Prompt injection testing
Prompt injection is the case where text the model reads is treated as an instruction instead of as data. The dangerous version is indirect: the instruction is not typed by your user, it is sitting in a web page, a document, a support ticket, a filename or a tool result that your agent fetches on its own.
Testing means supplying content through each of those paths and seeing whether the agent follows it. The finding that matters is never "the model said something odd" — it is "the model called this tool it should not have called, with these arguments, because of content it read here".
Reviewing what the agent is permitted to touch
Most agent incidents are permission incidents wearing a model costume. The model was convinced to do something, but the reason it could do it is that the token in its hand was broader than the job it was given.
The review maps every tool, MCP server and connected integration your agent can reach, and the real authority behind each one: which scopes the credential carries, which records it can read, what it can write, what it can delete, and whether a human sees the action before it lands.
- Every tool and MCP server the agent can call, enumerated rather than assumed
- The actual scope on each credential, compared with what the tool needs
- Which actions are irreversible, and whether any human approval gates them
- Where untrusted content enters the context window
- What an injected instruction could reach through the above
Open source behind this work
The tooling CyberArc uses in this area is public, so you can read it before you hire anyone. agent-shield is a prompt-injection detection toolkit and agent-permission-graph maps what AI agents and MCP servers can touch.
How client data is handled during an AI engagement
Testing an agent means handling whatever that agent handles. Client data is processed on local AI models by default, and cloud AI tools are used only with the client's written consent.
Health data is handled with Ontario's PHIPA obligations in mind, which matters because a support agent plugged into a clinic's records is exactly the kind of system this service exists to test.