What should be included in an AI pentesting checklist?

An AI pentesting checklist should cover pre-engagement planning, reconnaissance of LLM endpoints and MCP servers, prompt injection testing (direct and indirect), model extraction attempts, data poisoning verification, output handling review, API security assessment, and reporting guidelines.

How do you test prompt injection vulnerabilities?

Testing prompt injection involves crafting inputs that attempt to override system prompts, bypass content filters, or extract sensitive instructions. Testers use techniques like delimiter injection, role-playing scenarios, encoding bypasses, multi-language attacks, and indirect injection through documents or web content the LLM processes.

What are the key checks for MCP server security?

Key MCP server security checks include verifying authentication mechanisms, testing tool parameter validation, checking for resource exhaustion vulnerabilities, auditing MCP resource permissions, testing for prompt injection through tool outputs, and validating the MCP server's rate limiting and access controls.

What should an LLM pentesting checklist include?

An LLM pentesting checklist should include mapping the application's attack surface (endpoints, tools, data sources), direct and indirect prompt injection tests, system prompt extraction attempts, output sanitization verification, excessive agency checks, training data extraction probes, model denial of service tests, API authentication/authorization review, and logging/leakage inspection.

How should you document AI security assessment findings?

AI security findings should be documented with: a clear description of the vulnerability, affected AI components (LLM model, MCP tool, API endpoint), proof of concept showing impact, severity rating using CVSS adapted for AI systems, and actionable remediation steps prioritized by risk.

AI Pentesting Checklist 2026: 50+ Test Cases for LLMs, MCP & RAG

Pre Engagement

3 itens

Autorização assinada
Regras de tratamento de dados estabelecidas
Escopo definido

Conclua antes do início de qualquer teste

Testing

3 itens

Respeite os limites de taxa
Registre evidências seguras
Evitar dados de produção

Aplicar durante as fases de teste ativo

Reporting

3 itens

Descobertas de documentos claramente
Fornece etapas de correção
Incluir classificações de risco

Prompt Injection

10 itens

Test direct injection with common patterns (ignore, forget, DAN)
Teste a injeção indireta por meio de upload de documentos
Teste o pipeline RAG para documentos envenenados
Verify encoding bypass attempts (Base64, Unicode, ROT13)
Teste a manipulação de conversas multivoltas
Verifique se há vazamento de prompt do sistema
Test tool/function calling with malicious parameters
Verifique se a filtragem de saída está funcionando
Limite de taxa de teste e prevenção de abuso
Revisar registros para tentativas de injeção

Mcp Security

10 itens

Verify MCP server authentication is enabled
Test for path traversal in filesystem tools
Check for SSRF vulnerabilities in HTTP tools
Verify tool parameter validation
Test authentication bypass scenarios
Check for command injection in shell tools
Verify SQL injection protection in database tools
Review API key handling and storage
Test cross-tenant isolation (if multi-tenant)
Check for supply chain vulnerabilities in MCP packages

LLM Pentesting

10 itens

Map the LLM attack surface: endpoints, tools, plugins, and data sources
Test direct prompt injection with role-play and jailbreak patterns (DAN, ignore)
Test indirect prompt injection via uploaded documents, web content, and tool outputs
Attempt system prompt extraction and instruction leakage
Verify output sanitization (HTML/markdown injection, tool-call payload tampering)
Test for excessive agency: confirm tool permissions match the task
Probe for training data extraction (memorized PII, secrets, verbatim text)
Test model denial of service (token flooding, recursive loops, resource exhaustion)
Validate authentication, authorization, and rate limiting on LLM APIs
Check logging for sensitive data leakage (prompts, credentials, internal context)

Agentic Ai

10 itens

Test goal hijacking via indirect prompt injection
Verify tool use authorization and audit logging
Check identity and privilege management
Test for supply chain vulnerabilities in tools
Verify sandboxing for code execution
Test memory/context poisoning attacks
Check inter-agent communication security
Verify cascading failure handling
Test human-agent trust boundaries
Check for rogue agent persistence

Lista de verificação de segurança de IA

Orientação da lista de verificação

Pre Engagement

Testing

Reporting

Prompt Injection

Mcp Security

LLM Pentesting

Agentic Ai

Progresso da lista de verificação

Custom Checklist Builder

Dicas da lista de verificação

Lista de verificação de segurança de IA

Orientação da lista de verificação

Pre Engagement

Testing

Reporting

Prompt Injection

Mcp Security

LLM Pentesting

Agentic Ai

Progresso da lista de verificação

Custom Checklist Builder

Dicas da lista de verificação

Stay Ahead of AI Security