Redworm Book a test

Your AI agent is a liability nobody tested.

Every tool you give an AI agent is a button a stranger can press. Redworm finds out which ones before someone else does.

Book a test How a test runs

Every tool is a button a stranger can press.

An AI that only answers questions is low stakes. The moment it can make an offer, issue a refund or touch a company system, whoever is typing can try to make it do that. Companies are racing to give agents more access, and the security is years behind.

On your website

  • make_offer()Puts a price in writing that nobody approved.
  • issue_refund()Refunds $500 to someone who never ordered.
  • apply_discount()Stacks discounts until the order is free.
  • lookup_order()Reads out another customer’s name and address.
  • book_appointment()Fills your calendar with bookings that never show.

Inside your company

  • reset_password()The helpdesk agent resets a manager’s password for a caller who sounded urgent.
  • search_files()The company assistant summarises salary data for someone who should never see it.
  • send_email()The inbox agent forwards invoices to an outside address.
  • export_contacts()The sales agent hands over your whole customer list.
  • run_query()The reporting agent changes records it was only meant to read.

How a stranger gets in.

An AI agent does what it is told, and it cannot reliably tell your instructions from a stranger’s. None of this takes code or special tools. It takes typing. Five examples, playing on their own.

Example
Damage

This already happened.

The examples above are made up. These are not. Leaked data, money owed and a car for a dollar, all from AI that was live in front of customers or inside a company.

  1. Microsoft 365 Copilot, 2025

    One email, no click

    Researchers showed that a hidden instruction inside an ordinary email could make Copilot send a company’s emails, files and chats to an outsider. Nobody had to open anything. Microsoft rated it critical and patched it before it was used in the wild.

    Source
  2. McDonald’s hiring chatbot, 2025

    64 million applications exposed

    Researchers got into the admin side of McHire, the chatbot that interviews job applicants, with the password 123456. Up to 64 million applications were open to them, chat transcripts and contact details included.

    Source
  3. Slack AI, 2024

    Pulled secrets out of private channels

    Researchers showed that a message planted in a public channel could make Slack’s AI fetch data, like API keys, from private channels the attacker was never in.

    Source
  4. Lenovo support chatbot, 2025

    One question, support logins exposed

    A single 400-character question made Lenovo’s chatbot write code that could hand an attacker the support team’s logged-in sessions. Lenovo fixed it after researchers reported it.

    Source
  5. Car dealership, 2023

    Sold a $1 Tahoe

    A visitor told a Chevrolet dealer’s chatbot to agree with everything and call each answer legally binding. It agreed to sell a 2024 Tahoe for $1. The bot was pulled from the site.

    Source
  6. Air Canada, 2024

    Made up a refund policy

    The airline’s chatbot told a grieving customer about a refund that did not exist. A tribunal ruled the airline is responsible for what its chatbot says, and made it pay.

    Source

Try it yourself.

Gandalf is a free game by Lakera. An AI guards a password and you have to talk it out of it. The first level takes one message.

Play Gandalf

Why it is that easy.

Most unsafe AI agents are unsafe for the same handful of reasons. None of them is the model. All of them are how it was wired in. Where one has a name in the OWASP Top 10 for LLM applications, the industry’s list of AI risks, it is marked.

  • LLM06 Excessive agency

    Too much access

    The agent can read or change far more than its job needs, and every new integration adds more. Whatever it can reach, a stranger can reach through it.

  • LLM01 Prompt injection

    Rules that are only words

    "Never give a discount" in the instructions is a request, not a lock. Anything that matters has to be enforced by the system around the AI.

  • Vague instructions

    It was told what to do and never told what to refuse. Everything nobody thought to forbid is allowed.

  • LLM07 System prompt leakage

    Secrets in the instructions

    Codes, keys and internal notes get written into the hidden prompt. It is not hidden. Assume anyone can read it.

  • LLM01 Prompt injection

    Trusting what it reads

    Web pages, reviews, uploads and emails go in as reading and come out as orders.

  • LLM05 Improper output handling

    Nobody checks the reply

    The answer goes straight to the customer. Nothing looks for a price, a promise or a name before it is sent.

  • Nobody is watching

    No logs, no limits, no alert when someone tries two hundred times. The first you hear of it is a screenshot.

  • Only tested by friends

    The people who built it asked it nice questions and it gave nice answers. Nobody has tried to make it misbehave.

How a test runs.

  1. Scope

    You name the agent and sign off on it in writing. Nothing outside that list gets touched.

  2. Attack

    Every test is run by a person, by hand, through a test account. No scanners and no AI doing the attacking.

  3. Report

    Each finding arrives with its severity, its OWASP category, the exact messages that caused it and the fix.

  4. Retest

    Once you have made changes, every finding is run again and marked closed or still open.

Three tests.

Start with a quick check. Move to a full test if the AI is wired into anything that matters. Retest once you have fixed what was found.

Quick check

A first look at one AI agent.

For
You have just put an AI agent in front of customers and want to know if the obvious attacks work.
Covers
  • Just asking and playing a part
  • Data leaks, broken rules, false promises, off-brand replies
You get
  • A short report: each finding with its severity and the fix

Full test

Everything the AI can touch.

For
Your agent can take actions, like refunds, bookings or email, or is connected to company systems.
Covers
  • All five ways in
  • Every tool the agent can call, and what it can be talked into doing with it
  • The documents, systems and accounts it can reach
  • Long conversations and planted text
You get
  • The full report, with the exact messages to reproduce each finding
  • A call to walk through it

Retest

Proof that the fixes held.

For
You have had a report and made changes.
Covers
  • Every earlier finding, run again
  • New attempts around each fix
You get
  • An updated report: each finding marked closed or still open

If nothing is found, you do not pay full price.

A quick check or full test that turns up no vulnerabilities is billed at a reduced rate, agreed before the test starts.

Book a test