AI Agent Penetration Testing Scope: What to Include and Exclude

Why Standard Pentest Scope Falls Short for AI Agents

Standard application and infrastructure penetration tests cover web surfaces, APIs, networks, and host configuration. AI agents introduce additional attack surface that those engagements often miss: tool invocation chains, memory and context stores, connector protocols such as MCP, agent-specific identity, and agent-to-agent channels.

Agent-specific testing does not replace standard application penetration testing. It addresses attack surface introduced by tool use, memory, MCP interfaces, and agent identity. Standard application and infrastructure testing should continue covering the underlying web, API, and network layers the agent runs on. Scope both explicitly rather than assuming one covers the other.

Agent-Specific Attack Surface to Include

Treat the following as first-class scope items. Each represents a distinct manipulation or trust boundary that standard API or app testing rarely covers end to end.

• Tool invocation chainsWhich tools an agent can call, under what conditions, and with what parameters.
• Memory and context persistenceShort-term context windows and long-term memory stores as distinct manipulation surfaces. Test short-term context window manipulation separately from long-term memory store manipulation.
• MCP interfacesAuthorization between client, host, and server outside the traditional application boundary. Test MCP or equivalent tool-connector endpoints independently of the underlying application API.
• Agent identity and permissionsHow an agent authenticates to tools and whether it uses its own credentials or impersonates a user. Verify how that identity is checked at each tool call.
• Agent-to-agent communicationProtocols and trust assumptions that differ from agent-to-tool or agent-to-user interaction. Document and test this channel separately.

Also include permission boundaries under dynamic conditions. Where tool access depends on context (user role, task state, or similar), validate least privilege across representative context states rather than a single static permission set.

What to Exclude, and Why

Exclude underlying model provider internals from agent pentest scope. Model weights, training pipelines, and provider-side inference infrastructure are usually outside the customer’s control and outside what an application-layer agent engagement can meaningfully exercise.

Exclude application and infrastructure layers already covered by standard pentests, unless agent logic directly alters their behavior. Re-testing the same web routes, generic APIs, or network controls without an agent-specific path creates duplicate effort and can dilute focus on agent-only findings.

When agent behavior changes how those layers enforce access or process data, bring only the affected paths back into scope and document the boundary clearly.

Common Scoping Mistakes

• Undefined prompt injection boundary: Scope should state whether prompt injection testing covers only direct user input or also indirect content the agent ingests via tools, documents, or retrieval. Leaving this undefined causes disputes over whether a finding was in scope.
• Static permission assumption: Where agent tool access depends on context, such as user role or task state, testing a single fixed permission set will miss escalation paths that only appear under certain conditions.
• MCP endpoints treated as standard APIs: MCP defines authorization between client, host, and server outside the traditional application boundary and warrants testing as its own interface rather than folding into general API testing.
• No tool manifest provided: Without a current list of tools, parameters, and permission scopes, testers cannot assess whether granted access exceeds task requirements, a gap OWASP describes as excessive agency.
• Agent-to-agent communication left unscoped: Where agents coordinate with other agents, that channel may use different protocols and trust assumptions than agent-to-tool interaction and should be scoped separately rather than assumed covered.

Artifacts to Provide Before Engagement

Hand testers concrete artifacts so scope is testable, not theoretical. At minimum, prepare the following.