> For the complete documentation index, see [llms.txt](https://red.0xbad53c.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://red.0xbad53c.com/training-reviews/offensive-security/osai.md).
# OSAI
OffSec AI Red Teamer
After completing the [OSCE3](https://www.offsec.com/certificates/osce3/) journey in 2022, I genuinely thought I was done sitting through 24-hour+ OffSec exams. Since then, I focused mainly on following specialized red team courses, lurking in communities and delivering my own training, [Operational Purple Teaming For Defenders](https://red.0xbad53c.com/training/operational-purple-teaming-for-defenders).
But the IT industry has a way of keeping us sharp. We've all seen the rise of Artificial Intelligence (AI) over the past couple of years. Its possibilities both amazing and frightening. I've been lucky enough to be part of the DXC Strikeforce red team at [DXC](https://dxc.com). Our company builds and integrate AI systems at various layers of the enterprise stack.
We get to benefit from that, testing complex enterprise implementations. This enabled our team to experiment quite a bit and experience rather than just talk about AI capabilities. One one hand, we have an incredible new attack surface of AI-enabled, privileged applications (or entities) that can be socially engineered into going beyond their intended scope. On the other hand, the technology can be a very powerful tool in the hands of a capable cybersecurity team to help secure customers. New challenges await around every corner.
So there I was again: one realistic AI-enabled enterprise environment to compromise, 24 hours on the clock, and a whole new attack surface to dive in. I passed on my first attempt, and this is my honest review of the course and the exam and course.
OSAI Badge
In this course review, I will cover the course contents and the tips and tricks from my personal experience.
#### Overview
The main focus area of OSAI is offensive testing of AI-integrated systems, with topics like:
* Reconnaissance of AI targets (fingerprinting models, RAG pipelines, agent frameworks, MCP/A2A endpoints);
* Attacking single AI agents (direct and indirect prompt injection, memory poisoning, tool manipulation);
* Attacking multi-agent systems (agent impersonation, message tampering, task injection into shared queues);
* RAG pipeline exploitation (ingestion poisoning, retrieval hijacking, embedding attacks);
* MCP tool surfaces (tool description poisoning, tool shadowing, parameter coercion);
* AI supply chain attacks (datasets, model weights, LoRA adapters, CI/CD pipelines);
* Infrastructure-layer attacks (cloud ML services, model servers, Kubernetes orchestration);
* Adversarial machine learning (model extraction, evasion);
* Guardrail and AI-firewall bypasses;
* Threat modeling for AI environments (mapping to MITRE ATLAS, trust-zone diagramming);
You can find the syllabus at the following link:
The course follows a deliberate progression. It starts with foundations and reconnaissance, moves through the "AI-layer" attacks (single agent, multi-agent, RAG, MCP, supply chain), pivots to the infrastructure layer (cloud ML, model servers, Kubernetes, adversarial ML), and finally pulls everything together in a capstone red team engagement against a fictitious enterprise called Megacorphe (OSCP nostalgia). Everything culminates in a 24-hour exam that requires the same skill set as the capstone.
What made OSAI intimidating was not the individual techniques, because there is plenty of prompt-injection content for free online, but the fact that it treats AI as one layer of an enterprise environment. You are not poking at a chatbot in isolation. You are chaining an AI-specific foothold into classic internal network exploitation, lateral movement, and Active Directory, and doing it while orchestrating your own offensive AI tooling. That combination was new to me, and it is exactly where the exam earns its difficulty.
#### Planning
I've got to be honest here. I could not free up the same amount of time for AI-300 as the courses leading up to OSCE3. Though, I have been testing agentic applications since end of 2025, so I went in with a lot of the underlying intuition already in place and treated the course more as a way to systematize what I knew than to learn a field from scratch.
As always, one of the first things I did was book the exam date. I recommend this for two reasons that have held true across every OffSec exam I've taken:
1. Exam spots fill up quickly. Either plan ahead if you want a specific start hour, or stay flexible and keep checking for cancellations. I'd recommend the former;
2. A booked date gives you an end point to work towards and just enough pressure to actually commit your hours;
My honest advice here is the same as always: make a realistic plan and remember that life happens. If AI red teaming is new to you, budget more time than you think. The course covers a lot of ground and the exam expects you to move fluently between AI-specific and traditional attack paths, with some additional stealth requirements in mind.
