AI red teaming and LLM penetration testing

What an AI red-team assessment covers

An assessment tests the whole AI feature, not just the model. The serious failures usually happen where the model meets your system: the system prompt, the retrieval layer, the tools it can call and the data it can see. I agree the scope with you in writing, then test against a threat model built for your product and your users.

Where you already have guardrails or moderation in place, I test whether they hold, not just whether they exist.

• Direct and indirect prompt injection, including instructions hidden in documents, emails, web pages and retrieved content
• Jailbreaks and policy bypasses, in single and multi-turn conversations
• Data leakage: system prompts, secrets, personal data and other users’ records surfacing in responses
• Unsafe tool use and excessive permissions in agents and function calling
• Model output that reaches HTML, SQL, shell commands or downstream APIs without checks
• Abuse that drives runaway token use, loops or denial of service

Prompt injection and jailbreak testing

Prompt injection is the failure I test for first, because almost every LLM application is exposed to it. Direct injection comes from a user typing instructions into the chat. Indirect injection is harder to spot: the instructions arrive inside content the model reads, such as a support ticket, an uploaded PDF, a web page or a record pulled in by RAG, and the model treats them as commands.

I test both, using attacks written for your product rather than only a generic list. Jailbreak testing runs over multiple turns, because a model that refuses a harmful request in one message will often comply after a few turns of role-play, reframing or gradual escalation. Every successful attack is logged with the exact inputs, the response and the conditions needed to reproduce it, so your engineers can confirm it and test the fix.

AI agent and tool-use security testing

Agents raise the stakes. When a model can send emails, query databases, call internal APIs or run code, a successful injection is no longer just a bad reply: it becomes an action taken with your credentials.

I review agent trajectories step by step: what the agent was asked, what it decided, which tools it called with which arguments, and whether each step stayed within what that user was allowed to do. It is the same trajectory review I carry out on autonomous coding agents in evaluation work.

• Tools and permissions broader than the task needs
• Actions taken without a human confirmation step where one is needed
• Cross-user or cross-tenant access through shared tools, memory or retrieval
• Agents that report success when the task did not succeed
• Loops and chained calls that run up cost or hit rate limits

Mapping findings to the OWASP Top 10 for LLM Applications

The OWASP Top 10 for LLM Applications gives security teams, auditors and enterprise buyers a shared vocabulary for LLM risk, and many now ask for it by name. I map every finding to the relevant OWASP category, such as prompt injection, sensitive information disclosure or excessive agency, and give it a severity score based on likelihood and impact in your context.

That gives your security team a familiar structure, makes the report easy to use in customer security questionnaires and in a SOC 2 or ISO 27001 risk register, and shows clearly which categories were tested and which were out of scope. The framework is a floor, not a ceiling: findings that don’t fit a category neatly are still reported.

Why frontier-lab evaluation experience matters

Alongside consulting, I’ve done evaluation, red-teaming and training work on frontier LLMs and autonomous coding agents through Mercor, Turing, Uber AI Solutions, DataAnnotation, Mindrift, AfterQuery and Terac. It includes adversarial quality control, trajectory review and multi-turn reasoning audits, plus auditing synthetic repositories, test suites and Docker runtimes to catch reward hacking, answer leakage and false-positive verifications.

In practice, that means I know how models fail when someone is trying to make them fail, and how an evaluation can mislead. An agent that passes because the test was weak is something I look for by default. Because I design LLM evaluation and benchmarking frameworks too, I can leave you with an automated test suite that catches regressions, not just a one-off report.

The security grounding comes from an MSc in Cyber Security and Forensic Information Technology at the University of Portsmouth. I’m also a Databricks Certified Generative AI Engineer and was named Cybersecurity Engineer of the Year 2026 in the Corporate LiveWire Innovation & Excellence Awards.