Instructions hidden in content
A document, email or web page tells the assistant to ignore its rules, and it does (prompt injection).
AI System Audit · Audit & security
Is your AI agent safe, correct and under control?
An independent audit of AI agents, chatbots and RAG assistants: prompt injection, data exposure, agent permissions, output handling, evaluations and cost limits, mapped to the OWASP Top 10 for LLM Applications 2025.
Who it's for: Companies running AI agents, chatbots or retrieval-augmented (RAG) assistants with real users or real data.
- Written report
- Written authorization first
- NDA available
- Canadian company
Common problems
What we often find
Data shown to the wrong person
The assistant retrieves or repeats another customer's records, or reveals its own system prompt and secrets.
Agents with too much power
An agent can send emails, issue refunds or change records with no limits and no human approval step.
Model output trusted blindly
Text from the model is run as code, SQL or HTML, or passed to tools without checks.
No tests between releases
A prompt or model change quietly breaks answers that used to be right, and nobody notices until customers do.
No limits on use
One user, bot or loop can run up thousands of calls, with no rate limits, budgets or alerts.
What we check
A defined checklist, not guesswork
Each area maps to the OWASP Top 10 for LLM Applications 2025.
Prompt injection and system prompt leakage
LLM01, LLM07- Direct and indirect (document, email, web) injection tests
- Rules and secrets kept out of the system prompt
- Untrusted content separated from instructions
Sensitive data and retrieval
LLM02, LLM08- Retrieval respects each user's access rights
- Personal and confidential data in prompts, logs and answers
- Vector store and embedding access controls
Agent permissions and human approval
LLM06- Least-privilege tools and credentials
- Approval gates for money, messages and data changes
- Limits on actions per task and per user
Output handling
LLM05- Model output validated before code, SQL, HTML or tool calls
- Structured outputs checked against a schema
- Critical rules enforced in normal code, not the prompt
Correctness and guardrails
LLM09- An evaluation set built from real cases
- Accuracy, refusal and safety measured on every change
- Grounding and citation checks for factual answers
Supply chain and data
LLM03, LLM04- Models, libraries and plugins in use, and where they come from
- Training, fine-tuning and knowledge-base data sources
Abuse, cost limits and logging
LLM10- Rate limits, budgets and spend alerts
- Loop and retry limits for agents
- Logs that support investigation without leaking personal data
Reference: OWASP Top 10 for LLM Applications 2025
How it works
Scope, audit, report, you fix, we verify
- 01
Scope
A short call and a written scope: what we check, what we don't, the dates, and your written authorization.
- 02
Audit
Automated checks plus hands-on review by the Axieo team. Read-only where possible, and only on what you authorized.
- 03
Report
A plain-English written report with risk ratings, evidence, and prioritized recommendations, followed by a review call.
- 04
You fix, we verify
Your team makes the changes from the plan. We answer questions about the fixes, then re-test to confirm. We never change your systems.
- 05
Ongoing protection
Optional follow-up checks as your system changes, so fixed problems stay fixed.
What you get
- A written report with every finding mapped to the OWASP Top 10 for LLM Applications 2025
- Risk ratings and the evidence for each finding
- Prioritized recommendations your team can start on the same day, step by step for your stack
- Red-team and evaluation test cases from the audit, to rerun on every release
- A review call to walk through the results
- One re-test of critical and high findings within 60 days, to confirm your fixes
Pricing
From CA$5,000
Fixed quote after a free scoping call. One re-test included. Taxes extra where they apply.
The same rigor, in public
Test-first, threat-modeled engineering
Every Axieo audit uses the method behind our open-source PlainChain node: write the attack first, then prove the defense with a test.
- 622 automated tests in our open-source PlainChain node
- ~60 threats modeled and mapped to defensive code
- A live tamper-detection demo on our homepage
FAQ
Honest answers
What is the difference between Axieo Guard and the AI System Audit?
Axieo Guard checks the app itself: web apps built with AI app builders such as Lovable, Bolt.new, Replit, v0 or Base44, or written with AI coding tools such as Cursor. We check database access rules, exposed keys, logins, payments and hosting against a 25-point checklist. It starts with a free mini scan, audits start at CA$750, and monthly care plans are optional. The AI System Audit checks the AI inside a product: agents, chatbots and RAG assistants. We test prompt injection, data leaks, agent permissions, output handling and cost limits, mapped to the OWASP Top 10 for LLM Applications 2025. It starts at CA$5,000, with a fixed quote after a free scoping call. If your AI-built app also has an AI assistant, you may need both. We'll tell you on the first call. Both work the same way: we audit and recommend, your team makes the changes, and we re-test. We never change your systems.
What do you need from us?
Access to a test or staging version of the assistant, its system prompt and tool list, a description of the data it can reach, and a contact for questions. Written authorization comes first, and we're happy to sign an NDA.
Do you need production access?
Usually not. We prefer a staging environment and read-only access to logs. If something can only be checked in production, we agree exactly what, when and how in writing first.
Which models and frameworks do you cover?
Any: hosted models from OpenAI, Anthropic, Google and others, open-weight models, and the frameworks and tools around them. The risks we check don't depend on the vendor.
How long does it take?
It depends on how many assistants, tools and data sources are in scope. After a short scoping call you get a fixed quote and a fixed timeline.
Will testing harm our system or data?
No. Tests run only on what you authorize, preferably in staging. We don't change production data, and every test that could have side effects is agreed in advance.
Do you guarantee our AI system is secure?
No, and no honest auditor can. We check a defined, standards-based list of risks, show the evidence, and give you a clear plan. Testing again after changes keeps it that way.
What happens after the audit?
You get the report and a review call. Your team fixes from the plan, and we answer questions along the way. Within 60 days we re-test the critical and high findings, included in the price; further re-tests are quoted, usually CA$1,500 to CA$3,000. The test cases we leave you keep working on every release.
Will you make the changes for us?
No. We keep the audit independent, so we never change your code, prompts, data, settings or environments, and we never ask for write access. Every finding names the file, function or setting to change and how to check the fix. Your team, or a developer you choose, makes the changes.
Get started
Request an AI System Audit
Tell the Axieo team about your system. We reply within two business days to book a short scoping call, then send a fixed quote and a written scope.
- No payment details needed
- No passwords or keys needed
- Written authorization before any testing
- We never change your systems