AGENTS · TOOLS · MCP

AI Agent Security

Security reviews of AI agents that call tools, browse, read documents and take actions — where prompt injection becomes real-world impact.

5

Deliverables

8

Tools

3

Attacks covered

VAPT & WAPT SOC Operations AI Agent Security Mobile & API Security Malware Analysis & Threat Intelligence Digital Forensics & Investigations

What I deliver

Agent threat modeling: tools, data sources, permissions
Indirect prompt injection through documents, web pages and tool output
Excessive agency and unsafe tool chaining
Human-in-the-loop and approval design review
Mapped to OWASP Top 10 for Agentic Applications and MITRE ATLAS

⟩ how I approach it

Step by step

01
Map the agent's tools, data and permissions
02
Threat-model who can influence its inputs
03
Attack with indirect prompt injection and tool abuse
04
Review approvals and least privilege
05
Re-test in CI after every change

⟩ who it's for

Teams shipping AI agents or copilotsCompanies connecting LLMs to internal toolsProducts using MCP serversSecurity teams new to AI risk

⟩ real-world projects

Selected engagements

From my work at BERRY9 IT Services, as a freelancer, at CRIS InfoTech and Hacktr Technologies, and my own tools and research.

01

AI attack & pentest agent (self-built) — recon, scanning and exploit validation with human approval before any exploitation

02

MCP server and agentic AI reviews — tool poisoning, excessive permissions and insecure data flows

⟩ common vulnerabilities & how I find them

Top bugs I hunt — and the steps

The recurring weaknesses I see in this domain, with the repeatable workflow I run from discovery to fix.

STEP 1Plant instructions in content the agent will read (email, PDF, web page)
STEP 2Watch whether the agent follows them and calls tools
STEP 3Prove impact: data sent out, records changed
STEP 4Fix: separate trusted instructions from untrusted data, approval for sensitive tools

⟩ arsenal

Tools & frameworks

Garak

LLM Red Team

PyRIT

AI Risk Testing

Promptfoo

Prompt Evaluation

MCP Inspector

MCP Server Review

mcp-scan

MCP Risk Scanner

LangChain

LLM Framework

LlamaIndex

RAG Framework

Burp Suite Pro

Web Security

⟩ engage

Need ai agent security expertise?

⟩ related

More in Specialized Expertise

6+ years leading 100+ real-world projects, identifying critical vulnerabilities in complex enterprise networks and web applications.

6+ years managing L1/L2/L3 SOC operations for numerous clients, detecting and responding to advanced threats in real-time.

Mobile & API Security

6+ years of deep-dive mobile testing for 100+ iOS/Android apps, uncovering critical vulnerabilities.

Malware Analysis & Threat Intelligence

6+ years reverse-engineering real-world malware and producing actionable threat intelligence — YARA/Sigma rules, IOC feeds and MITRE ATT&CK-mapped reports that ship straight into client SOCs.

Digital Forensics & Investigations

Evidence-grade investigations of compromised hosts, phishing, insider cases and data leaks — with a clear, defensible timeline.

⟩

Let's Work Together

VAPT engagements, SOC consulting, AI/LLM security assessments, incident response or training at Hacktr Technologies — tell me what you're protecting and I'll reply within one working day.

1. Scoping call
30 minutes on what you need — apps, APIs, SOC, AI or training.
2. Proposal
Clear scope, rules of engagement, timeline and price.
3. Test, report, retest
Findings with PoC and fixes, then a free retest.

Security projects

CRIS InfoTech · Co-Founder & CTO

VAPT, SOC, AI/LLM security, forensics, incident response

contact@crisinfotech.com

Training & courses

Hacktr Technologies · Lead Trainer

Batches, corporate training, career & placement help

info@hacktrtechnologies.com

Talk to me directly

Sudhakar Reddy · LinkedIn

Speaking, collaborations, mentoring — message me on LinkedIn

Message on LinkedIn

LinkedIn GitHub Instagram Hyderabad · worldwide