AI endpoint security testing, reported only with proof.
AI endpoints get their own tests. NightVision tests whether an endpoint backed by a language model can be steered into calling out to an attacker or reading your cloud metadata service, and reports those only with proof. It also flags endpoints it recognizes as model-backed.
AI endpoint security testing checks the parts of a web app that are backed by a language model: a support chat, a summarizer, a search box whose model can fetch URLs or call tools. If the model can be steered into making server-side requests, an attacker can use it the way they would use any server-side request forgery bug. NightVision tests for two outcomes, a callback to an attacker's server and a read of your cloud metadata service, and reports either one only with proof.
An AI feature is still an endpoint.
A model-backed endpoint takes input over HTTP like any other route. The difference is what happens next: if the model can fetch a URL or call a tool, the request it makes runs from your server, inside your network, with whatever access your server has. That is LLM SSRF. It behaves like any server-side request forgery bug: the attacker never touches your infrastructure directly, because the model does it for them.
Two tests, both proven
Calls out to an attacker
The test gives the endpoint a one-time callback address. A finding needs that callback to arrive, so a model that only says it fetched something is not reported. Why callbacks can arrive late.
Proof: the callback arrives at the one-time address.
Reads your cloud metadata
A finding needs proof that the response came from the cloud metadata service itself, not text the model produced. How the cloud metadata check works.
Proof: the response came from the metadata service itself.
Why a model's reply is not evidence.
Language models are non-deterministic and eager to agree: ask one whether it fetched a URL and it may say yes when it did not. NightVision reports an AI endpoint finding only when something outside the model confirms it, so each finding is one your team can reproduce and fix.
Model-backed endpoints are flagged.
Alongside the two tests, the scan marks the endpoints it recognizes as model-backed, so your team can see where AI features sit in the app and which routes pass input to a model. Where you share a repository, source intelligence also marks the routes that call a model in the generated spec, across Python, C#, Go, JavaScript, TypeScript, Ruby and PHP.
Part of your DAST program.
AI endpoint tests are part of NightVision's standard DAST check set, so they run against the app you already test: recorded logins for the authenticated parts of the app, scans started from your pipeline or your coding agent, and a rescan to prove each fix.
AI endpoint testing questions, answered.
What is AI endpoint security testing?
Testing the parts of an application that are backed by a language model for what an attacker could make the model do. NightVision tests whether a model-backed endpoint can be steered into calling an attacker's server or reading your cloud metadata service, and reports a finding only with proof.
Can an LLM endpoint cause SSRF?
Yes. If a model can fetch URLs or call tools, an attacker can steer it into making requests from your server, including to internal services and the cloud metadata service. That is server-side request forgery carried out through the model.
How does NightVision confirm a finding?
With evidence from outside the model: the callback has to arrive, or the response has to come from the metadata service itself. A model saying it did something is not enough.
Ask for proof, not the model's word.
See whether your AI endpoints can be steered into calling an attacker or reading your cloud metadata, with evidence your team can reproduce. Part of NightVision web app DAST.