Up to 412 attack vectors · 19 categories · PDF reports

Security scanner
for AI agents & LLMs

Find prompt injection, data exfiltration, jailbreak, guardrail bypass, RAG poisoning, and more vulnerabilities in your AI agents and LLMs. Automated pentesting via API.

$ curl -X POST https://agentscan.sh/api/v1/scans \
-H "X-API-Key: as_live_..." \
-d '{"target_url": "https://your-agent.com/chat"}'
 
Risk Score: 87/100 (CRITICAL)
Tests: 254 | Vulnerabilities: 18
 
[CRITICAL] prompt_injection - direct_ignore_instructions
[CRITICAL] data_exfiltration - env_variable_leak
[CRITICAL] rag_poisoning - document_injection_prompt
[HIGH] jailbreak - dan_variant
[HIGH] guardrail_bypass - rot13_injection
[HIGH] function_calling_abuse - function_chaining_exploit
[MEDIUM] multi_step_exploitation - persona_drift

What we scan for

5 categories included free · 14 premium categories for Pro & Enterprise plans

💉

Prompt Injection

Direct, indirect, encoded, multilingual, and delimiter-based injection attacks. 73 vectors including few-shot manipulation, token smuggling, and attacks in 8 languages.

📤

Data Exfiltration

System prompt leaks, config extraction, PII exposure, cross-session data leaks, SSRF via markdown images, and incremental extraction.

🔓

Jailbreak

DAN variants, character roleplay, hypothetical framing, gradual escalation, authority overrides, and output format manipulation.

🛠

Tool Abuse

Unauthorized tool calls, SSRF via agent, SQL injection through tool parameters, chained attacks, and mass action triggers.

👑

Privilege Escalation

Admin claim, debug mode activation, permission boundary bypass, role confusion, capability unlocking, and context manipulation.

🛡

Guardrail Bypass PRO

ROT13, leetspeak, homoglyph, HTML entity, comment injection, zero-width chars, mixed encoding, and reverse text obfuscation attacks.

📋

Structured Output Injection PRO

JSON field injection, SQL in output, malicious code generation, CSV formula injection, XXE, JSON key override, and SSTI markers.

Function Calling Abuse PRO

Function hijacking, parameter type confusion, tool override, parallel calling abuse, hidden function discovery, and chain exploitation.

📑

RAG Poisoning PRO

Document injection, context overflow, knowledge base extraction, fake citation, metadata injection, embedding collision, and authority spoofing.

🎯

Multi-Step Exploitation PRO

Temporal attacks, state reset, conversation history manipulation, gradual constraint removal, logic bombs, persona drift, and trust escalation.

🤖

Agent Autonomy Abuse PRO

Skill injection, goal hijacking, sandbox escape, credential harvest. Test whether agents can be manipulated into autonomous harmful actions.

🔄

Multi-Turn Agent PRO

Trust building, memory injection, privilege escalation, session hijack. Multi-turn conversation attacks that exploit agent memory and state.

💥

State Injection ENTERPRISE

Memory poisoning, vector store injection, config override, cross-session leak. Advanced attacks targeting agent internal state and persistence layers.

🔌

MCP Attack ENTERPRISE

Tool poisoning, shadowing, rug pull, cross-server contamination, log-to-leak exfiltration. 12 vectors targeting the Model Context Protocol.

💣

DoS / Resource Exhaustion PRO

ThinkTrap, BadThink, sponge prompts, JSON bombs, infinite delegation, tool loops. Test if your agent can be crashed or exhausted.

🚨

Output Safety PRO

Insecure code generation (SQLi, XSS, eval), hallucinated packages (slopsquatting), phishing content, disinformation, adversarial suffixes.

🔒

Privacy / PII Extraction ENTERPRISE

Training data memorization, membership inference, GDPR probes, divergence prompts, cross-session data leaks, entity enumeration.

🖼

Multimodal Injection ENTERPRISE

FigStep simulation, typographic injection, PDF/audio/SVG injection, steganographic text, data URI and QR code injection vectors.

🔍

Side-Channel ENTERPRISE

Model fingerprinting, capability probing, error differential analysis, token count inference, infrastructure and rate limit fingerprinting.

📊

Detailed Reports

Risk score 0-100, severity breakdown, specific remediation advice per vulnerability. Export as JSON or PDF with full evidence.

Simple API

# Start a scan
POST /api/v1/scans
{
  "target_url": "https://your-agent.com/chat",
  "categories": ["prompt_injection", "jailbreak"]
}
 
# Get results
GET /api/v1/scans/{scan_id}
 
# Download PDF report
GET /api/v1/reports/{scan_id}/pdf

Pricing

Free

$0/month
  • 2 scans per month
  • 185 attack vectors (5 categories)
  • Auto-detect agent format
  • Fixed throttle (1 req / 10s)
  • JSON results
Get Started

Enterprise

Custom
  • Unlimited scans
  • All 412 attack vectors - 19 categories
  • + State Injection
  • All Pro features
  • SLA + dedicated support
Contact Us