[et_pb_section fb_built=”1″ _builder_version=”4.16″ global_colors_info=”{}” theme_builder_area=”post_content”][et_pb_row _builder_version=”4.16″ background_size=”initial” background_position=”top_left” background_repeat=”repeat” global_colors_info=”{}” theme_builder_area=”post_content”][et_pb_column type=”4_4″ _builder_version=”4.16″ custom_padding=”|||” global_colors_info=”{}” custom_padding__hover=”|||” theme_builder_area=”post_content”][et_pb_text _builder_version=”4.27.8″ background_size=”initial” background_position=”top_left” background_repeat=”repeat” hover_enabled=”0″ global_colors_info=”{}” theme_builder_area=”post_content” sticky_enabled=”0″]<\/p>\n
Whereasa functional audit<\/a>\u2014which we\u2019ve already covered in detail in our dedicated article\u2014is limited to interviews and a document review, an AI penetration test takes action: it actively exploits systems identified as priorities to demonstrate a real impact rather than merely assuming one. The methodology follows a six-step attack chain, modeled after the progression of a real adversary rather than a list of isolated checks. <\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n This step technically confirms or refutes the inventory reported during the functional audit. It scans the internal network for exposed self-hosted model servers, Ollama<\/strong>, vLLM<\/strong>, and LM Studio<\/strong> \u2014each of which has well-known signature ports\u2014fuzzes undocumented AI API endpoints, and technically confirms the presence of Shadow AI<\/a> by analyzing DNS logs and proxy traffic to known providers. A specific component searches for MCP configuration files on accessible systems, prior to the step dedicated to this protocol. <\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n In a developer role, the key test involves manipulating an AI agent configured in the development environment\u2014using instructions hidden in a code file, a comment, or a README\u2014to attempt to exfiltrate files outside the permitted scope or execute unintended commands, a scenario documented in detail in our article on prompt injection<\/strong>.<\/a><\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n From a compromised standard user account, the objective shifts: to retrieve tokens and keys already present on the machine, environment variables, the system credential manager, and currently running processes\u2014and then access the locally stored AI conversation history, which is often rich in sensitive information never intended to be extracted from its original context.<\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n This section, which directly builds on our article dedicated to the MCP, covers the authentication of discovered servers, checking for typosquatting in the names of installed MCP packages, and a test of poisoning tool descriptions exposed to the agent\u2014a malicious instruction hidden in a tool\u2019s metadata rather than in processed data.<\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n This step first verifies whether the review of AI-generated code is actually performed by a human by intentionally submitting code containing a subtle vulnerability and observing whether it is detected. It then searches for the \u201challucinated\u201d packages suggested by code assistants and checks whether they have been preempted by an attacker on public registries\u2014a risk detailed in our article on slopsquatting<\/a><\/strong>, as well as poisoning attempts via the project\u2019s AI context files\u2014CLAUDE.md and .cursorrules\u2014which share the same exploitation logic as the poisoning of MCP tool descriptions seen in the previous step. <\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n In the final step, it actively exploits what the reconnaissance phase uncovered: unauthenticated access to self-hosted models, prompt injection on internal chatbots with system prompt leakage testing, querying a RAG system beyond the document access rights normally granted to the tested user, and testing the circumvention of safeguards using classic jailbreak techniques, role-playing, alternative encoding, and language switching\u2014all of which have already been detailed in our article on LLM jailbreak<\/a><\/strong>. This stage also covers resilience against context saturation, which can push system instructions\u2014intended to govern the model\u2019s behavior\u2014outside the active context. <\/p>\n <\/p>\n <\/p>\n <\/p>\n [\/et_pb_text][et_pb_accordion _builder_version=”4.27.8″ _module_preset=”default” theme_builder_area=”post_content” hover_enabled=”0″ sticky_enabled=”0″][et_pb_accordion_item _builder_version=”4.27.8″ _module_preset=”default” theme_builder_area=”post_content” hover_enabled=”0″ sticky_enabled=”0″ title=”Does an AI-powered penetration test replace a traditional application penetration test?” open=”on”]No, the two are complementary. A hybrid system that combines traditional infrastructure with AI components generally requires both approaches to provide comprehensive coverage.[\/et_pb_accordion_item][et_pb_accordion_item _builder_version=”4.27.8″ _module_preset=”default” theme_builder_area=”post_content” hover_enabled=”0″ sticky_enabled=”0″ title=”Is it necessary to conduct the functional audit before the penetration test?” open=”off”]While not strictly required, it is strongly recommended: the audit allows you to prioritize which systems to test in depth, rather than spreading your efforts too thinly across a poorly defined scope.[\/et_pb_accordion_item][et_pb_accordion_item _builder_version=”4.27.8″ _module_preset=”default” theme_builder_area=”post_content” hover_enabled=”0″ sticky_enabled=”0″ title=”Is the MCP component relevant for all organizations?” open=”off”]This applies only to those who have deployed agents or co-pilots using this protocol. However, its rapid widespread adoption in 2025\u20132026 makes it an increasingly relevant component.[\/et_pb_accordion_item][\/et_pb_accordion][et_pb_text _builder_version=”4.27.8″ _module_preset=”default” theme_builder_area=”post_content” hover_enabled=”0″ sticky_enabled=”0″]<\/p>\n <\/p>\n <\/p>\n1. AI-Based Surface Recognition<\/strong><\/h2>\n
2. Initial Position: Developer<\/strong><\/h2>\n
3. Initial Access: Standard User Account<\/strong><\/h2>\n
4. Security of the MCP Agent Protocol<\/strong><\/h2>\n
5. Supply Chain for AI-Generated Code<\/strong><\/h2>\n
6. Operating the Internal AI Infrastructure<\/strong><\/h2>\n
Frequently Asked Questions<\/strong><\/h2>\n
Test the actual resilience of your AI systems<\/strong><\/h2>\n