Additional tip: Don't be like me and conclude that you forgot to [download the course material](https://help.offsec.com/hc/en-us/articles/4406821074196-How-to-Download-Course-Materials-from-the-Learning-Library) in the week before your exam. In my defense, the download was not working at the time I tried! Luckily, I was able to e-mail OffSec support and they had my back. It gives me peace of mind, knowing I can grep through the course PDF when I run out of inspiration during the exam.
#### My Course Experience
As with every OffSec course, people of all backgrounds start this one and some will find it much harder than others. The syllabus itself is explicit that it assumes classic penetration testing skills at the OSCP/PEN-200 level and then extends them to AI-specific targets. This is *not* a beginner AI course. Here is my relevant background before starting:
* Nine years of web application pentesting, infrastructure testing, and red team operations;
* I hold [OSCE3](https://red.0xbad53c.com/training-reviews/offensive-security/osed) (OSWE + OSEP + OSED);
* I've been testing agentic applications, so prompt injection and tool abuse were already part of my toolkit;
* I have spent a some time building and breaking LLM-backed systems in my own home lab on an RTX 3090. This is great if you want to familiarize yourself with the basics;
* I use Claude Code intensively (almost daily since Opus 4.5) and GitHub Copilot, so driving AI tooling felt natural. **This turned out to be one of the most important skills**;
In every module the concepts are explained thoroughly, and for the classic red team portions the course knowledge and labs are more than sufficient. The AI-specific material is well grounded in how these systems actually fail in production rather than in toy demos, which I appreciated.
Where I felt the course was lacking a bit was in its early pacing. The content starts slow and leans heavily on low-level `curl` interactions to hammer home how each layer works. That is great for understanding, but on a real engagement, you do not want to be hand-crafting individual `curl` requests against a dozen endpoints. I would have loved to see each chapter end with an "advanced" step that has you fold the technique into your own agentic harness or vibe-code your own tool, rather than leaving that as an exercise for the reader. If you come from a strong offensive background, expect to do that consolidation work yourself #TryHarder.
To fill the theory gaps, there is a wealth of free, high-quality material out there. Unlike most areas of security, the state of the art in AI red teaming largely lives in freely available academic papers. The [OWASP Top 10 for LLM Applications](https://genai.owasp.org/) is a good jumping-off point, and platforms like [Lakera's Gandalf](https://gandalf.lakera.ai/) (now AgentBreaker) and Microsoft's AI red teaming playground are excellent for building intuition on prompt injection and guardrail bypassing.
Upon completion, my key takeaways from this course were:
* Learn to enumerate the full AI stack the way an attacker does: model identity, RAG parameters, agent tool schemas, MCP/A2A endpoints. On real engagements, the interesting attack surface is almost always in the actions that are delegated to the LLM (tool calls);
* Demonstrate the impact of prompt injection. A successful injection is only valuable if it leads to a tool call, a credential, or a pivot;
* Understand how guardrails and AI firewalls actually work (they are pattern-matchers and classifiers with blind spots) so you can reason about bypasses generically rather than memorizing payloads. You learn how to do this manually, but it would have been great to automate this partially with the use of an LLM. I often reach to an AI to identify working guardrail bypasses against another model. Doing this manually often takes a long time.
* Treat authorization as a first-class target. I see a lot of authorization issues in real AI deployments. Agents and tools run with far more privilege than the user driving them. Sometimes we even observe the authorization being offloaded to the LLM, so it just takes some persuasion to convince the AI it is allowed to perform privileged actions;
* Build and operate your own offensive AI tooling. Orchestrating multiple offensive agents at once is genuinely powerful, but it is a skill in itself;
* It was very cool to see the AI attack vectors linked to traditional exploitation and lateral movement paths.
From a red team perspective, I think this course is a real added value and I would very much recommend it. If you're an offensive security professional watching AI get deployed everywhere and wondering where the field is heading, this is the direction.
#### Community
You are not alone in this one either. There is an active [OffSec Discord community](https://discord.gg/offsec) with dedicated `#ai-300` module and challenge-lab channels where people going through the same material trade tips and nudge each other in the right direction, without handing over solutions. Definitely check it out.
Because OSAI is a newer certification, a lot of the most useful preparation material comes from the handful of people who sat it early and wrote up their approach. I leaned on several of these and would recommend all of them:
* **SomeCanadian**'s [OSAI review](https://somecanadian.medium.com/ai-300-osai-review-my-experience-with-offsecs-ai-red-teaming-certification-13c4bd719c0a) is a detailed account of the exam experience. I took his tip on strict loot management to heart. Make sure to track every piece of information you get your hands on.
