Agentic Frontier & Supply Chain Testing
Multi-agent systems, reusable agent skills, long-term memory, and downloadable model weights are the newest part of the AI attack surface, and the least tested. An agent tends to trust another agent's output, a skill's instructions, or a model's weights as if they were safe. We test those trust relationships before an attacker demonstrates them for you.
What We Test
AI-to-AI trust: Where one model's output becomes another model's input, we verify whether hidden instructions survive the trip. This failure has already moved real money in production systems.
Agent skills and plugins: We review the skill packages your agents load for malicious or misused instructions, including the techniques used to slip them past automated review.
Persistent memory: If your assistant keeps long-term memory, we test whether an attacker can plant an instruction there that re-fires in every future session.
Tool ecosystem integrity: We test manipulation of tool selection and trust: tools that change behavior after approval, tools designed to win the agent's preference, and forged tool results.
Supply chain (OWASP LLM03): We review how you load models and dependencies, because untrusted model weights and configs can execute code on load, even with safety flags enabled.
Behavioral drift: For self-improving agents, we assess whether small remembered nudges can bend behavior over time.
Why It Matters
Every one of these attacks has been demonstrated in the wild in the last two years, from cross-agent theft to backdoored repositories. The field is moving faster than the defenses, which is exactly why this testing exists.
Deliverables
Trust relationship map: Where your agents, skills, memory, and models trust things they should verify.
Findings report: Mapped to the OWASP Top 10 for LLM Applications and MITRE ATLAS.
Hardening plan: Approval flows, allowlists, and supply chain controls for agentic systems.
Put Your AI Features to the Test
Contact us today to scope an AI penetration test. We will walk you through the realistic attack paths against your deployment and where untrusted input meets something that matters in your application.