AI and LLM Penetration Testing in 2026: The New Attack Surface

AI Did Not Just Change the Tools. It Changed the Target.

For most of the last decade, penetration testing had a stable map: web applications, APIs, networks, cloud accounts, and people. In 2026 there is a new territory on that map, and it is growing faster than any before it: the large language model, and the applications, agents, and pipelines built around it. Almost every company we speak to has added an AI feature this year, a support chatbot, a document assistant, an internal copilot wired into real systems. Each one is a new door, and most of them have never been tested by anyone who thinks like an attacker.

At the same time, AI is changing how the testing itself is done. The same models that create this new attack surface can be turned around and pointed at it, reasoning about an application, chaining findings together, and reproducing an expert's judgement at a scale no human team could match. This article looks at both sides of that shift, and at what Obventum and our Netherlands based sister company ReactiveZero are building because of it.

The New Attack Surface: How LLM Systems Actually Break

Securing a language model is not the same as securing a traditional application, and treating it as such is where most teams go wrong. A model does not expose a fixed set of inputs and outputs you can enumerate. It follows instructions written in plain language, and that is exactly the problem. The issues we find most often, and that do the most damage, fall into a handful of patterns:

• Prompt injection. Instructions hidden inside a web page, a document, an email, or a support ticket that the model reads and obeys as if they came from its owner. When the model can also take actions, injection stops being a text trick and becomes remote control.
• Jailbreaks and guardrail bypass. Carefully framed inputs that walk a model around its safety rules, leaking its system prompt, internal policies, or content it was explicitly told to withhold.
• Sensitive data disclosure. Models that surface training data, cached context, or one user's information to another, often because the application trusts the model to keep boundaries it was never designed to enforce.
• Insecure agents and tool use. The fastest growing risk of all. Once an LLM is given tools, the ability to browse, run code, query a database, or send mail, a single injected instruction can move money, exfiltrate data, or pivot into internal infrastructure.
• Retrieval and supply chain poisoning. Corrupting the documents an assistant retrieves, or the third party models and plugins it depends on, so the attack is baked in long before any prompt is sent.

These map closely to the OWASP Top 10 for LLM Applications, and they connect directly to problems we have tested for years. An agent wired to a database is still, underneath, an access control and injection problem, the same class of flaw we hunt in application and API security testing. That is why AI assurance belongs with an offensive security team, not with a data science team alone.

Why Automated Penetration Testing Is Finally Realistic

For years, "automated pentesting" was a vulnerability scanner with a confident name. Scanners match known signatures. They do not understand a business, chain three low severity findings into one critical path, or recognise that an endpoint behaving exactly as designed can still be abused. Real testing needs judgement, and judgement is precisely what modern models have started to show.

A capable model can read an application the way a tester does: form a hypothesis, try it, observe the result, and adapt, then explain the finding and its root cause in language a developer can act on. It does not get tired, it does not skip the dull endpoints at hour six, and it can follow hundreds of paths at once. It is not a replacement for a skilled human, the strongest results still come from a model and an expert working together, but it changes the economics of coverage completely.

What We Are Building: AI Powered Pentesting as a Service

This is the part we are most excited to share. Obventum and ReactiveZero have invested in serious infrastructure to build this properly: four NVIDIA DGX systems, running in our own environment, dedicated to training and running a local offensive security model. We chose local hardware over a public AI service for one reason above all others, confidentiality. Our work touches our clients' most sensitive systems and findings, and none of it should ever leave our control or be used to train someone else's model. On our own DGX cluster, the data stays with us.

On top of that infrastructure we are training a model and wrapping it in a platform: penetration testing as a service that clients will be able to run themselves, on demand, every time they ship a change, instead of waiting for a single scheduled test once a year. In its current scope the platform is designed to cover:

• Web application testing from every perspective: white box with full source and credentials, grey box with partial knowledge, and black box with nothing but the target, so you see your systems the way developers, insiders, and outside attackers each see them.
• Infrastructure testing across every environment: on premise, cloud, and hybrid, covering the networks, identities, and configurations that hold everything together.
• Reverse engineering assignments: taking apart binaries and firmware to understand how they truly behave and where they can be broken.

We want to be clear about where this stands: the platform is in beta and actively in testing right now. Every result is validated against the same standard as our manual work, because a finding you cannot trust is worse than no finding at all, and a human expert reviews what the system produces before it ever reaches a client. This is how we believe AI belongs in security: expanding what a trusted team can cover, never quietly replacing the trust itself.

What This Means for Your Organization

Two things follow from all of this. First, if your business shipped AI features this year, they need to be tested by people who understand both the model and the attacker, before that helpful assistant with database access becomes the easiest way into your company. Second, continuous and automated coverage is about to become a realistic expectation rather than a luxury, and the organizations that adopt it early will be finding and fixing issues while their competitors wait for next year's audit.

If you would like your AI features assessed today, or you want early access to the beta platform as we open it up, we would be glad to talk. Explore our penetration testing services, read more on the blog, or reach us on the contact page. The attack surface is changing quickly. We intend to stay ahead of it, and to help you stay ahead of it too.