Applications built on large language models (LLMs) – virtual assistants, copilots, autonomous agents, search features and content generation – have become part of critical business processes, handling sensitive information and performing actions on behalf of users.
Unlike traditional applications, an LLM application interprets natural language and treats the content it receives as a potential instruction. Documents, web pages, emails, search results and API responses may carry commands able to change the behaviour of the model, bypass the restrictions defined for it and lead the system to perform unauthorised operations.
Once the model is connected to tools, vector databases, internal APIs or features that execute actions, a flaw is no longer just an inappropriate answer: it becomes data leakage, fraud, resource abuse and compromise of the integrated systems.
The goal of an LLM Application Pentest is to assess that attack surface in a controlled way, identifying vulnerabilities before they can be exploited and allowing fixes to be applied proactively.
Depending on the agreed scope, the assessment of LLM applications may include:
Most current applications do not simply generate text. The model queries internal sources, calls APIs, triggers tools and, in agent architectures, chains several of those operations together to complete a task requested by the user.
Every tool made available to the model widens the attack surface. A malicious instruction received inside a document can be interpreted by the agent as a legitimate task and result in reading another user's data, sending information outside the organisation or performing unauthorised operations on integrated systems.
For that reason the assessment is not limited to the responses of the model. It also covers the permission boundaries of each tool, the validation applied before actions are executed, the isolation between user sessions and how the application behaves when the model receives conflicting instructions.
When the LLM application is exposed through a Web interface or APIs, those layers are assessed as well whenever they are part of the agreed scope, providing a broader view of the attack surface.
The assessment is based on the OWASP Top 10 for LLM Applications 2026, the main international reference for security testing of applications built on language models.
When the application is delivered through Web interfaces or APIs, the assessment is complemented by the OWASP Web Security Testing Guide (WSTG), the OWASP Top 10 and the OWASP API Security Top 10, according to the scope defined.
Most of the work is carried out manually by specialists, with automated tools used only to support reconnaissance, mapping and initial checks.
This approach matters particularly in LLM applications, where the most significant flaws depend on chained instructions, on the context of each conversation and on the permissions granted to the tools – conditions that automated scanners do not reproduce.
All tests are executed in a controlled manner, within the scope authorised by the company, seeking to minimise impact on normal application operation.
At the end of the assessment we deliver a technical report and an executive report containing everything needed to support the remediation of the vulnerabilities identified.
The report includes:
Alongside the technical report we also provide a Penetration Test Attestation Letter, a document that certifies the tests were carried out and can be used as evidence in audits, compliance processes, vendor approval and with clients and business partners.