# Testing AI Capabilities

Pick **AI Capabilities Only** when you want a focused assessment of copilots, chat, RAG, tools, memory, or other LLM features. Aikido maps those runtime surfaces and tests them as the primary objective of the run.

{% hint style="warning" %}
Run the pentest on a staging or test environment. Agents interact with your AI features and may create, modify, or delete data through tools, memory, or downstream systems.
{% endhint %}

## When to use what

| Wizard option            | Use it when                                                                                                                                                                                    |
| ------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Web Application**      | A full pentest of websites, frontends, APIs, and MCP servers. AI features in the application stay in scope. For a standalone MCP server, follow [Testing MCP Servers](https://help.aikidogov.us/pentests/configure-a-pentest/testing-mcp-servers). |
| **AI Capabilities Only** | The run should focus on AI agents and LLM features: chat, copilots, RAG, tools, memory, and similar surfaces.                                                                                  |

The report stays focused on AI and LLM risks. If agents confirm a web or API issue while testing those features, they still include it.

## What gets tested

Aikido discovers how your AI features actually work, then tests the security-relevant paths behind them. Typical focus areas:

* **Prompt injection and jailbreaks:** whether untrusted input, uploaded files, retrieved documents, or tool output can override instructions or bypass guardrails
* **Data leakage:** whether the agent can expose system prompts, hidden instructions, credentials, PII, or cross-tenant data
* **Tool and agency abuse:** whether the agent can take high-impact actions, call tools with malicious parameters, or reach downstream systems it should not
* **Memory and RAG:** whether persistent memory, session state, or indexed knowledge can be poisoned to steer later runs or leak data
* **Authorization on AI actions:** whether unauthenticated or low-privilege users can reach AI endpoints, tools, or actions reserved for another role or tenant
* **Unbounded consumption:** whether prompts, loops, or tool chains can trigger runaway cost, latency, or token usage

For the full list, see the [checks page](https://app.aikido.dev/ai-pentests/checks) and [OWASP Top 10 for Agentic Applications](https://help.aikidogov.us/pentests/coverage-and-findings/what-issues-can-aikido-pentest-find/owasp-top-10-for-agentic-applications).

## What you need

* **Manage Pentests** [permission](https://help.aikidogov.us/getting-started/automated-user-management/setting-roles-and-permissions)
* **Sufficient credits** in your [wallet](https://help.aikidogov.us/miscellaneous-info/wallet-and-credits)
* A **staging URL** for the application that hosts the AI features
* Ownership of the domain so it can be [verified](https://help.aikidogov.us/pentests/configure-a-pentest/domain-verification), or the [Aikido Broker](https://help.aikidogov.us/miscellaneous-info/aikido-broker-for-internal-applications) if the app is only reachable on an internal network
* Aikido's [pentest IP addresses](https://help.aikidogov.us/pentests/prepare-a-pentest/ip-addresses-for-pentest) added to your firewall, WAF, or API gateway allowlist
* **Test users** that can actually use the AI features you want tested
* All **repositories** in scope (strongly recommended for whitebox discovery)

## Set up the pentest

{% stepper %}
{% step %}
### Select AI Capabilities Only

Go to **Pentests**, open your **Project**, and click **Create Assessment**. On the **Select Pentest Target** step, select **AI Capabilities Only**.
{% endstep %}

{% step %}
### Define your scope

On the **Scope** step, enter the application's URL. Use a staging or QA environment.

Choose **Test entire application** if the AI features are part of the main app, or **Test specific parts only** if you want agents to focus on AI-specific paths (for example, `/chat`, `/copilot`, or an internal assistant).

Complete [domain verification](https://help.aikidogov.us/pentests/configure-a-pentest/domain-verification) for every in-scope host. If the app is only reachable on an internal network, add it as a broker resource and select that broker URL in scope.
{% endstep %}

{% step %}
### Add test users that can use the AI features

On the **Test Users** step, add credential sets for each role you want validated, such as a standard user, an admin, or a user from another tenant. See [Setting Up Test Users](https://help.aikidogov.us/pentests/configure-a-pentest/setting-up-authenticated-testing).
{% endstep %}

{% step %}
### Add code and context

On the **Code & Documentation** step, link all repositories in scope (frontend, backend, workers, and any service that implements or calls the AI features). Whitebox is strongly recommended: Aikido reads the source to map chat entrypoints, prompts, tools, memory, retrieval, and the controls around them.

If you cannot link a repository, use **Additional context** to describe:

* Which AI features exist and how users reach them
* Which tools, plugins, or downstream systems the agent can call
* Which roles should be allowed to use each capability
* Where memory, conversation history, or knowledge bases are stored

See [Leveraging Code and Documentation](https://help.aikidogov.us/pentests/configure-a-pentest/leveraging-code-and-documentation).
{% endstep %}

{% step %}
### Review safety, pricing, and launch

Finish the remaining **Safety Check**, **Pricing**, and **Summary** steps, then start the run.
{% endstep %}
{% endstepper %}

## Tips

* **Use a dedicated test instance** with non-production data. Mock or disable destructive tools (delete, deploy, send email, charge a card) where you can.
* **Give agents a path to the AI feature.** If the copilot is behind a feature flag, extra onboarding, or a specific workspace, say so in the test-user instructions or additional context.
* **Describe tools and knowledge sources** when you cannot attach code: which actions the agent can take, which data it can retrieve, and which tenants or roles should be isolated.
* **Issue dedicated test identities** with the permissions you want validated, and rotate them after the assessment.

## Need help?

If agents cannot reach your AI features or authentication fails, open the **Intercom chat** in the bottom right corner. Our team is here to help!