AI red teaming by Excession Labs
Find what your AI application can be made to do
We test LLM applications, RAG systems and AI agents for the failures that matter to a business: leaking data, crossing access boundaries and taking actions nobody approved.
Testing starts only after written scope and authorization. No credentials or customer data through the form.
A customer opens a ticket. Its text contains hidden instructions for the assistant.
An agent asks the assistant to summarize open tickets. The ticket enters the model's context.
The assistant calls send_email with order data to an outside address.
Tool-call log, prompt and output transcript. Succeeded in 4 of 20 attempts.
Outbound email limited to the requester's own address and gated by approval. 0 of 20 after the fix.
What we assess#
We test the whole path from input to action: what the model reads, which tools it can call, and whose permissions those tools use.
Assistants, copilots and search#
Prompt injection from users and from retrieved content, retrieval that ignores document permissions, sensitive data in answers, unsafe output rendering. LLM and RAG assessment
Systems that take actions#
Tool permissions, whose credentials the agent uses, approval steps that can be skipped, and multi-step actions nobody intended. Agent assessment
Tools you build or adopt#
Tool descriptions as untrusted input, token handling, authorization and servers that change after approval. MCP assessment
Evidence for AI security questionnaires#
What buyers ask about AI features, and a report that answers with evidence. AI security reviews
What we look for#
| Failure | Example |
|---|---|
| Data leakage | A user in tenant A asks a question and the answer quotes tenant B's documents |
| Indirect prompt injection | A web page, email or ticket instructs the assistant to change its behavior |
| Unauthorized actions | An agent issues a refund, sends email or changes a record the user could not change |
| Approval bypass | A large action split into small ones that each skip the approval step |
| Output exfiltration | A rendered image link sends conversation data to an outside server |
| System prompt exposure | Internal rules or codes in the prompt revealed to users |
How we test a system that answers differently each time#
A language model can give a different answer to the same input, so one success or one failure tells you little. We run each test case many times under recorded conditions and report how often it succeeded.
- A threat model of your data, tools and users before testing
- Test conditions recorded: model, settings, accounts, data and attempt count
- Evidence: prompts, outputs, retrieved documents and tool-call logs
- Business impact in plain words, not just a category name
- Fixes that limit damage: permissions, filters, approvals, output handling
- A retest with the same conditions after you fix
What an assessment can and cannot tell you#
An assessment shows where your system is exposed today, how often each attack works, and which controls reduce the damage. It cannot prove that no attack will ever work. Prompt injection has no complete fix today, so a good design limits what a successful injection can reach.
We map findings to the OWASP Top 10 for LLM Applications (the 2026 edition, with 2025 IDs alongside) so your team and your customers can compare results. Frameworks are a shared vocabulary, not a certificate.
When to test#
- Before you launch an AI feature to customers
- Before you connect a new data source or tool
- Before you let an agent act without a person approving
- When an enterprise customer asks how you handle AI risks
- After a model or prompt change that alters behavior
Guides#
Questions
What is AI red teaming?
AI red teaming is adversarial testing of an AI system to find how it can be made to behave in harmful or unintended ways. For a business application, that usually means testing whether the assistant or agent can leak data, cross access boundaries or take actions it should not. What is AI red teaming?
Is this different from a normal penetration test?
Yes. A penetration test checks the application's code paths, such as access control and injection. An AI assessment tests how the model behaves with untrusted input, retrieved content and tools. Most AI products need both. The rest of the application can be tested at penetrationtestservices.com.
Can you make our assistant safe from prompt injection?
No one can. Model providers and security agencies describe prompt injection as an unsolved problem. We show where your system is exposed, measure how often attacks succeed, and recommend controls that limit the damage, such as narrower tool permissions and approval steps. Then we retest.
What do you need from us?
A test environment, test accounts in at least two tenants or roles, a description of the data sources and tools the system uses, and a contact during testing. We agree access in writing. Do not send credentials or real customer data through the scoping form.
Which frameworks do you map findings to?
We map findings to the OWASP Top 10 for LLM Applications 2026, with the 2025 IDs alongside because many reviewers still use them. Agent findings also map to the OWASP Top 10 for Agentic Applications. We reference MITRE ATLAS and the NIST AI Risk Management Framework where useful. Frameworks help readers compare results; they are not certifications. Framework mapping
Shipping an AI feature or agent?
Describe the system, the data it reads and the actions it can take. We reply with questions and a proposed scope.