# Enoki

> Enoki tests AI agents for security and safety vulnerabilities. It attacks your agent the way an adversary would, shows the exact attack behind every finding, and re-runs that attack on every release to confirm your fix still holds.

Enoki is for the CTOs, AI engineers and tech leads who ship agents into production, often before there is a security team to ask. It is also for security leads at larger companies: the Enterprise plan adds unlimited security and safety testing, full evidence export for auditors, and Jira, Linear and Git integration. Traditional pentests stop at the API. Enoki tests what an attacker can make the agent itself do: leak its system prompt, use a tool it should not, or reveal another user's data.

How it works:

1. Connect: point Enoki at your agent's endpoint. No code changes, no SDK, no installation.
2. Attack: Enoki learns what your agent can do and generates attacks specifically for it, not a generic checklist.
3. Find: reproducible vulnerabilities with the exact attack, the agent's response, a severity, and a mapping to OWASP and MITRE ATLAS.
4. Verify: fix the issue once, and Enoki re-runs the attack on every release. If it succeeds again, the finding reopens.

Enoki runs from a coding agent over MCP, or from CI/CD over the API. The first assessment of one agent is free: no install and no credit card. Enoki is operated by EthicGate BV in Gent, Belgium.

## Product

- [Enoki](https://enokilabs.ai/): what Enoki tests and how it works
- [Questions about AI agent security testing](https://enokilabs.ai/#faq): what it is, how it differs from a pentest, and what Enoki does and does not do
- [Test your agent for free](https://enokilabs.ai/#hero): paste your agent's endpoint on the home page to start a free assessment
- [Pricing](https://enokilabs.ai/pricing): a free assessment of one agent, then Standard or Enterprise, scoped to what you are testing
- [Trust & Security](https://enokilabs.ai/trust): where account data is stored, how it is protected, what a test does to your agent and what Enoki keeps from it; GDPR compliant, ISO 27001 in progress, with a direct line to our security team
- [Team](https://enokilabs.ai/team): the co-founders and founding engineer building Enoki, and the open roles

## Free tests

- [Free security tests for AI agents](https://enokilabs.ai/test): all six free tests on one page, one per risk
- [Free prompt injection test for AI agents](https://enokilabs.ai/test/prompt-injection): Most prompt injection scanners check a block of text. Enoki attacks your running agent with injected instructions and shows you the attack that got through. Free, no install.
- [Free system prompt leak test for AI agents](https://enokilabs.ai/test/system-prompt-leak): System prompt leakage is rated critical and maps to OWASP LLM08:2026. Enoki runs the known extraction paths against your running agent and prints whatever it returned. Free, no install.
- [Free data leakage test for AI agents](https://enokilabs.ai/test/data-leakage): Enoki hides fake secrets where your agent can reach them, then tries to extract them. 4 categories, all rated critical, mapped to OWASP LLM02:2026. Free, no install.
- [Free multi-turn jailbreak test for AI agents](https://enokilabs.ai/test/jailbreak): Single-turn testing gives false confidence because it never reaches the state where an agent gives way. Enoki runs multi-turn and dynamic attacks against your agent. Free, no install.
- [Free OWASP LLM Top 10 test for AI agents](https://enokilabs.ai/test/owasp-llm-top-10): Every category on this page carries the OWASP LLM or Agentic Top 10 identifier the taxonomy holds for it. Run it against your agent and get findings already mapped. Free, no install.
- [AI agent pentest, continuous instead of annual](https://enokilabs.ai/test/agent-pentest): A yearly pentest describes an agent that no longer exists. Enoki runs the attack suite on every release and confirms each fix by re-running the attacks that found it. Free to start.

## Docs

- [Documentation](https://docs.enokilabs.ai): connecting an agent, running assessments, and using the API and the MCP server
- [Documentation for AI assistants](https://docs.enokilabs.ai/llms.txt): the same documentation in this format

## Blog

- [Which model is the best at hacking agents 👽](https://enokilabs.ai/blog/attacker-model-benchmark): 10 models, one attacker harness, two agents, three runs each, scored against a key written in advance. The ranking changes with the agent.
- [What red-teaming tools actually find](https://enokilabs.ai/blog/red-teaming-tool-benchmark): Four open-source AI red-teaming tools and Enoki's attacker, run against two agents whose weaknesses were written down first. Coverage, variance, and the gap between what a tool reports and what it achieved.
- [AI agent security: the risks, the real incidents, and how to test for them](https://enokilabs.ai/blog/ai-agent-security): AI agent security explained: the OWASP Agentic Top 10 risks, 12 real incidents from EchoLeak to ForcedLeak, the controls that matter, and how to test your agent.
- [AI agent security testing vs penetration testing: what a pentest misses](https://enokilabs.ai/blog/ai-agent-security-vs-pentesting): A pentest checks your application and its APIs, not what your AI agent can be talked into doing. See the gap in a real example, and what to ask your provider.
- [What is AI red teaming? A practical guide for AI agents](https://enokilabs.ai/blog/what-is-ai-red-teaming): AI red teaming is adversarial testing that finds an AI system's weaknesses before an attacker does. Here is how it works, what it tests for, and how to start.
- [AI agent red teaming tools in 2026: what actually catches agent failures](https://enokilabs.ai/blog/ai-red-teaming-tools): Seventeen AI red teaming tools compared by the job they actually do, not feature lists. Which ones test agents, which test models, and who now owns them.
- [Manual, automated, and continuous red teaming compared](https://enokilabs.ai/blog/manual-automated-continuous-red-teaming): Manual, automated, and continuous red teaming each catch different things. Here is how they compare, and why AI agents need testing on every release.
- [Single-turn, multi-turn, and dynamic agentic attacks explained](https://enokilabs.ai/blog/single-multi-turn-dynamic-attacks): Attacks on AI agents come in three forms: single-turn, multi-turn, and dynamic. Here is how each works, and why single-turn testing misses the dangerous ones.

## Contact

- [Email](mailto:hello@enokilabs.ai): hello@enokilabs.ai
- [Book an intro call with a founder](https://meetings-eu1.hubspot.com/joachim-roelants): 30 minutes, looking at your agent

## Optional

- [Full text](https://enokilabs.ai/llms-full.txt): the main pages, the free tests and every article in one file
- [Privacy policy](https://enokilabs.ai/privacy): what personal data Enoki processes and why
- [Terms of service](https://enokilabs.ai/terms): the terms that govern an organisation's use of Enoki