AI red teaming · for CEOs and CTOs shipping agents
The enterprise deal on your desk is waiting on proof your AI agent holds up under attack.
We produce that proof. Stonepath IT attacks your AI system the way an adversary would and hands you two things: a report your customer's security team can accept, and a test suite your engineers run on every release so the fixes stay fixed. One senior engineer does the work, start to finish.
On the first call we tell you whether you need this yet. If you do, the scope is in writing before anything starts, and the report and test suite are yours to keep whichever way the decision goes.
Red Squirrel · asleep
Replies come from Google's Gemini API. We keep nothing, so do not paste secrets. Privacy
Start here
MCP Security Review. $3,500. About five days.
We review one MCP server end to end: what tools it exposes, what metadata it hands the model, and where the trust boundary between the client and the server breaks. You get a dated report mapped to the OWASP MCP Top 10, with evidence for every finding.
MCP Security Review, $3,500, fixed. About five days.
- Scope
- One MCP server
- Testing
- Adversarial
- Turnaround
- About 5 days
- You keep
- Dated report
After the review
Two ways to go further.
Monthly retainer
The review tells you where the boundary breaks. The retainer keeps it tested as your system changes: new tools, new MCP servers, updated models. Scope and price after we have seen your architecture.
Agent Boundary Engagement
The full engagement tests the entire agent system: every tool call, every memory path, every privilege boundary. About three weeks, and a report plus a test suite you keep.
A fixed price comes after we have seen your architecture, because it depends on how many agents, how many tools they can call, and whether the Model Context Protocol is in the path. Ask on the call and you get a number in writing, not a runaround.
Who you get
You deal with the person doing the work. No junior analysts, no sales engineers.
Stonepath IT is run by Phillip Austin Green, working remotely, worldwide. He scopes the engagement, runs the exploits, writes the findings and walks your team through them. The firm opened this year. He has been in the trade since 2000.
Proof you can check before the call
- Published systems software
- Rust packages on crates.io, built around agent memory and identity boundaries. Public, and yours to read before we talk.
- Two preprints, with DOIs
- On agent memory provenance and identity stability: the failure modes this practice is built to test for.
- Twenty-plus years in the trade
- Secure command systems in the Air Force, network engineering, and a Tier 3 managed-services desk where the prompt-engineering work started early.
What we test
Four ways an AI agent goes wrong, found before your customers find them.
Each is a way an agent can be pushed past its instructions. Each ends up in front of your board, your customer or your insurer if it happens in production first.
- It gets talked into the wrong job
- A document, a web page or a tool result carries hidden instructions, and the agent follows them instead of yours. The technical names are goal hijack and indirect prompt injection.
- It misuses the tools you gave it
- The agent calls a tool it should not, or calls it on someone else's behalf, including through a connected MCP server it trusts by default.
- It acts on a planted memory
- Something written to its memory today changes what it does next week, long after the write that planted it looked harmless.
- It reaches further than you meant
- An agent credential with broad, long-lived access turns a small foothold into a path to your systems and your customers' data.
Every finding comes with the evidence, a severity and the recommended fix.
Fit
Who this is built for.
CEOs and CTOs of AI companies of 11 to 200 people selling agents, copilots or LLM features into larger customers. A different shape? Ask anyway and you will get a straight answer.
You are probably here because
- An enterprise deal is stuck on a security questionnaire that wants an AI red-team report from the last 12 months
- Your board or an investor asked how you handle prompt injection and agent misuse, and the answer was a slide
- You shipped an agent with real access to systems and data, and nobody has tried to break it
- You would rather hear what your agent does under attack from us than from a customer
- An auditor or a customer wants evidence the AI was adversarially tested
How this goes
Three steps, and you can stop after any of them.
- A scoping call
Twenty minutes to size it: how many agents, what they can reach, and whether regulated data is involved. Sometimes the answer is that you do not need this yet.
- The engagement
Scope and rules of engagement in writing, then the testing, against a target you authorize. Nothing in production is changed without a separate agreement. You get the report, the framework mapping and the test suite.
- Your call
Take the report to your customer or your board, hand the test suite to your engineers, or book a retest when the system changes. The report is yours to use.
One boundary
The one thing we will not do.
-
We do not certify you
We produce evidence-backed findings your auditor and your customers can act on. The certificate is issued by your auditor, and hiring us does not produce one.
Start with a 20-minute call.
A few questions, one business day for a reply, and a real person on the other end of it.