What can instruct it?
We introduce hostile instructions directly, through retrieved content and across multi-turn sessions.
- Prompt injection
- Policy extraction
- Boundary erosion
Offensive AI security · Pune / Worldwide
The red line
between autonomous
and exposed.
We attack the seams between models, memory, identity and tools—then give your engineers the evidence to close the path.
AUTHORITY PATH / LIVE
ATTACK / INSTRUCTIONCan hostile input rewrite the task?
Direct and indirect prompt injection against the system’s intended boundary.
SCROLL TO TRACE THE PATH
10MODEL SCANS
1,145ADVERSARIAL ATTEMPTS
350RAW FINDINGS
01THE SYSTEM HAS CHANGED
Models stopped being chat windows.
They can retrieve secrets, hold memory and call tools. So we test the chain—not just the chatbot.
AUTHORITY ENGINE / 5 BOUNDARIES
What can enter memory?
We test source trust, tenant isolation and whether one user can poison what another user receives.
- RAG poisoning
- Cross-tenant leakage
- Unsafe sources
Whose power does it borrow?
We trace the initiating human through delegated credentials, approvals and every downstream action.
- Confused deputy
- Privilege drift
- Missing attribution
What happens off-screen?
We chain tools, mutate arguments and pressure approval gates until the true blast radius is visible.
- Excessive agency
- Tool chaining
- Fail-open controls
02EVIDENCE, NOT THEATRE
A finding is useful only when engineering can reproduce it.
From attack path
to closed path.
Every result carries the literal input, observed response or action, impact, owning control and re-test state. No mystery scores. No fear deck.
Find the smallest useful test ↗
- 01Map
Authority, tools, data and approvals.
- 02Attack
The seams between trusted layers.
- 03Prove
Capture a repeatable effect.
- 04Fix
Change the control that owns it.
- 05Re-test
Replay the exact path.
03ARICA AI SECURITY LAB
Independent research · September 2026
We test the method
on ourselves first.
Ten locally run open-weight model scans. One adversarial harness. Results reported as evidence with limitations—not as universal rankings.
10Open-weight model scans
1,145Adversarial attempts
350Raw detector findings
124Deep-battery probes
OPENAIgpt-oss-20B
QWEN2.5 · 3 · 3.5
MICROSOFTPhi-4
METALlama 3.1 · 3.2
MISTRAL AIMistral 7B
GOOGLEGemma 3 4B
READ THE RECEIPTS
Methodology, versions, accounting, limitations and result tables.
Open the research note ↗Model names identify locally tested open-weight builds. Arica’s research is not affiliated with or endorsed by the providers and makes no claim about their hosted products.
04WAYS TO ENGAGE
Start where the
risk is real.
Pick one live surface, prove the method, then expand only when the evidence justifies it.
Screening assessment
A focused adversarial pass against one model, agent or RAG pipeline moving toward production.
- Defined attack surface
- Reproducible evidence
- Prioritised fix path
Focused engagement
End-to-end red teaming across model, retrieval, tool, identity and application boundaries.
- Threat-led plan
- Engineering debrief
- Fix verification
Continuous red team
Regression testing tied to model, prompt, tool and retrieval changes across releases.
- Recurring attack battery
- Regression evidence
- Risk readout
0530-SECOND SCOPE
What did you give the model?
Find the smallest
useful test.
Select the closest description. We’ll recommend a starting point—without a form gate.
Reply within one business day.
01 / SYSTEM
What are you shipping?
02 / AUTHORITY
What can it reach?
RECOMMENDED STARTChoose one option above
We’ll size the minimum test that gives you useful evidence.
Email this scope ↗06BEFORE THE CALL
No black box around the engagement.
Straight
answers.
01What exactly do you test?
Production AI agents, LLM applications, retrieval pipelines and the identity, tool and data boundaries around them. The plan follows what your system can actually reach and do.
02Do you need model weights?
Not always. We can begin black-box against an authorised endpoint and increase access only when the agreed scope requires it.
03How is this different from a penetration test?
A conventional test covers applications and infrastructure. This work targets model-driven behavior between an input and a consequential action, including retrieval, memory and delegated authority.
04What does engineering receive?
Reproducible attack inputs, captured effect, severity rationale, framework mapping, a system-specific fix path and re-test evidence.
05Can you work before launch?
Yes. Pre-production access often makes the test more useful because fixes can land before customers and real data increase the cost of change.
THE NEXT ATTACK PATH ALREADY EXISTS.