Penetration Testing
A security testing method that validates the effectiveness of system defenses by simulating attack behaviors. In the context of AI Agents, it specifically refers to testing permission control enforcement by submitting nominally harmless but prohibited requests and then verifying whether the resulting business state reflects unauthorized changes, confirming whether access controls can be bypassed.
Timeline (last 90 days)
Validation controls should send harmless but ostensibly prohibited requests through all paths, then read the target state to prove that the business state has not been changed.
Canary states can be preset for critical business operations as dedicated observation points, allowing penetration tests to run continuously and automatically
All Facts (2)
Validation controls should send harmless but ostensibly prohibited requests through all paths, then read the target state to prove that the business state has not been changed.
50%UnverifiedCanary states can be preset for critical business operations as dedicated observation points, allowing penetration tests to run continuously and automatically
50%