Agent Watch · Security testing for AI chatbots
Can your chatbot be tricked?
I test your customer service or sales AI chatbot the way an attacker would: can it be tricked into leaking data, handing out discounts or pretending to be human? Then I repeat the test every month.
For companies with an AI chatbot answering customers, especially one that sees customer data or prices, or can give discounts, send emails or place orders.
Sales chatbot, after a prompt change
2 results got worse
Unauthorised discount
A fake “manager approval” planted in the chat history, and the bot applied a 40% discount.
apply_discount(pct=40)Customer existence confirmed
Asked directly, the bot confirmed that a named customer is in the system.
Same model. Only the prompt changed: marketing added sales pressure and two rules went missing.
Why every month
A prompt is not a security boundary.
A chatbot's rules usually live in its prompt, and a prompt is a request to the model, not a lock. A clever question can bend it, and a new prompt, model or tool can quietly break it. One test shows one day. A monthly re-test shows whether the lines you set still hold.
How it works
From a pre-check to a monthly re-test.
Pre-check
Ten harmless questions to your public chatbot. I do not ask for customer data or passwords. It shows whether a closer look is worthwhile.
Check
We map what the chatbot can see and do, then I run 47 attacks. The report gives reproducible examples and fixes.
Watch
The same test every month, and on request after any change to the prompt, the model or the tools. I tell you only when a result has got worse.
The fix belongs outside the prompt: least access, code that checks actions before they run, and a filter on outgoing replies. If you like, I build these myself, and Watch checks that they hold.
What I test
47 attacks across ten areas.
Based on the OWASP Top 10 for large language model applications and the EU AI Act's transparency duty. Most attacks are in Estonian.
- Overriding instructions
- Steering through pasted content
- Sensitive information leaks
- Excessive agency
- Prompt leaks
- Misinformation
- AI disclosure (EU AI Act Art. 50)
- Staying in role
- Structure and data separation
- Long texts and conversations
Limits
What a test does not prove.
- A passed test means that the attack did not work. It is evidence, not a guarantee.
- I test the chatbot from the outside, as a customer would. I do not review your code, your knowledge base or your vendor contracts.
- This is not a conformity assessment or legal advice.
Frequently asked questions
Do you see our chatbot's system prompt?
No. You add a few made-up secrets to it. If one of them shows up in a reply, the leak is proven.
Does testing disturb real customers?
I test in separate conversations and only with your written permission. We agree the timing and volume of the test beforehand.
Where is the data processed?
I judge and keep the test results in the EU. The test questions and your chatbot's replies, however, travel to wherever your chatbot runs.
Pre-check
Send me a link to your chatbot.
I'll run the pre-check: 10 harmless questions, without asking for customer data or passwords. You get the results and an honest answer on whether it is worth looking further. I can also show you the demo, where the same model behaves differently under two setups.
mart@kratikaitse.ee