> For the complete documentation index, see [llms.txt](https://help.aikido.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.aikido.dev/pentests/configure-a-pentest/testing-ai-capabilities.md).

# Testing AI Capabilities

Set up Aikido Pentest to test AI agents and LLM features.

Pick **AI Capabilities Only** when you want a focused assessment of copilots, chat, RAG, tools, memory, or other LLM features. Aikido maps those runtime surfaces and tests them as the primary objective of the run.

{% hint style="warning" %}
Run the pentest on a staging or test environment. Agents interact with your AI features and may create, modify, or delete data through tools, memory, or downstream systems.
{% endhint %}

## When to use what

| Wizard option             | Use it when                                                                                                                               |
| ------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- |
| **Web Application**       | You want a full application pentest. AI features are still in scope, but they are not the priority.                                       |
| **AI Capabilities Only**  | You want the run focused on AI agents and LLM features: chat, copilots, RAG, tools, memory, and similar surfaces.                         |
| **MCP endpoint in scope** | The target is a remote Model Context Protocol server. Follow [Testing MCP Servers](/pentests/configure-a-pentest/testing-mcp-servers.md). |

The report stays focused on AI and LLM risks. If agents confirm a web or API issue while testing those features, they still include it.

## What gets tested

Aikido discovers how your AI features actually work, then tests the security-relevant paths behind them. Typical focus areas:

* **Prompt injection and jailbreaks:** whether untrusted input, uploaded files, retrieved documents, or tool output can override instructions or bypass guardrails
* **Data leakage:** whether the agent can expose system prompts, hidden instructions, credentials, PII, or cross-tenant data
* **Tool and agency abuse:** whether the agent can take high-impact actions, call tools with malicious parameters, or reach downstream systems it should not
* **Memory and RAG:** whether persistent memory, session state, or indexed knowledge can be poisoned to steer later runs or leak data
* **Authorization on AI actions:** whether unauthenticated or low-privilege users can reach AI endpoints, tools, or actions reserved for another role or tenant
* **Unbounded consumption:** whether prompts, loops, or tool chains can trigger runaway cost, latency, or token usage

For the full list, see the [checks page](https://app.aikido.dev/ai-pentests/checks) and [OWASP Top 10 for Agentic Applications](/pentests/coverage-and-findings/what-issues-can-aikido-pentest-find/owasp-top-10-for-agentic-applications.md).

## What you need

* **Manage Pentests** [permission](/getting-started/automated-user-management/setting-roles-and-permissions.md)
* **Sufficient credits** in your [wallet](/miscellaneous-info/wallet-and-credits.md)
* A **staging URL** for the application that hosts the AI features
* Ownership of the domain so it can be [verified](/pentests/configure-a-pentest/domain-verification.md), or the [Aikido Broker](/miscellaneous-info/aikido-broker-for-internal-applications.md) if the app is only reachable on an internal network
* Aikido's [pentest IP addresses](/pentests/prepare-a-pentest/ip-addresses-for-pentest.md) added to your firewall, WAF, or API gateway allowlist
* **Test users** that can actually use the AI features you want tested
* All **repositories** in scope (strongly recommended for whitebox discovery)

## Set up the pentest

{% stepper %}
{% step %}

### Select AI Capabilities Only

Go to **Pentests**, open your **Project**, and click **Create Assessment**. On the **Select Pentest Target** step, select **AI Capabilities Only**.
{% endstep %}

{% step %}

### Define your scope

On the **Scope** step, enter the application's URL. Use a staging or QA environment.

Choose **Test entire application** if the AI features are part of the main app, or **Test specific parts only** if you want agents to focus on AI-specific paths (for example, `/chat`, `/copilot`, or an internal assistant).

Complete [domain verification](/pentests/configure-a-pentest/domain-verification.md) for every in-scope host. If the app is only reachable on an internal network, add it as a broker resource and select that broker URL in scope.
{% endstep %}

{% step %}

### Add test users that can use the AI features

On the **Test Users** step, add credential sets for each role you want validated, such as a standard user, an admin, or a user from another tenant. See [Setting Up Test Users](/pentests/configure-a-pentest/setting-up-authenticated-testing.md).
{% endstep %}

{% step %}

### Add code and context

On the **Code & Documentation** step, link all repositories in scope (frontend, backend, workers, and any service that implements or calls the AI features). Whitebox is strongly recommended: Aikido reads the source to map chat entrypoints, prompts, tools, memory, retrieval, and the controls around them.

If you cannot link a repository, use **Additional context** to describe:

* Which AI features exist and how users reach them
* Which tools, plugins, or downstream systems the agent can call
* Which roles should be allowed to use each capability
* Where memory, conversation history, or knowledge bases are stored

See [Leveraging Code and Documentation](/pentests/configure-a-pentest/leveraging-code-and-documentation.md).
{% endstep %}

{% step %}

### Review safety, pricing, and launch

Finish the remaining **Safety Check**, **Pricing**, and **Summary** steps, then start the run.
{% endstep %}
{% endstepper %}

## Tips

* **Use a dedicated test instance** with non-production data. Mock or disable destructive tools (delete, deploy, send email, charge a card) where you can.
* **Give agents a path to the AI feature.** If the copilot is behind a feature flag, extra onboarding, or a specific workspace, say so in the test-user instructions or additional context.
* **Describe tools and knowledge sources** when you cannot attach code: which actions the agent can take, which data it can retrieve, and which tenants or roles should be isolated.
* **Issue dedicated test identities** with the permissions you want validated, and rotate them after the assessment.

## Need help?

If agents cannot reach your AI features or authentication fails, open the **Intercom chat** in the bottom right corner. Our team is here to help!


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://help.aikido.dev/pentests/configure-a-pentest/testing-ai-capabilities.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.