Skip to content

Case Study / API penetration testing

Prompt injection in an AI endpoint — found and fixed

A SaaS product with AI-powered features engaged us for an API vulnerability assessment and penetration test across its documented API surface, tested to NIST SP 800-115 and the OWASP API Security Testing methodology over a two-week engagement. The AI-processing endpoints, file upload, and account workflows were treated as elevated-risk surface.

SaaS · AI product · API VAPT

What we found

Prompt injection in an AI rewrite endpoint (High)

An AI text-rewrite endpoint took a user-controlled parameter straight into the model prompt. Crafted instructions in that parameter overrode the intended function and made the model follow arbitrary instructions — the class of flaw that can leak system prompts or hidden context when an AI is wired to other tools and data. Insufficient isolation between system and user content was the root cause.

Unrestricted file upload (High)

Upload endpoints accepted files without enforcing an allow-list of extensions, MIME types, or content signatures — a path to hosting malicious content and, in some deployments, code execution.

Double-extension upload bypass via null byte (High)

Even where filtering existed, a null-byte double-extension trick slipped disallowed file types past validation — demonstrated, not asserted.

No rate limiting on OTP verification (Medium)

OTP verification endpoints had no rate limiting, CAPTCHA, or throttling — leaving one-time codes open to brute force.

Input-validation & misconfiguration findings (Low/Info)

A tail of lower-severity issues: thin server-side input validation (HTML/JS acceptance), weak password-history control, information disclosure via server headers, and missing security headers.

How we worked

Risk-based API testing

Direct API testing of server-side controls, authorization enforcement, and input validation across the documented endpoints, prioritized by attack surface — AI processing, file upload, and account management first.

Exploit-verified findings

Each finding was validated for real exploitability, not flagged from a scanner — the prompt-injection and upload-bypass issues were demonstrated end to end.

AI-aware assessment

The engagement treated the AI endpoints as their own attack surface — prompt isolation, instruction handling, and model-integration boundaries — an area most API tests skip entirely.

Remediation-focused reporting

Findings were grouped by affected functionality with specific server-side fixes, so the team could remediate by area rather than chase a flat list.

What changed

  • Zero critical findings; three High-severity issues clearly prioritized for immediate fix.
  • The client remediated the findings and a follow-up retest returned a clean scan — the loop closed, not just reported.
  • The AI endpoints gained prompt-isolation controls, and file upload moved to strict allow-list validation with content-signature checks.

Client identity is confidential by agreement. The engagement is published anonymized; we never publish metrics we didn't measure.

Ready to scope the work?

A 30-minute call with the engineers who will do the testing — not a sales gate.

Book a scoping callDownload the sample report