AI & LLM Penetration Testing in India & UAE.
Security testing for production AI / LLM systems — prompt injection, jailbreaks, data exfiltration via context windows, model supply-chain risks, RAG pipeline poisoning, agentic tool-call abuse and ML training-data integrity. Mapped to OWASP LLM Top 10 and MITRE ATLAS, with deliverables your AI safety team and your CISO both accept.
What is AI and LLM penetration testing?
AI penetration testing assesses applications built on large language models for prompt injection, insecure output handling, data leakage, and agent/tool abuse, following the OWASP Top 10 for LLM Applications. Macksofy tests RAG pipelines, chatbots, and MCP servers so AI features ship without opening a new attack surface.
An AI system is seven systems.
Most AI security scopes test the prompt box because it is the part you can see. We test the model, the retrieval layer, the tools it can call, the data it was trained on and where all of that came from.
- ▸System-prompt extraction
- ▸Jailbreak sweep
- ▸Output-format hijack
- ▸Classifier bypass
- ▸Encoding + multi-turn evasion
- ▸PII/secret leak checks
- ▸Refusal-boundary probing
- ▸Membership inference
- ▸Cost-amplification
- ▸Corpus poisoning
- ▸Cross-tenant retrieval
- ▸Embedding-space adversarials
- ▸Confused-deputy tool calls
- ▸Schema fuzzing
- ▸Sandbox escape
- ▸Poisoning vectors
- ▸Model inversion
- ▸PII recall from corpus
- ▸Weight provenance
- ▸Embedding-model trust
- ▸Dependency + plugin review
A scope that stops at the chat box tests one of these seven layers. The findings that matter — tenancy, tool authorisation, corpus trust — live below it.
Four shapes of AI system. Four scopes.
The support agent, the onboarding bot, the in-product copilot.
- ▸Jailbreak and refusal-boundary sweep
- ▸System-prompt extraction attempts
- ▸Abuse and cost-amplification scenarios
- ▸Output handling in the surrounding app
Where multi-tenant SaaS most often leaks — and rarely notices.
- ▸Indirect injection via poisoned corpus documents
- ▸Cross-tenant retrieval and index isolation
- ▸Vector-store authorisation review
- ▸Embedding-space adversarial retrieval
Anything that can act, not just answer.
- ▸Confused-deputy testing across the tool boundary
- ▸Function-call schema fuzzing
- ▸MCP server enumeration and authorisation testing
- ▸Sandbox escape from code-execution tools
The training path is an attack path too.
- ▸Training-data poisoning vectors
- ▸Membership inference and model inversion
- ▸PII recall from the training corpus
- ▸Weight and embedding-model provenance
Nobody typed anything malicious.
The highest-impact AI findings do not look like attacks. A document gets ingested, a normal question retrieves it, and a tool the agent was always allowed to call returns data it was never allowed to return.
- De-risk customer-facing LLM products before regulator or media exposure
- Satisfy emerging AI-governance frameworks: EU AI Act, India DPDP Act AI-system controls, NIST AI RMF, ISO/IEC 42001
- Catch RAG-pipeline data leakage before it becomes a customer-data incident
- Validate agentic systems (function-calling, tool-use, MCP) for unintended actions
- Poison the corpusAttacker
A support article — submitted through a public form and auto-ingested — carries instructions addressed to the model, not the reader.
LLM04 · Data & Model PoisoningIngest-time content sanitisation and provenance tagging on the corpus - Retrieve the payloadRAG pipeline
A benign user question matches the poisoned chunk on embedding similarity. The injected text enters the context window as trusted source material.
LLM08 · Vector & Embedding WeaknessesRetrieval-time injection classifier plus per-tenant index isolation - Follow the instructionModel
Nothing in the context distinguishes retrieved data from operator instruction, so the model treats the payload as a directive.
LLM01 · Prompt InjectionStructured context with hard data/instruction separation - Invoke a privileged toolAgent
The agent calls its lookup tool with an identifier it was told to use. The tool trusts the agent's caller identity rather than the end user's.
LLM06 · Excessive AgencyAuthorisation enforced at the tool boundary, on the user's identity - Return another tenant's dataBackend
The record comes back and lands in the model's context — from where it will be summarised straight to the attacker.
LLM02 · Sensitive Information DisclosureRow-level tenancy checks independent of the calling service - Where it finally stopsOutput guard
An output validator that scores responses for cross-tenant identifiers is the last line — and the only one in this chain that held.
LLM05 · Improper Output HandlingDeployed and verified during the retest window
Reconstructed from an anonymised engagement against a customer-facing fintech support agent. Every finding we report ships with the reproducer prompt and the guardrail above it.
Seven phases, prompt injection is one.