* **ph03n1x** wrote an excellent [black-box preparation writeup](https://ph03n1x.net/passing-osai-blackbox-how-i-prepared-for-offsec-ai-red-team-exam/). His advice on disciplined evidence collection during testing and on planning a real sleep break in the middle of the exam is spot on. During the exam, you are often time-pressured and busy controlling multiple AI agents working on separate tasks. Some may try to drift off to different work or find things you need to inspect more closely. Ensure everything gets logged in detail. You will need this during reporting!
* **Zamrax**'s [osai-exam-copilot](https://github.com/Zamrax/osai-exam-copilot) is a clean toolkit of operating instructions, ledger templates, and report tooling. It's a great skeleton to adapt. Give it a star. I combined some elements of this with other knowledge to write one, consolidated instructions file.
* Eliahhango's [Jailbreaking Master Guide OSAI notes](https://github.com/Eliahhango/Jailbreaking-Master-Guide/blob/master/OSAI.md) are a handy reference for prompt-injection and jailbreak patterns to have in your back pocket;
Note: do not use any of these scripts or workflows blindly. Try to understand them and implement your own variation. That understanding is exactly what the exam tests.
#### Custom Tools
Automate all the things. Really, you should. This is even more true for OSAI than for the binary-exploitation exams, because the sheer volume of data flying at you is enormous: model responses, tool outputs, agent logs, network enumeration. Processing it under exam pressure is a skill in itself.
The course walks you through reconnaissance one `curl` at a time. That's the right way to learn it, but it's a terrible way to operate, so I wrapped the whole recon methodology into a small tool, focused on giving me an HTML report with necessary information whenever encountering an AI-enabled target.
Don't be like me. it was a horrible, vibe-coded mess focused on a human interpreting the results. Instead, code something your AI can use to get better results quicker!
**An agentic operator harness**
OffSec explicitly permits and encourages AI tooling on the OSAI exam. I built my own agentic harness: a mix of everything in the community toolkits plus my own day-job experience. It was not perfect or production-ready. For instance, the AI had access to execute direct bash commands rather than wrapping some things in restricted MCP servers. I felt that this flexibility was needed for the exam. So my agents acted as persistent red team operators with direct shell access, a durable file-based state ledger, and a fleet of focused subagents for parallel work across both attack chains.
A few hard-won lessons from operating it under exam conditions:
* **Give each agent a durable, file-based memory and a strict role.** My operator instructions had every session start by re-reading the target and credential ledgers and the current report state to understand where we were and tthen continue from durable state rather than reconstructing context from chat history. This is what let me run many sessions over \~24 hours without losing the thread;
* **Agent drift is real.** Left unattended, longer-running agents wander off and start attacking things that aren't their assignment. When you instruct them to focus on a target in attack chain 1, they may give up after a while and reason that you want them to select some other target. However, meanwhile you already compromised this other target and they just waste tokens going in circles. Keeping every agent focused is a constant, active effort. Short, well-scoped tasks with clear success and failure indicators beat one giant "go compromise everything" prompt every time;
* **You must build it yourself to trust it.** If you want to operate effectively here, you need tooling you built and understand. When an agent chases noise, you have to recognize it instantly, and you can only do that if you know how the harness thinks. Make sure to test your harness in the capstone red team engagement or in the challenge labs;
* **One the exam, use the most capable model.** I made the mistake of trusting a mid-tier model in the beginning, since it was giving me decent results on some targets I had tested it against before the exam. However, on the exam itself, I quickly noticed that it lost focus and gave up earlier during some attacks. Overall, I spent around $300 on tokens during the exam and $250 for the reporting part, after switching to the most capable model.
I'm deliberately keeping this general. The value is in the approach, not in any exam-specific payload. My tools may not be as polished as some of the brilliant stuff others have built, but they got the job done, and building them is where most of my actual learning happened.
#### Other Tips
* Read the exam guide and reporting requirements *before* you start studying, and familiarize yourself with the report format. OSAI wants a professional red team report as a PDF, archived into a password-less `.7z` under 100 MB, with every query included as text and everything reproducible copy/paste style;
* Write your report as you go. This is doubly important on OSAI because you also have to comb through the logs of every AI agent you ran to make sure you captured every attack that actually happened. Your agents did things. You understood what it did. But you need to know exactly what it tried, executed, and cite it in the report;
* I wanted to proxy everything through Burp. The idea was to route every web app-related tool and every exploitation attempt through a single proxy so you have one authoritative record of what hit the target. However, then my AI decided to start several parallel bruteforce attempts, which froze my kali machine and crashed my Burp Suite community edition. HTTP logs gone...
