Redworm Book a test

Your AI chatbot is a liability nobody tested.

Redworm is hired to break the AI on your site before someone else does.

  1. You name the AI feature: a chatbot, a search box, an assistant, anything with a model wired into your systems.
  2. A person attacks it by hand, the way a stranger would: by typing.
  3. You get a report: what broke, how bad it is and how to fix it.
Book a test How a test runs

How a stranger gets in.

An AI feature does what it is told, and it cannot reliably tell your instructions from a stranger’s. None of this takes code or special tools. It takes typing. Five examples, playing on their own.

Example
Damage

Why it is that easy.

Most unsafe AI features are unsafe for the same handful of reasons. None of them is the model. All of them are how it was wired in.

  • Too much access

    The AI can read or change far more than its job needs. Whatever it can reach, a stranger can reach through it.

  • Rules that are only words

    "Never give a discount" in the instructions is a request, not a lock. Anything that matters has to be enforced by the system around the AI.

  • Vague instructions

    It was told what to do and never told what to refuse. Everything nobody thought to forbid is allowed.

  • Secrets in the instructions

    Codes, keys and internal notes get written into the hidden prompt. It is not hidden. Assume anyone can read it.

  • Trusting what it reads

    Web pages, reviews, uploads and emails go in as reading and come out as orders.

  • Nobody checks the reply

    The answer goes straight to the customer. Nothing looks for a price, a promise or a name before it is sent.

  • Nobody is watching

    No logs, no limits, no alert when someone tries two hundred times. The first you hear of it is a screenshot.

  • Only tested by friends

    The people who built it asked it nice questions and it gave nice answers. Nobody has tried to make it misbehave.

How a test runs.

  1. Scope

    You name the AI feature and sign off on it in writing. Nothing outside that list gets touched.

  2. Attack

    Every test is run by a person, by hand, through a test account. No scanners and no AI doing the attacking.

  3. Report

    Each finding arrives with its severity, the exact messages that caused it and the fix.

  4. Retest

    Once you have made changes, every finding is run again and marked closed or still open.

Three tests.

Start with a quick check. Move to a full test if the AI is wired into anything that matters. Retest once you have fixed what was found.

Quick check

A first look at one AI feature.

For
You have just put an AI feature in front of customers and want to know if the obvious attacks work.
Covers
  • Just asking and playing a part
  • Data leaks, broken rules, false promises, off-brand replies
You get
  • A short report: each finding with its severity and the fix

Full test

Everything the AI can touch.

For
Your AI can look things up, take actions or read content from outside your company.
Covers
  • All five ways in
  • The documents, tools and accounts the AI can reach
  • Long conversations and planted text
You get
  • The full report, with the exact messages to reproduce each finding
  • A call to walk through it

Retest

Proof that the fixes held.

For
You have had a report and made changes.
Covers
  • Every earlier finding, run again
  • New attempts around each fix
You get
  • An updated report: each finding marked closed or still open

If nothing is found, you do not pay full price.

A quick check or full test that turns up no vulnerabilities is billed at a reduced rate, agreed before the test starts.

Book a test