AI penetration testing with frontier models, verified by senior operators
The strongest AI models from OpenAI, Anthropic, and xAI attack your website, API, or source code through our private harness. A senior operator proves every finding by hand before it reaches your report.
AI-assisted tests start at $500 for a simple website and $1,100 for a chatbot. See your exact price in 2 minutes →
- Verified findings only
- Black box or white box
- Fixed fee, free retest
- Report ready for SOC 2 and customers
What do you need tested?
Pick your starting point. Most clients start with one and add the rest once they see the results.
Website & API (black box)
We attack your live app over the network, the way an outside attacker would. Every finding comes with a working exploit.
Source code review (white box)
Frontier models read your entire codebase and trace every input to every sink. Each finding points to the exact file and line.
Desktop, mobile & vibe-coded apps
Installed software, iOS and Android apps, and products built fast with Lovable, Bolt, Cursor, or Claude Code.
Chatbots, RAG & AI agents
Prompt injection, data leakage, and tool abuse in the AI features you put in front of customers.
AI covers the ground. Operators prove the breach.
Attackers already use AI to find and chain vulnerabilities faster than a yearly pen test can keep up. We answer with the same tools: frontier models doing the volume work an attacker would automate, inside a harness built by operators who ran offensive programs for Fortune 500 companies.
Our harness gives the models a pentester's method: recon first, findings only with evidence, and a human checkpoint before anything changes your systems. It also feeds them this week's CVEs and exploits, so they are not limited to what they memorized at training time. Read how we built it.
What the AI does
- Maps every page, endpoint, parameter, and user role, not just the ones a human has time to reach
- Reads entire codebases and traces untrusted input to dangerous sinks, line by line
- Generates and runs thousands of targeted test cases against each hypothesis
- Checks every fingerprinted component against current CVE and exploit intelligence
What the senior operator does
- Sets scope and rules of engagement, and approves any action that could change your data or systems
- Chains low and medium findings into the real attack path, the part that still takes judgment
- Reproduces every finding by hand and throws out anything that does not survive a second look
- Writes the report and walks your team through it. No unverified AI output reaches you.
Two ways to test: black box or white box
Black box testing attacks your live application over the network, exactly as an outside attacker would, with no access to your code. White box testing hands the models your source code so they can review every line and every path, including the ones no attacker has found yet. Each answers a different question. Most SaaS companies get the most value from both.
Not sure which fits? We recommend one on the scoping call based on your stack, your deadline, and who is asking for the report.
Attack the live app over the network
The models and the operator start from a URL and a set of test accounts, the same position as a real attacker. We test your deployed application, its APIs, its authentication, and the infrastructure in front of it.
- Shows what an outside attacker can actually reach and exploit today
- No source code leaves your hands, so legal and procurement sign off fast
- Every finding comes with a working proof of exploit, request and response included
- Best for: compliance and customer pen test requests, external attack surface, apps you did not build
AI source code review
You give us read-only access to the repository. Frontier models read the whole codebase, follow data from every input to every sink, and flag the flaws. The operator then confirms each one against a running staging instance, so you get proof, not a pile of maybes.
- Finds bugs in code paths an outside attacker has not reached yet, including unreleased features
- Checks authorization on every route and every role, not a sample
- Points each finding to the exact file and line, with a suggested fix your developers can apply
- Best for: SaaS products, pre-launch and pre-enterprise-sale reviews, regulated data, AI-written code
Combine both
The code review finds the candidate. The live test proves it is exploitable in production. Together they give you the widest coverage and the strongest evidence for a customer security review or an audit.
| Black box | White box | |
|---|---|---|
| What we need | Target URLs, test accounts for each role, a testing window | Read-only repo access, build notes, a staging environment with test accounts |
| What it proves | What an attacker can exploit right now | Where the code is weak, including paths not exposed yet |
| Covers | Deployed app, APIs, auth, configuration, edge infrastructure | Every route, role, input handler, dependency, and secret in the code |
| Evidence | Working exploit with request and response | File and line, data-flow trace, confirmed against staging |
| Blind spots | Code paths the attacker cannot reach from outside | Production-only configuration, unless combined with black box |
Beyond websites: desktop, mobile, and vibe-coded apps
The same frontier models that review a web codebase can review almost anything with source code or a binary we can take apart. If you ship software your customers install, or you built your product in a weekend with an AI coding tool, the attack surface is in the code. That is where we look.
