Analysis · curated 27 Aug 2026
LLM security testing: how to pentest LLMs and MCP servers
First reported · updated · 2 reports escape.tech
Coverage timeline
Why it matters
MCP-connected LLM applications expose new injection channels (tool descriptions, tool responses, rendered Markdown sinks) that standard web-app testing misses, so defenders need a repeatable method to prove and regression-test these probabilistic findings.
Escape.tech publishes a methodology for pentesting LLM applications and MCP servers, mapping attacks to the OWASP Top 10 for LLM Applications 2025 (prompt injection, improper output handling, excessive agency, system-prompt leakage) and demonstrating them against a self-built vulnerable FastMCP lab. The guide explains why LLM testing breaks the web-app playbook — no parser boundary, non-deterministic interpreter, no sanitization line — and notes MCP tool descriptions and tool responses both reach the model as trusted injection channels, referencing tool poisoning and rug-pull attacks.