your identities, remote access, cloud environments and exposed services, too.
Explore AI threat readiness ↗03 / NEXT STEP
Map the boundaries before launch.
Describe your AI use case, data sources, connected tools, user roles and target date. Keep the first email high-level: no credentials, private datasets or sensitive prompts.
Scope an AI security reviewOpens your email app. Nothing is sent automatically.