October 30, 2026
How much does an AI or LLM penetration test cost in 2026?
An AI penetration test from Escaped costs $1,200 a day, with a two-day minimum. A customer support chatbot is $2,400, and most AI features come to $2,400 to $9,600, quoted as one fixed price before testing starts. Specialist AI security firms quote $8,000 to $15,000 for a chatbot and $15,000 to $35,000 once the feature can read user data or call tools, usually after a sales call. Automated “AI red teaming” scans are sold from about $1,500 and are a different thing, covered at the end of this page.
The rest of this page is the detail behind those numbers: what the common sizes cost, why there is a two-day minimum, what moves the number, what is in the price, and how to get a quote for your own feature.
Typical prices by feature
| What you’ve built | Days | Price at $1,200 a day |
|---|---|---|
| Customer support chatbot answering from your help docs | 2 | $2,400 |
| Assistant with access to user data and a few tools | 3 to 4 | $3,600 to $4,800 |
| Agent that can take actions across several systems | 5 to 8 | $6,000 to $9,600 |
These are the sizes from our AI testing service page, priced at the day rate. Your own quote comes after a free scoping call of about 30 minutes, and it is a fixed number, so a test that turns up twenty findings costs the same as one that turns up two.
Why there is a two-day minimum
Attacks on an AI feature are conversations, not single requests. Getting a model to reveal its instructions or another user’s document usually takes many turns and several reworded attempts. Indirect prompt injection means planting text in a document, a web page or an email and waiting for the feature to read it, which takes a setup and a wait. One day is enough to find the obvious problems. Two is the least it takes to try the attacks properly and write them up so your developers can reproduce each one.
What moves the number
Three things decide how many days an AI test needs, and we work them out with you on the scoping call.
What the feature can do. A chatbot that only answers from your help docs is the smallest job. Once the feature can read a user’s data, the question becomes whether it can be talked into reading someone else’s, and every data source it reaches gets tested. Once it can take actions, such as sending email, changing records or calling other systems, every tool it can call is a boundary to test on its own.
How many ways text gets in. The chat box is one route. Uploaded documents, retrieved web pages, emails, support tickets and other users’ content are each another way for an attacker’s instructions to reach the model, and each one is tested.
How much access you give us. The system prompt, a description of what the model is connected to, and test accounts for each role let us spend the days on attacks rather than on working out how the feature is built. Testing blind is possible, and it takes longer.
The model provider does not change the price. OpenAI, Anthropic, Google, open-source or fine-tuned, the testing targets your application around the model, because that is where the risk is.
What is in the price
You are paying for tester time and the report. The test covers direct and indirect prompt injection, leaking of the system prompt, other users’ data or connected documents, misuse of the tools the model is allowed to call, unsafe handling of model output in your app, access control in retrieval, and cost and abuse controls such as rate limits and runaway agent loops. It covers the parts of the OWASP Top 10 for LLM Applications that apply to a running product, and findings can be tagged against the list if your auditor or customer asks.
The report has a summary for the customers and investors who ask about AI risk, technical findings for the people building the feature, and example prompts that reproduce each finding alongside a practical fix. It arrives within five business days of the last testing day, followed by a call to go through it with your team. Once you have fixed things, the retest and an updated report are free.
Does the AI feature need its own test?
Usually, yes. A web application test looks for the problems web apps have: broken access control, injection into databases, weak authentication. It does not try to talk your chatbot into leaking documents or your agent into misusing a tool, because those problems come from what you connected the model to, and testing them is a different exercise. Customer security questionnaires have started asking whether the last penetration test covered the AI feature, and a web app report on its own does not answer that question.
If you are already booking a web app test, the AI feature can be added as extra days on the same job and reported in the same document.
Penetration test or automated AI scan
Automated red-teaming tools, some free and some sold from about $1,500 a run, send a library of known jailbreaks and injection prompts at your chat endpoint and report which ones got through. They are worth running, in the same way a vulnerability scanner is worth running. What they cannot do is know what your feature is connected to, so they cannot tell that it just read another tenant’s documents or that a tool it called did something it should not have. That takes a person who understands your product, and it is what the days are for. Penetration test vs. vulnerability scan covers the same difference for ordinary apps.
Getting a number for your feature
For a ballpark with no call, describe what you’ve built and you’ll have a range by email within one business day. For a fixed quote, tell us what the feature does and we’ll come back with one after a short call. The pricing page has the day rate and more examples, and how much a penetration test costs covers web, mobile and API testing.