Deployed AI Feature Security Test – What Your Chatbot Tells a Stranger Who Asks

You put an AI feature on your website. Has anyone asked it what its instructions are?

The Deployed AI Feature Security Test sends a small, fixed set of ordinary questions to an AI feature you own — a support chatbot, an AI search box or an AI-backed API endpoint — and reports what the answers give away: whether it will describe the instructions it was given, which model and provider it names, whether it can be used without signing in, whether anything it is told in one conversation reappears in another, and whether its error messages expose stack traces or file paths. At most twelve requests, every one of them listed in the report.

What it checks

• Whether the AI will describe the instructions it was given — system prompt leakage (OWASP LLM07)
• Whether it can be used without signing in, and what usage information it returns (LLM10)
• Which model and provider it discloses, in its answers and in its response headers
• Whether a reference planted in one conversation reappears in a fresh one (LLM02)
• Whether error responses expose stack traces, file paths or provider identifiers
• The endpoint itself: encryption, certificate, CORS and rate-limit signals

What you get

• A written PDF report emailed back to you, typically within one business day.
• Every finding rated Critical / High / Medium / Low, mapped to the OWASP Top 10 for LLM Applications.
• The exact questions asked and the answers received, so your developer can reproduce every finding.
• An executive summary written for the customer security questionnaire that probably prompted the purchase.
• A "what was checked" appendix that states the limits of the scan honestly.
• Reporting built to CompTIA Security+ and PenTest+ practice standards.

Who it's for

Any business that has shipped a chatbot, an AI assistant or an AI-backed API and has been asked — by a customer, an insurer or their own conscience — whether it is safe. The alternative is an AI red-team engagement at four figures, or nothing.

Requirements

• Windows 10 or Windows 11
• No administrator rights needed
• An internet connection
• The full address of the AI feature, and you type its hostname a second time to confirm it is yours
• About 3 minutes
• You must own or be authorised to test the AI feature you enter — the test refuses AI provider addresses and anything that is not yours to test

What this is not

QuickScan is detection and advisory only. It sends a fixed set of plain questions, never a jailbreak, an exploit or an attempt to extract other people's data; it stops at the first sign of a leak instead of pulling on the thread; and it is hard-limited to twelve requests. It never contacts any third party, only the endpoint you name. It is not a red-team exercise, a certification, an audit or an attestation — if the report shows a serious leak, it points you to ThreatVector's hands-on services.

One-time purchase. No subscription, no auto-renewal. Your report is prepared with AI-assisted analysis under ThreatVector's security review protocols and checked against our false-positive triage rules before it is sent. Reports are produced by ThreatVector LLC. ThreatVector and its scan library are developed, sold and distributed by ThreatVector LLC.