Each engagement can run white box from your source, or black box from the shipped app or binary when the code is not available.
Desktop applications
Windows, macOS, and Linux apps, including Electron, .NET, Java, and native code. Installed software runs with your customer's privileges, so a flaw here can hand an attacker their machine.
- Local privilege escalation through installers, services, and update mechanisms
- Unsigned or hijackable updates, DLL search order, and insecure IPC
- Electron misconfigurations: exposed Node integration, unsafe preload bridges, remote content
- Tokens, keys, and customer data stored in plain text on disk
Mobile applications
iOS and Android apps, native or cross-platform (React Native, Flutter). Tested against the OWASP MASVS, with the backend API in scope, because that is where most mobile breaches actually happen.
- API keys and secrets embedded in the app package
- Insecure local storage, weak certificate validation, and missing pinning where it matters
- Deep links, exported components, and WebViews an attacker can abuse
- Backend API authorization flaws reachable straight from the app
Vibe-coded applications
Built with Lovable, Bolt, Replit, v0, Cursor, or Claude Code? These tools ship working products fast, and they ship the same security mistakes over and over. We know exactly where to look.
- Database rules left open: Supabase row-level security off, Firebase rules that allow anyone
- Service keys and API secrets exposed in the front-end bundle
- Authorization checked only in the browser, so any user can call the API as an admin
- Unverified webhooks, missing rate limits, and dependencies the AI invented
- Best for: founders about to take payments, sign an enterprise customer, or raise a round
Chatbots and LLM systems exposed to your customers
If you put a chatbot, copilot, RAG assistant, or AI agent in front of customers, you gave the internet a new way into your data. A model that can read your documents or call your tools can be talked into leaking them or misusing them. We test it the way an attacker would, and we use AI attackers to do it at scale.
LLM security testing is a penetration test of a chatbot, RAG assistant, or AI agent that tries to make the model leak data, ignore its instructions, or misuse the tools it can call. Findings are mapped to the OWASP Top 10 for LLM Applications and MITRE ATLAS.
We go past jailbreak screenshots. A finding means real impact: data that left, an action that should not have run, or money an attacker can make you spend.
What we attack
- Simple chatbots. Q&A bots and support assistants with no tools or private data
- RAG and knowledge assistants. Models that answer from your documents, tickets, or customer records
- Agents and tool-using systems. Models that call APIs, run code, send email, or connect through MCP servers
What we test for
- Direct and indirect prompt injection, including instructions hidden in documents, web pages, and emails the model reads
- System prompt extraction and guardrail bypass
- Leakage of customer data, other tenants' data, and RAG sources the user should not see
- Excessive agency: tool and function calls an attacker can trigger, and MCP server abuse
- Insecure output handling that turns model output into XSS, SQL injection, or command execution
- Abuse and cost attacks that run up your model bill or knock the assistant offline
Frameworks we map to
Findings map to the OWASP Top 10 for LLM Applications, the OWASP Top 10 for Agentic Applications, and MITRE ATLAS, so your auditors, customers, and AI governance program (NIST AI RMF, ISO/IEC 42001) can use the report directly.
Safe for production, careful with your code
Letting AI loose on your systems should make you ask hard questions. Here are our answers, in writing, before any testing starts.
Guardrails on the AI
- Scope enforced in code. Every command passes a scope gateway that checks targets and the testing window before it runs.
- A human holds the brakes. Anything that could change data or system state waits for operator approval.
