Web Check · feature

AI chatbot security (an active check of your own bot against prompt attacks)

AI chatbot security is checked here the way an attacker would probe it: Web Check sends your bot a set of hostile requests and reads the answers. It is an active check, so it comes with one firm rule: test only a bot that you own or run. The page is meant for developers and owners who put a chatbot on a site and want to know how it reacts to prompt attacks before visitors find out.

AI chatbot security report: attack classes with severity and the verdict held or gave in

What AI chatbot security testing means

Most checks in Web Check are passive and only read public responses. AI chatbot security cannot be judged that way: the service really sends attacking requests to the endpoint of your bot and looks at what comes back. For that reason it is not part of the automatic audit of a site. It runs only when you start it explicitly and give the address of the bot.

The set of attacks was extended with the OWASP LLM Top-10 (2025) in mind. Only your own bot may be tested; a chatbot of somebody else is not a target for this function.

Settings and the two modes

To check AI chatbot security you provide the address of the bot and, if needed, change the defaults:

the request field, text by default;
the response field, reply by default;
an optional authorization header;
the mode: express or full.

Express covers the three most dangerous classes: injection through data (H), tool abuse (I) and extraction of the system prompt (A).

Full sends 18 requests over 14 classes of vectors: prompt extraction, context filling, gradual lead-in, meaning encoding, role switching, refusal blocking, answer agreement, data injection, tool abuse, many-shot (demo examples), payload splitting, output masking, adversarial suffix and skeleton key.

How a run works, step by step

You open /ai-security or call GET /api/ai-agent-security with the address of the bot endpoint in url.
You name the request and response fields if they differ from the defaults, add an authorization header if the bot requires one, and pick express or full.
Web Check sends the attacking requests of the chosen mode to the bot.
It reads every reply and decides whether the bot gave in: it repeated the control word PWNED, stepped out of its role ("developer mode, restrictions removed"), or output phrases from its system instructions or a secret marker.
Every attack class has a severity, and it tells you where to look first.

How the attack classes are ranked

Critical. Injection through data, tool abuse and skeleton key. Injection through an image or a document and poisoning of a RAG knowledge base are also critical, but they are not in this set.
High. Prompt extraction, role switching, meaning encoding, many-shot, payload splitting, output masking and adversarial suffix.
Medium. Context filling, gradual lead-in, refusal blocking and answer agreement.

The ranking of AI chatbot security risks tells you what to read first when several classes worked at once.

Where it helps and how to start

Before a bot meets visitors. Run full against the endpoint and see which classes got through.
After a prompt or tool change. A new system prompt or a newly connected tool is a good moment to repeat the run, at least in express mode: extraction of the system prompt and tool abuse are two of its three classes.
As a quick regular spot check. Express covers the three most dangerous classes and is the shorter run.

GET https://webcheck.asibots.pro/api/ai-agent-security?url=BOT_ENDPOINT

The same check is available on the /ai-security page.

Honest limits: what a passed result does not mean

Only your own bot. AI chatbot security testing is active. Do not point it at a chatbot that is not yours.
"Held" is not "invulnerable". The result "held" means that these requests did not work. It does not prove that no other request will.
Some risks cannot be seen through chat. Injection through an image or a document and poisoning of the RAG knowledge base cannot be tested through a chat channel. Without those channels a "held" would be false, so they are examined in the extended audit.
Not part of the auto-audit. The check runs only on explicit start with the address of the bot.

Frequently asked questions

Can I test a chatbot that belongs to someone else?

No. The check is active: Web Check sends attacking requests to the bot. Use it only on a bot that you own or run.

Does a passed AI chatbot security check mean the bot is safe?

No. The result "held" means that these requests did not work, not that the bot is invulnerable. A different request or another channel may still succeed.

Which risks cannot be checked through the chat channel?

Injection through an image or a document and poisoning of a RAG knowledge base. A chat check would give a false "held" for them, so they are analysed in the extended audit.

Test my own bot