What should be included in an AI pentesting checklist?

An AI pentesting checklist should cover pre-engagement planning, reconnaissance of LLM endpoints and MCP servers, prompt injection testing (direct and indirect), model extraction attempts, data poisoning verification, output handling review, API security assessment, and reporting guidelines.

How do you test prompt injection vulnerabilities?

Testing prompt injection involves crafting inputs that attempt to override system prompts, bypass content filters, or extract sensitive instructions. Testers use techniques like delimiter injection, role-playing scenarios, encoding bypasses, multi-language attacks, and indirect injection through documents or web content the LLM processes.

What are the key checks for MCP server security?

Key MCP server security checks include verifying authentication mechanisms, testing tool parameter validation, checking for resource exhaustion vulnerabilities, auditing MCP resource permissions, testing for prompt injection through tool outputs, and validating the MCP server's rate limiting and access controls.

What should an LLM pentesting checklist include?

An LLM pentesting checklist should include mapping the application's attack surface (endpoints, tools, data sources), direct and indirect prompt injection tests, system prompt extraction attempts, output sanitization verification, excessive agency checks, training data extraction probes, model denial of service tests, API authentication/authorization review, and logging/leakage inspection.

How should you document AI security assessment findings?

AI security findings should be documented with: a clear description of the vulnerability, affected AI components (LLM model, MCP tool, API endpoint), proof of concept showing impact, severity rating using CVSS adapted for AI systems, and actionable remediation steps prioritized by risk.

AI Pentesting Checklist 2026: 50+ Test Cases for LLMs, MCP & RAG

AI-hackning

Omfattande katalog över AI-specifika sårbarheter och attackvektorer.

AI Hacking Team

The AI Hacking team researches and documents AI/LLM security vulnerabilities, red teaming techniques, and defensive strategies. Our guides are based on real-world pentesting experience and continuous monitoring of the AI security landscape.

GitHub LinkedIn

AI-säkerhetschecklistor

Guidning för checklista

Pre Engagement

Testing

Reporting

Prompt Injection

Mcp Security

LLM Pentesting

Agentic Ai

Checklista Framsteg

Custom Checklist Builder

Checklist Tips