We test LLM and agentic systems the way real attackers exploit them.
Prompt injection, tool and agent abuse, data exfiltration, and RAG and model manipulation, assessed against the OWASP LLM Top 10, MITRE ATLAS and NIST AI RMF, with findings you can reproduce and fix.
We publish verifiable research. Four credited CVEs:
- id
- TV-AI-013
- class
- Indirect prompt injection, OWASP LLM01
- vector
- Poisoned document retrieved by the RAG pipeline
- impact
- Agent exfiltrates session context to an external URL
- mapping
- MITRE ATLAS, LLM prompt injection
- status
- Reproduced, fix verified on retest
Example finding, illustrative, not a client engagement.
What AI security testing covers
Shipping an LLM feature, a RAG system or an autonomous agent adds a new attack surface that conventional application testing does not reach. We assess that surface directly: how your prompts, tools, retrieval and model boundaries behave under a motivated attacker, and what it costs you when they get through.
Who it is for
- Teams shipping LLM-backed product features
- RAG and knowledge-retrieval systems
- Autonomous agents and copilots with tool access
- Model and inference APIs exposed to users
What the adversary actually does
The attacks we run, each mapped to an OWASP LLM Top 10 category.
- LLM01directDirect prompt injectionOverrides your system prompt and guardrails to make the model act against its instructions.
- LLM01indirectIndirect prompt injectionPlants instructions in content the model later reads, such as a web page, a document, or a retrieved record.
- LLM02Sensitive information disclosureCoaxes out secrets, other users' data, or the hidden system prompt.
- LLM05Improper output handlingTurns unsanitised model output into XSS, SSRF or command execution downstream.
- LLM06Excessive agencyAbuses the tools and actions an agent can take, such as sending mail, calling APIs, or moving money.
- LLM04Data and model poisoningCorrupts training data or a RAG corpus so the model fails on attacker-chosen inputs.
Vyra in the field
Vyra has surfaced real vulnerabilities, up to Critical severity, in authorized bug-bounty and coordinated-disclosure programs. Most stay under program disclosure terms, so we show what we can and link what you can check.
Publicly verifiable
Separately from the field reports above, our four credited CVEs in Oracle and WSO2 products are from 2020 manual research, each linked to the public record.
Findings Vyra surfaced in authorized bug-bounty and coordinated-disclosure programs; report identifiers are shown as filed, and most remain under program disclosure terms. Program names and marks belong to their owners; a reported finding does not imply affiliation with or endorsement by these organizations.
How we run an engagement
Automation expands coverage and consistency. A human operator drives exploitation and judgement. It does not replace manual testing. It frees our testers to spend their time where it counts.
- 01
Scope and threat model
Map the system (models, tools, data flows, trust boundaries) and tie each surface to the OWASP LLM Top 10 and MITRE ATLAS.
- 02
Automated probing
Vyra runs broad probe categories across the surface for coverage and consistency. See Vyra.
- 03
Manual exploitation
Senior testers drive the attacks that need judgement: injection chains, guardrail bypasses, and abuse of real business logic.
- 04
Impact validation
We prove real impact, such as exfiltrated data or unauthorised actions, rather than reporting theoretical risk.
- 05
Report and remediation
Reproducible findings with severity, standard mappings and concrete fixes your engineers can act on.
- 06
Retest
We re-run the proven attacks after you remediate and confirm each one is closed.
Standards we map to
| Framework | What we map to it |
|---|---|
| OWASP Top 10 for LLM Applications (2025) | Every finding tagged to an LLM risk category. |
| MITRE ATLAS | Adversary techniques specific to AI and ML systems. |
| NIST AI RMF + Generative AI Profile | Risk framed across Govern, Map, Measure, Manage. |
| CERT-In 2026 AI guidance | India-specific expectations for securing AI systems. |
What you receive
- A threat model and attack-surface map of your AI system
- Reproducible findings with severity and standard mappings
- Evidence of real impact, not theoretical risk
- Prioritised, engineer-ready remediation guidance
- An executive summary for non-technical stakeholders
- A retest once you have remediated
Why trust our findings
Published research
- CVE-2020-14723Oracle Fusion Middleware, Stored XSS
- CVE-2020-14444WSO2 Identity Server, Reflected XSS
- CVE-2020-14445WSO2 Identity Server, XSS / open redirect
- CVE-2020-14446WSO2 Identity Server, Open redirect
Research credited through CybersecurityWorks Research Labs.
Practitioner-led
Ten-plus years in offensive security, preceded by roughly nine years building software. Most testers cannot read a codebase, and their reports show it. Ours can, so findings come with the why, not just the what.
Certified
- OSCP+ (certified 14 Sep 2026)
- CPENT
A boutique team: senior testers on every engagement, no handoff to juniors.
Scope an AI security engagement
Tell us what you are shipping and where it is exposed. We will scope the test and send a quote. No fixed package, no guesswork.