Agent Attack Audit by VANDAM: Red-team your agents and their connections

This page as Markdown llms.txt llms-full.txt services.json sitemap.xml
# Agent Attack Audit by VANDAM: Red-team your agents and their connections

> A findings report with a reproduction for every attack that worked, and the fixes already applied and re-tested. We test the support bots, email agents, Cowork connectors and MCP servers you run today, with the access they hold today.

URL: https://vandam.ai/agent-attack-audit  
Contact: hendrik@vibelab.be

# See what your agents do when a stranger gives the orders.

A findings report with a reproduction for every attack that worked, and the fixes already applied and re-tested. We test the support bots, email agents, Cowork connectors and MCP servers you run today, with the access they hold today.

[Discuss the project](mailto:hendrik@vibelab.be?subject=VANDAM%20/%20Agent%20Attack%20Audit)

**$6,400** two weeks

## Agents read text from strangers. Few companies limit what they can reach.

- **#1**
  risk in the [OWASP](https://genai.owasp.org/llmrisk/llm01-prompt-injection/) Top 10 for LLM applications, 2025: prompt injection, including instructions hidden in websites and files a model reads.
- **97%**
  of organizations that reported a breach of an AI model or application had no AI access controls in place. [IBM](https://newsroom.ibm.com/2025-07-30-ibm-report-13-of-organizations-reported-breaches-of-ai-models-or-applications,-97-of-which-reported-lacking-proper-ai-access-controls) Cost of a Data Breach Report, 2025.
- **10+ days**
  of data exports from Salesforce instances in August 2025, using stolen tokens from the Salesloft Drift chat integration. [Google Threat Intelligence](https://cloud.google.com/blog/topics/threat-intelligence/data-theft-salesforce-instances-via-salesloft-drift).

> Prompt injection is the new #1 attack vector.
>
> Alex Lieberman, Co-founder, Tenex, June 2026, [Source](https://x.com/businessbarista/status/2069529729309512135)

## An agent reads what strangers send. Then it acts with your keys.

A support bot reads tickets written by customers. A payables agent reads invoices written by suppliers. A language model has no reliable way to tell your instructions apart from instructions hidden in that text, and [OWASP](https://genai.owasp.org/llmrisk/llm01-prompt-injection/) ranks this, prompt injection, first in its Top 10 for LLM applications. Its advice starts with limiting what the model can reach to what the task needs.

That reach decides the damage. In August 2025, attackers used stolen tokens from the Salesloft Drift chat integration to export data from many companies’ Salesforce instances, then searched it for AWS keys and Snowflake tokens, according to [Google Threat Intelligence](https://cloud.google.com/blog/topics/threat-intelligence/data-theft-salesforce-instances-via-salesloft-drift). A chat tool with wide access to the CRM became the way into it.

We test the agents you already run the way an attacker would: planted instructions in tickets, emails, shared documents and tool descriptions, then we watch which tools the agent reaches for and what its tokens allow. What gets through is fixed in the same two weeks and attacked again. It is the agent counterpart of the [Adversarial App Audit](https://vandam.ai/adversarial-app-audit), which does the same for the code of an app.

> Every agent with access to your systems is a new door into your company, and a lot of those doors were left open.
>
> Greg Isenberg, CEO, Late Checkout, October 2026, [Source](https://x.com/gregisenberg/status/2110414696037716372)

## How the two weeks run.

1. Map what each agent can reach: We list every agent, connector and MCP server, the content each one reads and the scopes and keys it holds. The first finding is often a token with far more access than the job needs.
2. Attack with your own kind of content: We write attacks in the shapes your agents meet every day: a support ticket, an invoice email, a shared document, the description of a third-party tool. Each attempt is logged with the agent’s reasoning and every tool call it made.
3. Fix, then attack again: Scopes are cut to the task, outside content reaches the model as data, keys move out of the agent’s reach and risky actions wait for a person. Every attack that worked runs again until it fails.

## Attacked once. Attacked again after every change.

Models update, connectors get added and prompts change, and any of those can reopen a door. After the audit we can run the attack set every month and test each new agent before it goes live.

- Attack rerun: The full attack set run against every agent, next to last month’s results.
- New connections: Every new agent, connector or MCP server attacked before it goes live.
- Scope review: Tokens and permissions compared with what each agent actually used.
- Findings call: A monthly session with IT on what changed and what to close next.

[Ask about monthly attack runs](mailto:hendrik@vibelab.be?subject=VANDAM%20/%20Agent%20Attack%20Audit%20care)

## What you receive.

- Attack map: Every agent and connection with the access it really has.
- Findings report: Each finding with the input, the tool call and a severity.
- Fixes, re-tested: Changes applied and the same attacks run again until they fail.

$6,400

two weeks

An indication from past projects. The final price can move a little with the size and complexity of your company, and we agree it in writing before we start.

For operations, IT and security leads at 20–500 person companies with agents in production. Useful once an agent reads outside content and can act in your systems.

[hendrik@vibelab.be](mailto:hendrik@vibelab.be?subject=VANDAM%20/%20Agent%20Attack%20Audit)

## Where the audit leads. Each next step has its own service.

### Agent Onboarding

Reconnects each agent with only the access it needs, owner by owner.

**$9,600 + $1,600/mo**

### Eval Suite

Turns every attack that worked into a test case run on each new model.

**$12,800**

### Agent Ops

We run the agents with the fixes in place and watch for the next attempt.

**$3,200/mo**

### Private AI

Moves the most sensitive steps to a model you control.

**$16,000**

> a permissions manager for your AI agents. which agents can access which accounts, what’s the spending limit, what requires your approval. nobody is building this and everyone is going to need it.
>
> Greg Isenberg, CEO, Late Checkout, April 2026, [Source](https://x.com/gregisenberg/status/2048381278953603406)

## Before you ask.

### Do you attack our production systems?

We agree the scope with your IT lead first. Most tests run against the live agents with test accounts and test records, so an attack that works shows what would have happened without touching real customers or money.

### Which agents and tools do you cover?

Support bots, email and payables agents, Claude Cowork connectors, MCP servers, custom GPTs and in-house agents: anything that reads outside content or holds a key. We start from the inventory and test what can reach the most.

### How does this differ from the Adversarial App Audit?

The Adversarial App Audit tests the code of an app you built. This audit tests agents: what they read, how they can be steered and what their scopes let them reach.

### Can prompt injection be fixed for good?

No model is immune today. The fixes limit what a steered agent can do: narrow scopes, outside content passed as data, keys out of reach and a person approving risky actions. The re-test shows what still gets through.