Skip to content
Book a call

Service · Agent security

AI agent security and red teaming

An agent that reads untrusted content and holds real permissions can be talked into misusing them. We test what your agents can be made to do, then fix the harness around them.

Comonad red-teams AI agents for prompt injection, sensitive data disclosure and excessive tool permissions, and fixes the findings in the agent's harness: permissions, data boundaries, egress, approvals and logging.

Prompt injection cannot be reliably prevented by the model alone, so the defence is containment: what the agent may touch, where its output may go, and who must approve an irreversible action. Our framework for governing AI agents treats this as runtime security, which depends on getting identity, authority and policy right first.

We test the whole agent, including its tools and permissions, as well as what the model says. Testing is authorised in writing and run under an agreed scope and rules of engagement. Fixes go into the harness through your release process, with the tests kept so they run again on every change.

Tell us which agents you run, what they can read, and what they can change.

Discuss agent security
  • CISOs and security leads
  • Platform leads
  • Risk and audit
On this page

Why agents need their own testing

When a chatbot gives a wrong answer, the damage is usually limited to what it said. An agent connected to a mailbox, a ticketing system and a database can be instructed to act, and then the same mistake becomes a security incident. The risk sits in the combination of untrusted input, access to private data and the ability to act.

A conventional penetration test is not usually scoped to cover this, because the attack arrives as ordinary text: an email, a web page, a document in a shared drive, a field in a support ticket.

What we test

Test cases are drawn from the OWASP Top 10 for LLM Applications and from your own threat model, then run against the agent in a test environment that mirrors its real permissions.

  • Prompt injection, direct and through content the agent reads.
  • Sensitive information disclosure: whether data leaves the boundary it should stay inside.
  • Excessive agency: tools, scopes and credentials wider than the task needs.
  • Missing approvals for irreversible actions, and whether the stop works.
  • Gaps in logging that would leave an incident unexplained.

What an engagement covers

  • Threat model

    Each agent's inputs, data, tools and credentials, and what a misuse would cost. Output: a written threat model your security team can maintain.

  • Red-team testing

    Scripted and exploratory attacks against the agent with its real tool permissions, in a non-production environment. Output: findings with reproduction steps and severity.

  • Fixes in the harness

    Narrower permissions, data boundaries, egress limits, approvals and logging, delivered through your release process, either by us or by your engineers from our findings.

  • Regression suite

    The attacks kept as tests that run on every change to the agent, its prompts or its tools, so a fixed finding stays fixed.

What you keep

  • Threat model

    Inputs, data, tools and credentials for each agent.

  • Findings report

    What we could make the agent do, how, and how serious it is.

  • Regression tests

    The attacks, kept as tests in your pipeline.

How an engagement runs

Frameworks we test against

OWASP Top 10 for LLM Applications

A community list of the main risks in LLM applications, including prompt injection, sensitive information disclosure and excessive agency.

NCSC guidelines for secure AI system development

Published by the NCSC and the US CISA with international partner agencies, covering secure design, development, deployment, and operation and maintenance.

DSIT Code of Practice for the Cyber Security of AI

DSIT's voluntary code setting baseline security principles across the AI lifecycle.

What we do not do

  • We do not give legal advice. Legal sign-off stays with your counsel.
  • We do not resell a model, an agent platform or a coding assistant, and we take no referral fees.
  • We do not test production systems without written authorisation and agreed rules of engagement.
  • We do not replace a general penetration test of your wider estate.

Who it is for

  • Security leads whose organisation has agents in production or about to go live.
  • Platform teams that want findings they can fix, with tests to prove it.
  • Risk and audit teams that need evidence the agent's controls were tested.
Alex Vakhitov, founder of Comonad Limited

Alex Vakhitov

Founder, Comonad · AI and software architect, London

Alex Vakhitov founded Comonad in 2024. An AI and software architect, he was co-founder and CTO of Cloud KB, UK energy-market software, from August 2015 to March 2022.

Read Alex Vakhitov's profile

Questions about agent security

Can prompt injection be fixed in the model?

Not reliably. Model-level defences reduce it but do not remove it. The dependable controls sit outside the model: narrow permissions, data boundaries, egress limits and human approval for irreversible actions.

Do you test in production?

We prefer an environment that mirrors production permissions. Anything in production needs written authorisation and agreed rules of engagement first.

How does this relate to your harness work?

Testing finds what the agent can be made to do. The agent harness is where the fixes live. You can take either on its own.

Sources

Related

Discuss agent security

Tell us which agents you run, what they can read, and what they can change.

Discuss agent security