A rule the bot ignores
You state a boundary. If the reply crosses it, the report keeps that reply as evidence and the change to make.
AI Security
Check a live chatbot
Point Vulnify at a chatbot you can already open. You get the reply, what it shows, and what to change. A quiet result means these checks did not show a problem.
Coverage
What is included
One address per run. A direct chat address or the chat box on a page. No login bypass, and no real email, charge, or record change.
Name the bot
Use a direct address that returns JSON or streamed text, or the page that already contains the chat box.
Run the checks
Baseline is a short run. Standard covers more cases. Both stay on the address you named.
Read the report
You get the reply, what it shows, and what to change. Run the same check again after a fix.
A secret in the reply
A planted secret is optional. If you add one, a reply that contains it or a hidden marker is recorded as confirmed.
An action the bot tries
Email, payment, and data-change checks stop before a real person, card, or record is touched.
How to
How to check a chatbot
Use a bot you can already open. Confirm you are allowed to test that address. Read the report, then run the same check after a fix.
Open AI Security
Sign in and open AI Security from the dashboard. The public page explains the check. The signed-in page is where you add a bot and start a run.
Add an address you can already open
Paste a direct chat address, or the website page that holds the chat box. A public model chat and a client support bot both fit, when you are allowed to test that exact address. Vulnify does not bypass a login.
Confirm the test and pick a profile
Confirm you are allowed to test that address. Baseline uses 12 credits. Standard uses 24 credits. A longer profile stays hidden until it is turned on.
Read the result, then run it again
The report lists the scope, the method, the reply, the fix, and how to repeat the check. A quiet result says no violation was observed in these tests. It does not say the bot is safe.
Step-by-step notes live in AI Security documentation and AI Security help.
Report
What the report says
Each row is a result of these tests. Severity is separate from how sure the check is.
Confirmed
The reply contained the planted secret or marker, or the bot tried an email, payment, or data change and the call was caught or blocked.
Likely
The bot says it can email, take payment, or change data, or a tool list shows that wiring. A claim can be a bluff. Likely is not the same as confirmed.
No violation observed
These tests did not show a problem. That sentence is the quiet result. It is not a certificate, and it does not cover every trick.
Actions
Email, payment, and live data
You still learn whether the bot can reach those systems. The check does not use them on real people.
Confirmed
The attempt was caught, or a Vulnify sink received it. A real charge is never placed.
Declared
The tool list shows email, payment, or a data change is wired up, even if this run did not fire it.
Claimed
The bot says it can do the thing. That is recorded as likely, because the reply may be a bluff.
Payment is confirmed only from a blocked call, a declared payment tool, or an endpoint you marked as a test. A real charge is never placed.
Credits
What a run costs
A live target is a flat credit charge. A practice fixture on your own machine is not charged.
Baseline
12
A short run. About 15 requests and a 90-second cap.
Standard
24
A wider run. About 40 requests and a 3-minute cap.
Credits come back when a run is canceled or fails before the first completed check, or when every check is unsupported. A finished run with no violation observed is not refunded. See credit pricing.
Examples
Worked examples
How the same check looks for an agency, a planted secret, and a payment claim.
An agency checks a client bot
The agency can already open the client’s support chat. They add that page or the direct address, confirm they are allowed to test it, and run Standard.
A planted secret comes back
The team adds one test secret the bot should never repeat. The reply includes it.
The bot offers to take a payment
The reply says it can charge a card, or it calls a payment tool. The call is blocked before a real charge.
Compare
AI Security versus the other Vulnify checks
Pick the product that matches the question you need answered.
| Product | Question | Billing | Best for |
|---|---|---|---|
| AI Security | What does this live chatbot reveal? | 12 or 24 credits per run | A bot or model chat you can already open |
| AI Access Watch | Does the server follow published crawler rules? | $9 per origin / month | robots.txt, llms.txt, and agent paths |
| Website Security Scanner | What is exposed on the public site? | Credits or a plan | A website snapshot, not a chat transcript |
| Penetration Test | What does a verified automated test show? | $297 or $497 | A web app engagement and a retest |
FAQ
AI Security FAQ
Which bots fit, what a quiet result means, and how credits come back.
It points at a live chatbot or model chat you can already open. You get the reply, what that reply shows, and what to change. It is a credit-based check, not a daily monitor and not a website scan.
Check a chatbot you can already open
Add the address, confirm you are allowed to test it, and read the reply with the fix.