aisecurity.llc
AI SECURITY · PRIVACY · TRUST
SECURITY REVIEW ATTESTATION
Independent Assessment · Evidence-Based · Public-Safe
This attests that
ACME Corp
acmecorp.io
ACME Corp engaged aisecurity.llc to conduct a security review of the systems, processes, and public trust surfaces described below.
Service(s) performed
AI Red Team Assessment
Full adversarial engagement against AcmeAssist: prompt injection, jailbreaks, indirect attacks, and abuse scenarios.
Prompt Injection Testing
Direct and indirect injection attacks against system prompt, user context, and retrieved document content.
Agentic Pipeline Abuse
Tool-call manipulation, unauthorized action escalation, and out-of-scope action attempts via crafted inputs.
Data Exfiltration Probes
Attempts to surface training data, system instructions, customer records, or cross-tenant content via the model interface.
Scope
Results summary
Strong
AcmeAssist demonstrated resilient prompt handling and strong output guardrails across the majority of test scenarios. Two high-severity findings were identified — one involving indirect injection via crafted support documents and one involving partial system instruction leakage. Both were remediated prior to this attestation being issued.
Domains reviewed
AI Security
Prompt handling, output controls, and adversarial resilience.
Application Security
API surface, authentication, and injection vectors.
RAG & Data Access
Document injection, retrieval manipulation, and context poisoning.
Identity & Access
Privilege escalation paths and cross-account action attempts.
Data Security
Exfiltration paths and sensitive data surfacing via the model interface.
Monitoring & Detection
Coverage of adversarial patterns in telemetry and alerting.
Incident Response
Response playbook coverage for AI-specific abuse scenarios.