Launching AI Red Teaming: pentest your AI agents and MCP servers all alongside your app

Developers are standing up AI agents and MCP servers faster than security can test all the data flows they introduce, and often faster than anyone can agree on the guardrails. Layer on the APIs behind them and you have a whole new attack plane.

The use of AI systems in applications has exploded across the board, and in high-stakes environments, from finance to healthcare and everything in between. 

Yet the APIs behind the MCP server see broken authorization or too much trust in their caller, and the agents in front retrieve information they shouldn’t all because they were given much more access than they need.

Typically, the web team owns the frontend, the AI team owns the agent and the MCP server behind it, and security ends up testing each side with a different tool.

But the place where they meet and how data flows from one to the other falls through the gap. Until today.

It's now part of Escape's AI Pentesting: while Cascade pentests your web app, it also tests what the chatbot agent can be talked into fetching, which APIs it can reach, and any other vulnerabilities lying behind the MCP, just like an attacker would. Or, point a pentest directly at an MCP server.

AI Red Teaming is included in Escape's AI Pentesting and live for customers on October 21.

Here's what it can do:

1. Chatbot-to-MCP testing: attack the MCP server through the chatbot that fronts it, or pentest it directly
2. Multi-turn jailbreaking: reach the vulnerabilities that only surface several turns into a conversation
3. Exploits, not odd answers: prove what a prompt injection actually gets an attacker
4. One pentest for the whole app: web app, AI agents and MCP server tested together, in one platform

AI agents and MCP servers: new attack surfaces, tested

AI agents sit between the frontend and the API, and vulnerabilities live in that crossover. A tool the agent can call that the frontend never meant to expose or an input the MCP server trusts because it came from "our" chatbot.

Cascade now tests exactly that. It talks to the chatbot as a user and uses it to launch tests against the MCP server behind it, with no separate server setup and no need to map in advance the tools it exposes. You can also pentest an MCP server directly: Escape lists its tools and attacks them over MCP's own JSON-RPC protocol, which scanners built for REST or GraphQL can't enumerate or fuzz. 

You get:

• Coverage of the interaction between the frontend and MCP server
• Tests that match the real attack path. Reach the MCP the same way anyone on the internet can: through the chatbot
• No MCP expertise required. Find issues in the MCP layer without first auditing how it was built

Multi-turn jailbreaking: go beyond the first prompt

Guardrails typically hold against a single malicious prompt, but they slip once a conversation has built up enough context. That whole class of vulnerability is entirely missed by tests that fire one payload and read a single guardrail response.

Cascade now holds multi-turn conversations with your chatbot. It builds context across turns, adapts to each answer, and keeps pushing to uncover the jailbreaks that appear only when you’re several exchanges in.

You get:

• In-depth testing, not a payload list. Cascade responds to how your chatbot actually behaves instead of replaying canned prompts.
• A reproducible path. The conversation that led to the vulnerability is part of the evidence, so engineers can walk through it turn by turn.

One pentest for the whole app

For most security teams today, testing an AI chatbot involves one tool for the web app and a different one for the MCP server, getting lost in two dashboards and having to manually merge findings, letting critical crossovers slip through the gaps.

AI Red Teaming runs in the same pentest as your web application. One dashboard, every crossover covered, and one issue structure your team is already working with.

What you get:

• Fewer tools, fewer dashboards. The web app and the AI agent are covered in one place.
• Scenarios two tools can't run. Tests that start in the frontend and land in the AI agent only exist when one platform sees both.
• More coverage with no extra cost. Every web app with a chatbot, and every MCP server, is now one more tested attack path, inside the AI pentest assessment you already run.

Exploits that prove what the injection reached

Most AI testing stops when a chatbot returns an unexpected response and leaves security teams to debate about the severity of the finding, wasting precious hours that should be spent remediating what’s actually exploitable.

Escape’s AI Red Teaming checks whether a prompt injection gets something real: an unauthorized tool call, another tenant's data, or a privileged action. If it does, the finding comes with proof of the exploit.

You get:

• Vulnerabilities proved as exploits. You see what the injection reached, not just that the model went off-script.
• Severity engineers accept. Proof of exploitability ends the back-and-forth debate between security and engineering.
• Triage on impact. An injection that reaches another tenant's data and one that changes the bot's tone stop competing for the same spot in the triage queue.

AI features, pentested like the rest of your app

Chatbots and MCP servers ship through the same pipelines as everything else but require different tools, dashboards, and a whole different set of vulnerabilities. Now they get tested the same way: in the pentest you already run, with proof of what an attacker can actually reach, and no separate tool for the part where two teams' code meets.