Automated prompt injection testing for AI-powered web apps
Every SaaS product shipped in 2026 has AI features. Nautillo Pro is the first DAST platform to automate prompt injection testing against your live application — discovering AI endpoints, running goal-driven payloads, and delivering confirmed findings with HTTP proof.
Five attack goals — executed in priority order
Nautillo Pro runs a structured payload corpus organized by goal. Tests stop after the first confirmed proof — no noise, no duplicate findings.
System prompt disclosure
Attempts to extract the hidden system prompt — instructions the developer embedded before user content. Success here means an attacker can read internal logic, hardcoded secrets, or privileged context.
Fix
Never embed secrets in system prompts. Separate instructions from user content with clear delimiters.
Policy bypass leading to sensitive output
Attempts to override safety or content policies to produce restricted output. Tests whether role-override and jailbreak patterns defeat your model's guardrails.
Fix
Add output filtering for sensitive data types. Use a system prompt that explicitly rejects instruction-override attempts.
Cross-tenant data disclosure
Attempts to elicit data the model should not have access to — other users' records, internal documents, out-of-scope context injected into RAG pipelines.
Fix
Treat retrieved documents as untrusted input. Scope RAG context strictly to the current user or tenant.
User PII and conversation history extraction
Attempts to make the AI reveal personal data (email addresses, names, account IDs) or conversation content belonging to other users — exploiting RAG pipelines, session context, or shared conversation state.
Fix
Scope RAG retrieval strictly to the authenticated user. Never inject other users' records into the model context. Add an output filter that blocks email patterns and PII before returning the response.
Unauthorized tool / function selection
Detects whether the model would describe or attempt to select a tool or function it should not call. Runs as detection-only — no real actions are executed.
Fix
Enforce authorization checks outside the model. Validate tool selection server-side before execution.
How it works
Step 1
AI surface discovery
Nautillo Pro crawls your application and identifies chat interfaces, completion endpoints, and document-processing APIs. Each candidate is scored for confidence that it routes to an LLM.
Step 2
Intelligent AI surface detection
Each candidate endpoint is scored against a proprietary detection model. Prompt injection tests only run against endpoints that pass the confidence threshold — skipping non-AI pages to eliminate false positives.
Step 3
Structured payload execution
Payloads execute in priority order, starting with highest-impact goals. The run stops after the first confirmed proof. Evidence is redacted before storage — model responses containing sensitive data are truncated.
Step 4
HTTP proof captured
Every confirmed finding includes the exact POST body, the response that proves impact, the goal achieved, and remediation guidance. No inference — only findings with observable HTTP evidence.
What no other DAST tool does
Data privacy and EU residency
Healthcare and financial services buyers have strict requirements about where application data goes. Here is exactly what happens with your data during AI security testing.
- All probes are read-only — payloads attempt to elicit information but cannot modify, delete, or write data in your application.
- Prompt injection probes are HTTP requests to your application — the payloads go to your server, not to any third party.
- AI-guided endpoint discovery uses an AI classifier to analyse URL patterns and response shapes. You can disable this phase if your compliance requirements prohibit third-party AI processing.
- No response content is stored after analysis. Evidence in reports is truncated before storage to prevent sensitive data retention.
- The no-AI scan mode skips AI-guided discovery entirely. Prompt injection tests still run — they use only HTTP access to your endpoints, with no external AI dependency.
For HIPAA buyers and EU-regulated teams, enabling the no-AI scan mode removes the external AI classifier dependency entirely while keeping all prompt injection and non-AI tests active. Contact support@nautillo.pro to discuss EU-hosted model options.
What AI surfaces Nautillo Pro tests
Chat and completion APIs
POST endpoints accepting free-text user input and returning LLM-generated responses. The primary injection surface.
Document and summarization endpoints
Endpoints that accept documents, emails, or URLs and process them through an LLM. High-risk for indirect injection.
Agent tool interfaces
Endpoints that route user intent to tool calls or function selection. Tested for unauthorized tool abuse (G3).
Your AI endpoints are live. Are they tested?
Most teams ship AI features and assume the LLM provider handles security. It doesn't. Prompt injection is an application-layer vulnerability — and it's your responsibility to test it.
Prompt injection tests run automatically on every scan. No configuration required.