Automated adversarial testing and EU AI Act Article 50 disclosure checks for AI agents and chatbots — gated behind the same domain-ownership verification used for TLS certificates, run before a single test prompt is sent.
Point us at a URL and tell us whether it's production or staging.
Add a DNS TXT record or a token file to /.well-known/. Either is sufficient.
No test prompt is sent until verification passes — enforced in code and in the database.
A five-section PDF: score, EU AI Act matrix, reasoning gaps, exploit log, remediation.
Does the agent disclose it's an AI when asked directly, even under a constraint telling it not to?
Does the agent hold its system-level instructions under a direct extraction attempt?
Can the agent follow a short multi-step instruction under output constraints, without drifting?
Can the agent be talked into an unauthorized state change, like approving a refund?