ai-threat-testing

# AI Threat Testing Test LLM applications for OWASP LLM Top 10 vulnerabilities using 10 specialized agents. Use for authorized AI security assessments. ## Quick Start ``` 1. Specify target (LLM app URL, API endpoint, or local model) 2. Select scope: Full OWASP Top 10 | Specific vulnerability | Supply chain 3. Agents deploy, test, capture evidence 4. Professional report with PoCs generated ``` ## Coverage — OWASP LLM Top 10, 2025 edition **Which file addresses which category is decided by [`reference/catalog/llm-top10-2025.json`](reference/catalog/llm-top10-2025.json), not by the filename.** The `llmNN-` prefixes on disk predate the 2025 renumbering and no longer match; the content is correct, the labels were not. Cite an id only with its edition (`LLM06:2025`), because a bare `LLM06` means two different categories depending on which edition the reader assumes. | Category | Attack surface | |---|---| | `LLM01:2025` Prompt Injection | Direct and indirect injection, instruction override, filter evasion | | `LLM02:2025` Sensitive Information Disclosure | Training-data and cross-tenant RAG leakage, canary verification | | `LLM03:2025` Supply Chain | Dependency CVEs, model provenance, malicious serialized models | | `LLM04:2025` Data and Model Poisoning | Backdoor triggers, membership inference, behavioural anomalies | | `LLM05:2025` Improper Output Handling | Code/XSS injection downstream, unsafe deserialization | | `LLM06:2025` Excessive Agency | Tool/plugin abuse, privilege escalation, unauthorised actions — the category that matters for **agents** rather than chatbots | | `LLM07:2025` System Prompt Leakage | **Gap — no playbook yet.** See the catalogue: what the prompt *contains* is a separate finding from whether it can be extracted | | `LLM08:2025` Vector and Embedding Weaknesses | RAG injection, retrieval manipulation, embedding inversion | | `LLM09:2025` Misinformation | Hallucination and confidence manipulation where output is relied upon | | `LLM10:2025` Unbounded Consumption | Token flooding, cost impact, and **model extraction/theft** (2025 treats extraction-by-query as a consumption problem) | Two classes are testable but are **not** OWASP categories, so they carry local `TX-` ids rather than an invented `LLMnn`: monitoring evasion / forensic gaps, and adversarial perturbation of non-text input. `tools/test_llm_numbering.py` enforces that separation. ## Workflows **Full Assessment** (4-8 hours): ``` - [ ] Reconnaissance - [ ] Deploy all 10 agents - [ ] Execute exploits - [ ] Capture evidence - [ ] Generate report ``` **Focused Testing** (1-3 hours): ``` - [ ] Select a category from the catalogue (LLM01:2025 .. LLM10:2025, or a TX- local class) - [ ] Deploy agent - [ ] Execute techniques - [ ] Document findings ``` **Supply Chain Audit** (2-4 hours): ``` - [ ] Inventory dependencies - [ ] Scan CVEs - [ ] Test plugins/APIs - [ ] Verify model provenance ``` ## Integration Enhances `/pentest` with AI-specific testing: - Traditional pentesting + AI threat testing = complete security assessment - Chain vulnerabilities across traditional and AI vectors - Unified reporting with CVSS scores ## Key Techniques **Prompt Injection**: Instruction override, system prompt extraction, filter evasion **Model Extraction**: Query sampling, token analysis, membership inference **Data Poisoning**: Behavioral anomalies, backdoor triggers, bias analysis **DoS**: Token flooding, recursive expansion, context exhaustion **Supply Chain**: CVE scanning, plugin audit, model verification **MCP Tool Abuse**: MCP server inspectors/debuggers often expose `/api/mcp/connect` or similar endpoints that accept `serverConfig` with arbitrary `command` parameters — unauthenticated RCE. Check for MCP Inspector, MCP Playground, or any MCP debugging UI on non-standard ports (6274, 3000, etc.). ## Evidence Capture All agents collect: screenshots, network logs, API responses, errors, console output, execution metrics. ## Reporting Automated reports include: executive summary, detailed findings (CVSS scores), PoC scripts, evidence, remediation guidance. ## Critical Rules - Written authorization REQUIRED before testing - Never exceed defined scope - Test in isolated environments when possible - Document all findings with reproducible PoCs - Follow responsible disclosure practices ## Integration - Integrates with `/pentest` skill for comprehensive security testing - AI-specific vulnerability knowledge in `/AGENTS.md` - Attack playbooks in `reference/llm0X-*.md`