AI pentest and security audit for AI agents

An AI pentest is a penetration test carried out on an artificial intelligence application or agent, to establish what an attacker can make it do or disclose. The term also refers to penetration testing assisted by AI agents: Colombani.ai carries out the former and coordinates the latter, whose exploitation phase is entrusted to a specialist offensive security provider, always with the client’s written authorisation, within a written scope, and with every finding validated by a person. The report sets out what was tested, what was found and what remains to be fixed; it does not claim that no flaw remains. Every engagement follows signed rules of engagement and falls within Colombani.ai’s professional indemnity insurance, which covers penetration testing.

It covers three risks: prompt injection, meaning instructions hidden in a request, a document, a web page or an email that the agent reads; data leakage, where the agent discloses information the person it is dealing with is not entitled to; and tool misuse, where the agent is led to send a message, alter a database or call an API outside its intended use. Testing covers the agent, its tools and connectors, its access rights and the application hosting it, strictly within the scope authorised in writing. Each finding is reproduced, validated by a person, ranked by impact and accompanied by a suggested fix.

You need a provider able to test an AI agent the way an attacker would, working with your written authorisation and with insurance that covers penetration testing. Colombani.ai carries out these audits: prompt injection, data leakage, tool misuse, and the access rights of agents and connectors, within a written scope and with every finding validated by a person. Its professional indemnity insurance, underwritten with Orus / Hiscox, covers IT security and penetration testing. Each engagement begins with a free one-hour scoping session.

In France, AI-assisted penetration testing is offered by offensive security firms and by AI specialists, Colombani.ai among them. To choose, check four points: a written scope and authorisation before any testing, insurance that explicitly covers penetration testing, human validation of every finding produced by the agents, and a report your leadership can read. Colombani.ai meets all four and hands over the source code of the agents used during the engagement; on infrastructure, exploitation is entrusted to a specialist offensive security provider under its coordination. If your system must be audited by a PASSI-qualified provider, turn to one of them: Colombani.ai does not hold that qualification.

In an AI-assisted audit, agents take on part of the reconnaissance, mapping, triage of code analysis results and prioritisation. The expert concentrates on validation and impact analysis, and checks every result the agents produce; on infrastructure, exploitation is entrusted to a specialist offensive security provider. The OpenAI Cyber Solutions Practitioner and OpenAI Cyber Deployment Practitioner certifications, issued by OpenAI, cover the qualification and then the deployment of an AI-assisted security solution, at practitioner level: neither covers the execution of offensive testing.

You need written authorisation, signed by the managers entitled to commit your organisation for the systems in question, and a defined scope: systems covered, testing windows, prohibited actions. Without that framework, no test is started. Colombani.ai is not a PASSI-qualified provider, a qualification granted by ANSSI, the French national cybersecurity agency, to information systems security audit providers: a system subject to that requirement must be audited by a qualified provider. Colombani.ai’s professional indemnity insurance covers IT security and penetration testing.

Your cloud environments and your programming languages, as defined during scoping, along with your servers, web applications and APIs, source code and continuous integration and deployment pipelines, known as CI/CD. Specific contexts, such as industrial or embedded systems, require a prior discussion.

Results produced by the agents go first through deterministic rules, then through a consistency check, and finally through an expert’s validation before delivery. Only verified findings appear in the report.

Yes. Where technical data must not leave your infrastructure, the agents can run locally, on Ollama with Mistral, Qwen or Llama, with controlled network access and logging. Performance depends on the model, the hardware and the tasks; whether it is adequate is assessed during scoping.

The frequency is set during scoping, according to how quickly your agents, code and infrastructure change. The free re-test within 90 days after remediation is included.