The request crosses several trust boundaries
The prompt box is one entry point. An assistant may also read documents, emails, tool descriptions, and another agent’s output. Content that was meant to supply facts can be interpreted as instructions, and the effect may only become visible when the assistant takes an action.
A convincing response is not evidence that the permissions held. Review what the system read, which identity made each call, what parameters reached the tool, and where the result went.
Five places to follow the request
- Prompt
- Test direct hostile input and attempts to extract hidden instructions or internal context. Observe behavior across multiple turns as well as one request.
- Retrieval
- Test whether planted content can redirect behavior and whether searches cross a user’s data boundary. An instruction can enter at ingestion and remain dormant until a later query retrieves it.
- Reasoning
- Check whether the system’s objective can be redirected and whether persistent memory carries that redirection into later work. In multi-agent systems, examine the trust placed in another agent’s output.
- Tool call
- Examine the identity, allowed actions, and arguments at the moment reading becomes doing. Test whether the user’s permissions still constrain a shared agent or connector identity.
- Response
- Check who sees the result and how downstream software handles it. Generated text entering a rendered interface, query, or script needs controls appropriate to that destination.
Use the published risk lists as a reference
OWASP publishes separate risk lists for LLM and agentic applications. We use them to classify applicable findings, with the edition recorded in the report. A framework identifier makes a finding easier to compare; the evidence and reproduction steps are what make it actionable.
For reference, the 2025 LLM list uses the following identifiers. These are risk categories, not a fixed test plan for every deployment.
- LLM01 · Prompt injection
- Instructions that redirect behavior.
- LLM02 · Sensitive information disclosure
- Restricted information reaching an unintended audience.
- LLM03 · Supply chain
- Dependencies and components introduced into the system.
- LLM04 · Data and model poisoning
- Untrusted changes to training or retrieval inputs.
- LLM05 · Improper output handling
- Generated output used without appropriate validation.
- LLM06 · Excessive agency
- More permissions or autonomy than the task requires.
- LLM07 · System prompt leakage
- Internal instructions exposed through model responses.
- LLM08 · Vector and embedding weaknesses
- Weaknesses in retrieval and embedding-based access.
- LLM09 · Misinformation
- Incorrect answers used as reliable information.
- LLM10 · Unbounded consumption
- Resource use without effective limits.
An agent adds actions, identity, and persistence
The agentic review also examines goal redirection, tool misuse, identity and privilege abuse, the tool and agent supply chain, and persistent memory. A narrow tool can still become dangerous when it is chained with another tool or called under a broader identity.
Private data, untrusted input, and an external communication path deserve attention together. Trace whether content from an untrusted source can cause the agent to transmit information it was entitled to read but not entitled to disclose.
A repeatable test suite needs judgment
Our testing can combine broad probes, multi-turn scenarios, and custom checks tied to the deployment. Garak, PyRIT, Promptfoo, and Giskard are part of the tooling discussed in our assessment approach. They do not all answer the same question, and a passing run is not a guarantee that a system is safe.
We confirm candidate failures against the actual architecture, record the configuration and account used, and distinguish observed failures from untested paths. Repeatable cases then give your engineers a way to check future changes.