- No denial-of-service testing unless you specifically scope it in. We share source IPs in advance and can pause instantly.
- Full audit trail. Every AI and operator action is logged with a timestamp.
Your source code and data
- Your code is reviewed in an isolated workspace and deleted at the end of the engagement, with written confirmation on request
- Your code and findings are never used to train AI models
- We tell you which model providers process your data, and if anything must not reach a cloud model, we scope around it
- Mutual NDA available before you share anything
What you get
The same engagement standard as every Red Hound penetration test: fixed fee against a written statement of work, daily status during active testing, critical findings reported within 24 hours, and a free retest of every critical and high finding once you fix it.
Deliverables
- Executive summary written for non-technical readers, safe to share with customers and auditors
- Verified findings only, each with proof of exploit or file-and-line evidence and business impact
- Prioritized fixes your developers can apply, including code-level suggestions for white box findings
- Framework mapping: OWASP Top 10, OWASP MASVS, OWASP LLM and Agentic Top 10, MITRE ATLAS
- Attestation letter for procurement, compliance, or your cyber insurer
- Live readout with engineering and leadership
Why Red Hound
- Our own harness, not a resold platform. We built it, we refresh its exploit intelligence every week, and we know exactly what it can and cannot do.
- Senior operators on every engagement. CISSP, GPEN, GWAPT, and GCIH certified, with decades of Fortune 500 red team and Big Four offensive experience reviewing what the AI finds.
- Transparent pricing. Price it yourself in two minutes with our pentest cost calculator. No demo call required.
- Built for 10 to 500 employees. Enterprise-grade AI testing without the enterprise platform contract.
Frequently asked
The questions buyers ask most about AI penetration testing. If yours is not here, ask it on the scoping call.
What is AI penetration testing?
AI penetration testing is a penetration test in which frontier AI models do the volume work of mapping your application, reviewing code, and generating attacks, and a senior human operator verifies every finding by hand before it reaches your report. Red Hound runs it black box against your live website or API, or white box against your source code. It is also the name for security testing of AI systems themselves, such as chatbots and AI agents, which we cover in LLM and chatbot testing.
Is AI pentesting just an automated scan?
No. A scanner matches known signatures and reports everything that looks suspicious. Our harness has frontier models reason about your application, form hypotheses, and test them, and then a senior operator proves or discards each one by hand. You get verified findings, not a list of maybes.
Will AI testing break production?
The harness enforces scope before every command, and any action that could change data or system state waits for a human. Denial-of-service testing is off unless you scope it in. For extra safety, many clients point white box confirmation and the most aggressive tests at staging.
Which AI models do you use?
Frontier models from OpenAI, Anthropic, and xAI, with each model assigned to the work it does best: deep reasoning on hard attack paths, orchestration, or fast triage. We name the providers in your statement of work.
Should we choose black box or white box?
Black box if you need to show what an outside attacker can do today, or you cannot share code. White box if you own the code and want the deepest coverage per dollar. Both if you sell to enterprises or handle regulated data. We will recommend one on the scoping call.
Will the report satisfy SOC 2, customers, and auditors?
Yes. The report follows the same structure as our standard penetration tests, with an executive summary, verified findings, remediation guidance, and an attestation letter. Clients use it for SOC 2, ISO 27001, PCI DSS, HIPAA, and customer security questionnaires.
How long does it take and what does it cost?
Most engagements run one to three weeks of active testing plus a week for reporting, depending on size. Every engagement is fixed-fee: AI-assisted website tests start at $500, standard web applications at $800, and chatbot or LLM tests at $1,100. Get an instant estimate in two minutes →. Free, no sales call needed.
Find out what an AI-equipped attacker would find first.
Get an instant cost estimate in two minutes, or book a paid 30-minute scoping session with a senior expert (your fee is credited toward the engagement). Either way, you get a written SOW with a fixed fee before you commit.
Need network, Active Directory, cloud, or social engineering testing too? See all penetration testing services.