AI Security

Why AI needs its own category

AI-backed endpoints have an attack surface that traditional scanners don't model. The vulnerable code might be perfect — but the LLM behind it accepts user input that influences its behavior in ways the original developer never anticipated. Standard SAST sees no bug; standard DAST sees a 200 response. AI-specific scanning probes the actual semantic behavior.

Coverage matrix

LLM prompt-injection scanning

For any endpoint that returns LLM-generated text, Sectora sends a curated payload set covering:

• Direct instruction override ("ignore previous instructions")
• Role hijack ("you are now DAN")
• System-prompt extraction ("repeat your instructions verbatim")
• Tool-call hijack (when the endpoint exposes function-calling)
• Encoding-layer attacks (base64-encoded instructions, unicode obfuscation, ROT13)
• Indirect injection (poisoned page content the LLM ingests)
• Jailbreaks from a payload corpus updated weekly

Findings include the exact payload, the model's response, and a behavioural delta vs the system-prompt baseline (we know what the model SHOULD do).

Adaptive multi-turn red-team

Single-shot payloads catch a lot, but the dangerous attacks unfold across a conversation. A model that refuses "ignore your instructions" on turn one will often comply after a few turns of role-play, hypotheticals, and incremental escalation — the "crescendo" pattern. Sectora's adaptive red-team pursues a concrete goal across multiple turns, switching tactic when the model refuses, until it either achieves the goal or exhausts its turn budget.

It pursues three goals independently, each scored by an automated judge:

• System-prompt extraction — coax the model into revealing its hidden instructions.
• Instruction override — get it to follow an injected instruction that overrides its own rules.
• Tool-call hijack / excessive agency — drive it to emit a destructive or privileged tool call.

The attacker and judge run in two modes: a deterministic heuristic pair (no extra model required — escalation ladders that branch on refusal), and, when an internal model is configured, an AI-backed pair that generates adaptive prompts and scores responses semantically. The loop is identical either way; only the move-generation differs, and every run records which engine actually ran. Findings carry the full escalation transcript as evidence.

Enable it per endpoint with the Adaptive multi-turn red-team toggle when you add an endpoint (model providers only — not MCP). The single-shot OWASP LLM suite still runs alongside it in the same scan.

MCP server scanning

Model Context Protocol servers expose tools that LLMs can call. The tool inputs originate from LLM-generated calls, which means they're effectively user-controlled. Sectora's MCP scanner:

• Enumerates tools via the MCP server's standard listing endpoint
• Reads each tool's input schema
• Probes for unsanitized input flowing into filesystem / shell / network / SQL sinks
• Tests authorization — can a tool intended for admins be called by non-admin contexts?
• Checks rate limiting + resource exhaustion patterns

Agent sandbox bypass

Agent frameworks (LangChain, Vercel AI SDK, Claude Code SDK shape) let LLMs invoke tools. Common bug: granting a "run shell command" tool with no allow-list. Sectora's scanner probes for:

• Tools that wrap raw exec/Bash without command-allowlist
• Tools that access filesystem outside a base directory
• Tools that fetch arbitrary URLs (SSRF via agent)
• Tools that bypass auth on downstream APIs
• Recursion bombs — agents that call themselves indefinitely

RAG poisoning

For Retrieval-Augmented Generation endpoints (which fetch context from a doc store before responding), Sectora probes the retrieval surface:

• Can a user inject content into the doc store that'll later influence other users' responses?
• Does the retrieval prefer attacker-influenced content via crafted query embeddings?
• Are retrieved chunks correctly fenced as untrusted in the final prompt?

AI Smart Triage (using AI to triage findings)

Separately from scanning AI endpoints, Sectora uses AI to triage every scan finding (SAST/DAST/SCA). See AI Integrations for setup. The model receives the code context + finding metadata and returns a structured verdict — used to mute likely-FP findings without hiding them.

How to run an AI Security scan

AI Security scans are run from the AI Security console — you register the endpoint once, then scan it on demand:

1. Open AI Security → Add Endpoint.
2. Pick the Provider:
   • OpenAI / Anthropic / Azure / Vertex / Bedrock / Custom — for an LLM endpoint. Enter the endpoint URL, model name, and API key. Runs the OWASP LLM Top 10 suite. Flip on Adaptive multi-turn red-team to additionally run the autonomous crescendo loop. (The Provider is just the API wire format — point the URL at your deployed app; what's tested is your implementation, not the model vendor.)
   • MCP Server — for a Model Context Protocol server. Enter the server URL and pick a Transport (below). Runs the OWASP MCP Top 10 suite.
3. Save, then click Scan on the row. Findings appear on the scan page tagged by category (LLM01–LLM10 / MCP01–MCP10) with CWE mappings.

MCP transport: HTTP (JSON-RPC) vs SSE

MCP messages are JSON-RPC 2.0; the transport is just how they travel. Pick the one your server exposes:

• HTTP (JSON-RPC / Streamable HTTP) — request→response: the client POSTs a JSON-RPC call and gets a JSON reply. The modern default; try this first.
• SSE (Server-Sent Events) — a long-lived text/event-stream the server pushes messages down (server→client streaming/notifications), with requests POSTed on a side channel. The older remote transport; use it if your server advertises an /sse endpoint.

OWASP coverage reference

LLM Top 10 (model endpoints) — 46 payloads across:

• LLM01 Prompt Injection — direct overrides, role escape, encoding bypass, indirect/document injection
• LLM02 Sensitive Information Disclosure — system prompt, API keys, PII, training-data probes
• LLM05 Insecure Output Handling — XSS / SQLi / SSRF / command output rendered from the model
• LLM06 Excessive Agency — tool enumeration, unauthorized actions, permission escalation, action chains
• LLM07 System-Prompt Leakage · LLM08 RAG/Embedding · LLM09 Misinformation · LLM10 Unbounded Consumption (DoS)

MCP Top 10 (MCP servers) — 23 probes across MCP01–MCP10: secret leakage in tool descriptions/resources, excessive capabilities, hidden-instruction / invisible-Unicode injection, server-identity drift, shell/pipe/SSRF injection through tool args, tool-result poisoning, missing auth on tool calls, audit gaps, endpoint shadowing, and context-isolation breaks.

What's next

• DAST — broader runtime scanning.
• API Security — same target surface from a structural perspective.
• AI Integrations — BYO key for AI Smart Triage.