* Do not let AI control [Sliver](https://sliver.sh). Sliver is a fantastic, capable C2 framework, also demonstrated during the course. However, it has happened to me on multiple occasions that and LLM starting connecting to Sliver to list beacons or attempt to execute commands. Every single time, this caused my machine to freeze, lag or become unstable. Yes, also on the exam.
* Ensure your VM has sufficient resources: Disk space will fill up with AI logs, memory and processors are needed for your tools. I had 8 cores and 16GB of RAM, but still experienced issues.
* Practice strict loot management. Track where each credential, token, and artifact was found and everywhere you subsequently tested it. In an environment with multiple chains converging on a shared objective, this bookkeeping is the difference between a clean chain and hours of confusion;
* Take breaks and eat healthy. I took a break every couple of hours. I did not sleep, because staying awake 24 hours was doable. However, you do need to take a step back at regular intervals. If you go the night without sleep, make sure to eat another meal to keep going! I always prep a meal with lots of vegetables that I can heat up and eat any time of day.
* Validate everything your AI produces. An assistant can generate a fluent, technically convincing explanation. Every finding still needs an operator who knows what a real attack path looks like. Especially during reporting, the LLM does not always give you the exact commands executed. Sometimes I got hallucinated output which looked like it could work;
#### Exam
The OSAI exam is a hands-on, 24-hour practical AI red team engagement, followed by an additional 24 hours to write and submit your report.
The publicly-described shape of the exam is: a realistic AI-enabled enterprise you need to compromise, scored out of 100 points, with 75 required to pass. Points come from a mix of AI-vector and traditional-vector objectives, so you genuinely cannot pass on AI skills alone. You need the classic internal exploitation, lateral movement, and Active Directory tradecraft too. The report is scored alongside the technical result: findings only count if they're documented well enough for a skilled attacker to reproduce them.
As with every OffSec exam, I spent the final days before it building a playbook so I wouldn't waste brainpower or precious exam-minutes on typos or setup. Mine had three parts:
* **Pre-exam preparation:** proctoring/support contact details; a pre-built workspace with target and credential ledgers, note templates, and report skeleton already in place; a setup script to stand up the folder structure, my recon harness, and my agentic operator harness with a single command; and the exact steps to connect the VPN/Tailscale and lay out my screens the way I'd practiced;
* **Main playbook:** copy-paste command references from the course; recon and enumeration workflows; a checklist of AI-specific techniques to try per layer (agent, RAG, MCP, infra); and a "things to try when stuck" list; Every command I do not need to waste brainpower on during the exam, goes on the list! I even practice what will be on which screen (kali machine, report, notes, browser) so I can use muscle memory!
* **Post-exam tasks:** the procedure to comb every agent log for captured attacks, and to build, verify, and upload the `.7z` report. After 24 hours without sleep + 24 hours of report-writing and perfecting, you do not want to think about this stuff.
I started at mid-morning and, as with all these exams, it was intense. It was a very cool experience to be orchestrating multiple offensive agents across two attack chains simultaneously, with an enormous amount of data to triage. I finished comfortably above the passing threshold.
The report was its own challenge, and I want to stress this because it caught me a little off guard: beyond documenting findings, you have to reconstruct what your agent did from their logs. When you run a fleet of autonomous tools for a day, "what actually happened" is not fully in your head in technical details. This was a very different experience compared to other OffSec exams, where you identify, write and perfect every exploitation step yourself. Budget enough time for this.
#### Conclusion
OffSec put together an excellent, timely course. The content is exactly what the industry needs right now, and it was rewarding to take my day-job experience testing AI systems and put it to work in OffSec's exam environment while still walking away having learned a lot.
Here's my biggest takeaway: there's a growing narrative that AI has become so capable it can simply automate our job. This course and exam proved the opposite to me. The agents didn't replace my expertise, they amplified it. Every finding still required an operator who knows what a real attack path looks like, who can spot when an agent is chasing noise, and who can steer the operation toward what actually matters. AI raises the ceiling for skilled practitioners; it doesn't remove the need for them. If anything, the people who master orchestrating these tools will be more valuable, not less.
I genuinely thought OSCE3 was the end of my 24-hour OffSec exams. I'm glad I was wrong. If you're an offensive security professional and AI is showing up everywhere in your engagements, this is the direction the field is heading. Highly recommended. #TryHarder.
#### Other Reviews
*
*
*
