Find out what your AI agent can be tricked into doing.
We attack the actions your agent can take: tool calls, MCP servers, permissions, refunds, payments and data access. You get a written report of what broke and how to reproduce it, within 72 hours of access.
Fixed price. Report within 72 hours of getting access.
1. Customer sends a support email containing hidden instructions 2. Agent reads the email and calls issue_refund(order_id, amount) 3. No check that the amount matches the original order Result: refund issued for more than the order total
What an Agent Action Pentest is
A traditional pentest looks at your web app and APIs. Agents add a new surface: a model that reads untrusted text and then decides which tools to call with which arguments. We test that surface directly.
Prompt injection
Instructions hidden in user messages, documents, emails, web pages or tool results that steer the agent.
Privilege escalation
Getting the agent to use tools, scopes or accounts beyond what the current user should be able to reach.
Data exfiltration
Leaking customer data, secrets or system prompts through tool calls, links, outputs or logs.
Unsafe actions
Refunds, payments, emails, deletes and record changes triggered without the checks a human would apply.
Scope checklist
We agree the exact scope with you at intake. A typical engagement covers:
- Every tool and function the agent can call, and the arguments it can control
- Connected MCP servers and the permissions they grant
- Direct and indirect prompt injection paths
- Actions that move money: refunds, credits, payments, discounts
- Actions that change or delete data
- Outbound channels: email, messages, webhooks, links
- Access boundaries between users, tenants and roles
- Confirmation steps and guardrails, and whether they can be bypassed
How it works
Four steps, fixed price, no sales calls required.
- Pay and fill in intakeCheckout through Stripe, then a short form about your agent and its tools.
- Give us accessA staging environment, test account or demo deployment. We confirm scope in writing.
- TestingWe attack the agent's actions within the agreed scope and document each finding as we go.
- Report within 72hDelivered within 72 hours of access, with findings ranked by severity.
What you get
- A written report of every finding
- A severity rating for each finding
- Step by step reproduction for each finding
Who it's for
Teams shipping agents
Your agent takes real actions for customers and you want it tested before or soon after launch.
MCP server builders
You expose tools to agents and want to know how they can be misused.
Teams facing a security review
A customer or partner is asking how your agent handles untrusted input.
FAQ
What access do you need?
Usually a staging environment or test account where the agent can run with realistic tools, plus a short description of what each tool does. Production access is not required.
Can we sign an NDA?
Yes. An NDA is available on request. Email yaz@plaw.io before or after paying.
What if we're not sure it's a fit?
Contact us before paying if you are unsure. We will tell you honestly whether the engagement makes sense for your setup.
How do you handle our data?
We only use the access you give us, within the agreed scope. Findings and any data we see are shared only with you. Tell us at intake if you have specific handling requirements.
Who does the work?
VulnZap is run by Plaw, Inc., the team behind Veto, runtime authorization for AI agents.