Testing AI Capabilities

Set up Aikido Pentest to test AI agents and LLM features.

Pick AI Capabilities Only when you want a focused assessment of copilots, chat, RAG, tools, memory, or other LLM features. Aikido maps those runtime surfaces and tests them as the primary objective of the run.

Run the pentest on a staging or test environment. Agents interact with your AI features and may create, modify, or delete data through tools, memory, or downstream systems.

When to use what

Wizard option	Use it when
Web Application	A full pentest of websites, frontends, APIs, and MCP servers. AI features in the application stay in scope. For a standalone MCP server, follow Testing MCP Servers.
AI Capabilities Only	The run should focus on AI agents and LLM features: chat, copilots, RAG, tools, memory, and similar surfaces.

The report stays focused on AI and LLM risks. If agents confirm a web or API issue while testing those features, they still include it.

What gets tested

Aikido discovers how your AI features actually work, then tests the security-relevant paths behind them. Typical focus areas:

• Prompt injection and jailbreaks: whether untrusted input, uploaded files, retrieved documents, or tool output can override instructions or bypass guardrails

• Data leakage: whether the agent can expose system prompts, hidden instructions, credentials, PII, or cross-tenant data

• Tool and agency abuse: whether the agent can take high-impact actions, call tools with malicious parameters, or reach downstream systems it should not

• Memory and RAG: whether persistent memory, session state, or indexed knowledge can be poisoned to steer later runs or leak data

• Authorization on AI actions: whether unauthenticated or low-privilege users can reach AI endpoints, tools, or actions reserved for another role or tenant

• Unbounded consumption: whether prompts, loops, or tool chains can trigger runaway cost, latency, or token usage

For the full list, see the checks page and OWASP Top 10 for Agentic Applications.

What you need

• Manage Pentests permission

• Sufficient credits in your wallet

• A staging URL for the application that hosts the AI features

• Ownership of the domain so it can be verified, or the Aikido Broker if the app is only reachable on an internal network

• Aikido's pentest IP addresses added to your firewall, WAF, or API gateway allowlist

• Test users that can actually use the AI features you want tested

• All repositories in scope (strongly recommended for whitebox discovery)

Set up the pentest

1

Select AI Capabilities Only

Go to Pentests, open your Project, and click Create Assessment. On the Select Pentest Target step, select AI Capabilities Only.

2

Define your scope

On the Scope step, enter the application's URL. Use a staging or QA environment.

Choose Test entire application if the AI features are part of the main app, or Test specific parts only if you want agents to focus on AI-specific paths (for example, /chat, /copilot, or an internal assistant).

Complete domain verification for every in-scope host. If the app is only reachable on an internal network, add it as a broker resource and select that broker URL in scope.

3

Add test users that can use the AI features

On the Test Users step, add credential sets for each role you want validated, such as a standard user, an admin, or a user from another tenant. See Setting Up Test Users.

4

Add code and context

On the Code & Documentation step, link all repositories in scope (frontend, backend, workers, and any service that implements or calls the AI features). Whitebox is strongly recommended: Aikido reads the source to map chat entrypoints, prompts, tools, memory, retrieval, and the controls around them.

If you cannot link a repository, use Additional context to describe:

• Which AI features exist and how users reach them

• Which tools, plugins, or downstream systems the agent can call

• Which roles should be allowed to use each capability

• Where memory, conversation history, or knowledge bases are stored

See Leveraging Code and Documentation.

5

Review safety, pricing, and launch

Finish the remaining Safety Check, Pricing, and Summary steps, then start the run.

Tips

• Use a dedicated test instance with non-production data. Mock or disable destructive tools (delete, deploy, send email, charge a card) where you can.

• Give agents a path to the AI feature. If the copilot is behind a feature flag, extra onboarding, or a specific workspace, say so in the test-user instructions or additional context.

• Describe tools and knowledge sources when you cannot attach code: which actions the agent can take, which data it can retrieve, and which tenants or roles should be isolated.

• Issue dedicated test identities with the permissions you want validated, and rotate them after the assessment.

Need help?

If agents cannot reach your AI features or authentication fails, open the Intercom chat in the bottom right corner. Our team is here to help!