What should be included in an AI pentesting checklist?

An AI pentesting checklist should cover pre-engagement planning, reconnaissance of LLM endpoints and MCP servers, prompt injection testing (direct and indirect), model extraction attempts, data poisoning verification, output handling review, API security assessment, and reporting guidelines.

How do you test prompt injection vulnerabilities?

Testing prompt injection involves crafting inputs that attempt to override system prompts, bypass content filters, or extract sensitive instructions. Testers use techniques like delimiter injection, role-playing scenarios, encoding bypasses, multi-language attacks, and indirect injection through documents or web content the LLM processes.

What are the key checks for MCP server security?

Key MCP server security checks include verifying authentication mechanisms, testing tool parameter validation, checking for resource exhaustion vulnerabilities, auditing MCP resource permissions, testing for prompt injection through tool outputs, and validating the MCP server's rate limiting and access controls.

What should an LLM pentesting checklist include?

An LLM pentesting checklist should include mapping the application's attack surface (endpoints, tools, data sources), direct and indirect prompt injection tests, system prompt extraction attempts, output sanitization verification, excessive agency checks, training data extraction probes, model denial of service tests, API authentication/authorization review, and logging/leakage inspection.

How should you document AI security assessment findings?

AI security findings should be documented with: a clear description of the vulnerability, affected AI components (LLM model, MCP tool, API endpoint), proof of concept showing impact, severity rating using CVSS adapted for AI systems, and actionable remediation steps prioritized by risk.

AI Pentesting Checklist 2026: 50+ Test Cases for LLMs, MCP & RAG

Pre Engagement

3 Systeme

Vollmacht unterzeichnet
Ata-Handhabungsregeln festgelegt
bewältigen definiert

abgeschlossen sein, bevor mit den Tests begonnen wird

Testing

3 Systeme

Achten Sie auf Tarifbegrenzungen
aufzeichnungssichere Beweise
Produktionsdaten ungültig machen

Anwendung während aktiver Testphasen

Reporting

3 Systeme

Befunde eindeutig dokumentieren
Bereitstellung von Abhilfemaßnahmen
Fügen Sie Risikobewertungen hinzu

Prompt Injection

10 Systeme

Test direct injection with common patterns (ignore, forget, DAN)
Es handelt sich um eine indirekte Einspeisung per Dokumenten-Upload
est RAG-Pipeline für vergiftete Dokumente
Verify encoding bypass attempts (Base64, Unicode, ROT13)
ist die Manipulation von Gesprächen mit mehreren Runden
Überprüfen Sie, ob das System schnell undicht ist
Test tool/function calling with malicious parameters
Überprüfen Sie, ob die Ausgabefilterung funktioniert
Höchstgeschwindigkeitsbegrenzung und Missbrauchsprävention
Überprüfen Sie die Protokolle auf Injektionsversuche

Mcp Security

10 Systeme

Verify MCP server authentication is enabled
Test for path traversal in filesystem tools
Check for SSRF vulnerabilities in HTTP tools
Verify tool parameter validation
Test authentication bypass scenarios
Check for command injection in shell tools
Verify SQL injection protection in database tools
Review API key handling and storage
Test cross-tenant isolation (if multi-tenant)
Check for supply chain vulnerabilities in MCP packages

LLM Pentesting

10 Systeme

Map the LLM attack surface: endpoints, tools, plugins, and data sources
Test direct prompt injection with role-play and jailbreak patterns (DAN, ignore)
Test indirect prompt injection via uploaded documents, web content, and tool outputs
Attempt system prompt extraction and instruction leakage
Verify output sanitization (HTML/markdown injection, tool-call payload tampering)
Test for excessive agency: confirm tool permissions match the task
Probe for training data extraction (memorized PII, secrets, verbatim text)
Test model denial of service (token flooding, recursive loops, resource exhaustion)
Validate authentication, authorization, and rate limiting on LLM APIs
Check logging for sensitive data leakage (prompts, credentials, internal context)

Agentic Ai

10 Systeme

Test goal hijacking via indirect prompt injection
Verify tool use authorization and audit logging
Check identity and privilege management
Test for supply chain vulnerabilities in tools
Verify sandboxing for code execution
Test memory/context poisoning attacks
Check inter-agent communication security
Verify cascading failure handling
Test human-agent trust boundaries
Check for rogue agent persistence

I Sicherheitschecklisten

Anleitung zur Heckliste

Pre Engagement

Testing

Reporting

Prompt Injection

Mcp Security

LLM Pentesting

Agentic Ai

Hecklist-Fortschritt

Ustom Checklist Builder

Hecklist-Tipps

I Sicherheitschecklisten

Anleitung zur Heckliste

Pre Engagement

Testing

Reporting

Prompt Injection

Mcp Security

LLM Pentesting

Agentic Ai

Hecklist-Fortschritt

Ustom Checklist Builder

Hecklist-Tipps

Stay Ahead of AI Security