- ▸Architecture review: model, RAG, agent tools, fine-tune pipeline, deployment surface
- ▸Data-flow review: training data, embeddings, vector store, output channels
- ▸Threat model aligned to OWASP LLM Top 10 + MITRE ATLAS
- ▸Direct + indirect (RAG-borne) prompt injection
- ▸Jailbreak technique sweep (DAN, roleplay, encoding, multi-turn)
- ▸System-prompt extraction attempts
- ▸Output-format hijack (markdown, link, image injection)
- ▸Indirect prompt injection via poisoned documents in the corpus
- ▸Embedding-space attacks (adversarial similar-meaning queries)
- ▸Cross-tenant retrieval leakage testing for multi-tenant RAG
- ▸Vector-DB access control and authorization review
- ▸Function-call schema fuzzing
- ▸Tool-chain confused-deputy testing (agent invoking privileged tools on user behalf)
- ▸MCP server enumeration and abuse
- ▸Sandbox escape from code-execution tools
- ▸Training-data integrity review (poisoning vectors)
- ▸Model supply chain (HuggingFace weights, embedding-model provenance)
- ▸Membership inference + model inversion testing
- ▸PII leakage from training corpus probing
- ▸Output-classifier coverage testing (toxicity, PII, secrets, prompt-leak)
- ▸Rate-limit + abuse-detection circumvention attempts
- ▸Cost-amplification attack scenarios (long-context, tool-loop)
- ▸Per-finding writeup with reproducer prompt
- ▸Suggested guardrail prompt + output-validator rule
- ▸Free retest of guardrails within 30 days
Both of these shipped fixed.
Scope · Customer-facing GPT-4o-powered support agent + RAG over support docs
Finding · Indirect prompt injection via a poisoned support article let an attacker exfiltrate other tenants' chat history via the agent's retrieval tool
Critical — patched via guardrail prompt + retrieval-tenancy enforcement; cross-tenant leakage closed before launch
Scope · Patient-symptom triage LLM with EMR tool-call access
Finding · Tool-call confused-deputy: a craftily-phrased patient prompt caused the agent to retrieve another patient's record via the EMR lookup tool
Critical — authz enforced at the tool layer not the agent layer; remediated before clinical rollout
The evidence your auditor will ask for.
AI governance frameworks are converging on the same demand: show that you adversarially tested the system, and show what you changed.
Personal data flowing into prompts, embeddings and training corpora is still personal data. We test where it goes and what the model can be made to recall.
For high-risk classifications, robustness and adversarial testing are expected evidence. Our findings inventory maps to that expectation.
Findings are organised so they slot into the Measure and Manage functions rather than sitting in a separate security silo.
AI management-system audits ask for evidence of ongoing evaluation. Retest results give you a dated artefact.
Open red-team frameworks. Plus our own corpus.
Provider-agnostic across OpenAI, Anthropic, Google, Meta and Mistral, plus self-hosted models via vLLM or Ollama and your own fine-tunes. We test what you actually ship.
Transparent tiers. No surprises at quote time.
Indicative price ranges based on typical Indian engagements. Final fixed-price quote within 72 hours of the discovery call.
Focused
- Manual + tooled testing
- CERT-In format report
- Free 30-day retest
Stack
- Everything in Focused
- Web + API + mobile coverage
- Executive + technical briefings
Programme
- Everything in Stack
- Quarterly cycles + post-release retests
- Same consultants throughout
Note · Indicative pricing in INR. Final quote depends on scope, asset count and engagement window. Fixed-price proposal within 72 hours.
What lands in your inbox
- OWASP LLM Top 10 + MITRE ATLAS findings inventory
- Reproducer prompts for every finding (copy-pasteable)
- Recommended guardrail prompts + output-validator rules
- RAG pipeline + vector-store hardening checklist
- Agent tool-use sandboxing patterns
- Training-data integrity + supply-chain risk register
- Free retest within 30 days of guardrail deployment
Sectors we operate in
Empanelled by CERT-In. Accredited by EC-Council.
“We've worked with three Big 4 firms before Macksofy. None found what their team did in our payments stack. The most actionable report we've received in a decade.”
“The CHFI training Macksofy delivered for our cyber cell raised investigation quality measurably. Practical, India-context-aware, and respectful of our operational realities.”
“Came in with zero security background. 5 weeks later I was running Burp Suite and Metasploit confidently. Cleared CEH on the first attempt.”
Questions before we scope.
Where Macksofy delivers AI Pentest.
On-site engagements across India's BFSI, fintech, government and SaaS metros plus the UAE. Senior consultants fly from Mumbai BKC for kickoff, key reviews and exit briefings; remote weeks run through the rest of the engagement.
Macksofy delivers this work to the following standards and regulator requirements. Definitions and controls are sourced from the issuing bodies below.
Get a fixed-price proposal in 48 hours.
Tell us about your security need — pentest, audit, training or a wider engagement. A senior consultant will reply within a few business hours.
- CERT-In Empanelled
- EC-Council ATC · CompTIA Authorized
- Thousands of professionals trained
- India + UAE engagements