nandsec

AI and Agent Security

nandsec secures the AI coding tools and agents your organisation uses, and tests their attack surfaces, such as prompt injection through untrusted input, excessive tool permissions and data leakage. This includes secure AI-assisted development, AI tool and data review, agent and integration review, and LLM and agent penetration testing. We also assess applications built with AI coding tools.

assistant ยท routes/export.pydiff ready
 from flask import Blueprint, send_file
+import reqeusts
 from .auth import require_auth
 
 bp = Blueprint("export", __name__)
 EXPORT_URL = "https://api.example.com/export"
 @bp.route('/export')
-@require_auth
 def export():
+    token = "sk_live_[redacted]"
+    data = reqeusts.get(EXPORT_URL, headers={"Authorization": f"Bearer {token}"})
     return send_file(build_csv(data.json()))
Package allow-listblocked
"reqeusts" is not on the allow-list and is one letter from "requests".
Secret detectionblocked
A live API key pattern in source.
Protected code pathsneeds review
An authentication decorator was removed from a route.
Human reviewrequired
Changes to auth, payments or dependencies need a named reviewer.

Secure AI-assisted development

Secure AI-assisted development covers the environments and workflows in which your developers run AI coding tools and agents. nandsec is focused on designing secure, specialised architectures for each environment, with sandboxing, scoped credentials and filesystem access, and an egress allow-list. This covers Windows, macOS and Linux, even where the operating system offers no sandbox of its own. nandsec also sets controls on every AI-written change before it is merged, from the dependencies it adds to the review it must pass.

Scope

  • Isolated containers or virtual machines for each agent or project
  • What files, credentials and networks each agent can reach
  • Account setup for managed and unmanaged AI services
  • Dependency, secret and protected-path checks before merge
  • Rules and context files for the coding tools themselves

How it runs

We design the setup with your team and build it on your machines and repositories.

AI tool and data review

AI tool and data review examines the AI tools in use across your organisation, including unapproved ones, and the data that reaches each tool. nandsec records each tool and account in a register, classifies the data sent to it, and reviews retention, training opt-out, data residency and vendor terms.

Scope

  • Which AI tools and accounts are in use, including unapproved ones
  • What data is sent to each tool, and who can see it
  • Data retention, training and sharing settings
  • Vendor terms and where data is stored

How it runs

We work from interviews and account settings to map each tool and the data it receives.

Agent and integration review

Agent and integration review assesses AI agents and the tools they connect to: MCP servers, plugins and API integrations. Our engineers enumerate what each tool lets an agent do, and review the credentials and permission scopes each agent holds. We then trace where untrusted content (email, tickets, web pages) can reach an agent's instructions, and test tool poisoning and confused deputy paths.

Scope

  • Permissions and credentials held by each agent
  • What each tool or MCP server lets an agent do
  • Where untrusted content can reach an agent's instructions
  • Approval steps for actions that change or send data

How it runs

We confirm each finding with a working test against your agents and their tools.

LLM and agent penetration testing

LLM and agent penetration testing covers applications and agents built on LLMs, for example chat assistants, support bots and internal agents. nandsec tests each one for direct and indirect prompt injection, jailbreaks, system prompt leakage and improper output handling. Our engineers then chain these attacks through the application's tools and data sources, to exfiltrate data or act on another user's behalf.

Test coverage

  • Direct and indirect prompt injection
  • Data leaks through responses, tools and logs
  • Actions an agent can be made to take on someone else's behalf
  • Bypass of content and access controls

How it runs

We test in a staging environment with the tools and data sources the application uses.

AI-built application assessment

AI-built application assessment addresses the vulnerability classes AI coding tools introduce most often: missing or permissive database access policies, secrets exposed in the client bundle, broken access control, injection and cross-site scripting, and hallucinated or typosquatted dependencies. nandsec assesses applications built with Lovable, Bolt, Replit, v0, Cursor, Claude Code and similar tools, and confirms which of these weaknesses affect your application.

Test coverage

  • Row-level security and database access policies
  • Secrets in the client bundle and the repository
  • Authorisation on routes and server functions
  • Injection and cross-site scripting
  • Dependencies, including hallucinated packages
  • Tenant isolation and business logic across user roles
  • Authentication provider configuration (OAuth redirects, JWT validation, email verification)
  • Storage bucket and file upload policies
  • Webhook signature verification, for example on payment events
  • Server-side request forgery through AI features and URL fetchers
  • Prompt injection in any LLM features inside the application
  • Rate limits and spend abuse on paid APIs, such as exposed LLM API keys
  • Secrets in git history and deployment environment variables

How it runs

Each finding comes with a fix prompt for your AI coding tool.

SecretsKept in a managed vault and rotated
Sign-inMFA for staff, rate-limited login
Data accessRow-level security on every table
InputValidated on the server
ErrorsGeneric errors, detail in logs
LoggingAudit log for sign-in, payments, admin
BackupsDaily, restore tested monthly
DependenciesPinned, updated weekly
Production ready

Other services

Penetration TestingApplications, APIs, cloud, networks and internet-facing systems. Security Architecture and AdvisoryThreat models, architecture review and secure design. Red Teaming and ForensicsRed and purple team engagements, compromise assessment and malware analysis. Embedded and Firmware SecurityDevices, firmware, operating systems and compiled software. Security EngineeringHardened systems, secure pipelines and secure firmware for your products. Software Design and EngineeringArchitecture, full-stack, mobile and systems development. Applied ResearchSecurity research across operating systems, memory safety, malware, firmware and AI agents.

Scope a test

Email [email protected] with the AI tools or applications you use and what you want checked or set up. We reply with a scoping outline. For sensitive discussions, or if you prefer, message us on Signal or SimpleX.