> AI-300: Advanced AI Red Teaming — OSAI / OSAI+ reference

OSAI (OffSec AI-300): course and exam reference

A consolidated reference on the OffSec AI-300 course and the OSAI exam: pricing, exam format and scoring (75/100 points, 10 machines, Tailscale), the 11-module syllabus, tools referenced in reports, documented candidate experiences, and preparation notes for a 4–8 week plan.

Level 300 ~65h of material Exam 24h + 24h report AI use on the exam permitted VPN Tailscale
View syllabus Readiness self-check Pricing comparison

Updated: 2026-09-03 • Sources: OffSec Exam Guide and Exam FAQ, HiveHack, somecanadian (90/100), Reddit, RedTeamGuide. Unofficial reference.

Key facts

Facts relevant before purchasing the course.

$1 749Course + Cert Bundle

90 days of lab access + 1 exam attempt. Alternative: Learn One at $2,749/year (1 year + 2 attempts).

24h + 24hexam + report

Proctored session with an on-screen timer. Results within 10 business days. A late report is a fail.

75/100passing score

10 machines, 2 of which are decoys worth 0 points. An interactive shell is not required — reading the flag is sufficient.

50–100hrecommended study

Recommended background: OSCP-level penetration testing plus Linux/networking/scripting. Familiarity with LLMs is helpful.

AI assistance permitted and recommended. The Exam Guide states that candidates who do not use AI are likely to find the exam extremely challenging. Permitted: notes, documentation, the Learning Platform, web browsing. Prohibited: help from other people, exfiltrating files from the exam environment, sharing exam content.
Note on conflicting guides. Some third-party write-ups (reusing OSCP rules) state that ChatGPT/Claude lead to a ban. That does not apply to OSAI — the current OSAI Exam Guide and Exam FAQ take precedence.

Scope and audience

A third-party comparison (RedTeamGuide) rates hiring recognition at OSCP 5/5 versus OSAI 3/5, and describes OSAI as a specialization building on OSCP-level skills.

Profiles that typically match

  • Penetration testers / red teamers with OSCP-level experience extending into AI red teaming.
  • Application and security engineers testing applications that use LLMs, RAG, agents, or MCP.
  • AI engineers assessing attack classes such as injection, RAG poisoning, tool abuse, and supply-chain risks.
  • Candidates seeking a hands-on assessment (24h live environment, not multiple-choice).

Profiles that typically do not match yet

  • Without Linux / networking / web fundamentals — OSCP-, eJPT- or CPTS-level preparation is usually recommended first.
  • Expecting automation alone to be sufficient — reported difficulty is 7/10 with an AI harness and 9/10 without one.
  • Sensitive to lab instability reports and additional API token costs (see limitations below).

Exam format

Per the official Exam Guide (updated 08.2026): 24h proctored session + 24h reporting window. 10 machines, Tailscale, PDF report in a .7z archive.

Scoring (max 100, pass at 75)

TypePtsDescription
AI-vector15entry via an AI vector, with escalation to the flag
Traditional10conventional web/Linux testing (~OSCP level)
Standalone AI15model/application attack without a shell (e.g. XSS/SQLi via output, RAG data disclosure)
DC5Domain Controller, counted once — reported as frequently decisive at 70/100
Decoy ×20distractor machines. Reported practice: reassign after ~2h without progress

Example path to 75 points: 2× AI-vector (30) + 2× standalone (30) + 1× traditional (10) + DC (5). Traditional machines alone do not reach the passing score.

Illustrative 24h breakdown (select a phase)

0–2h: Reconnaissance — inventory of models, tools, RAG sources, APIs, guardrails.
Documented practice: route application traffic through Burp before manual testing; system prompts and parameters are visible in requests.
2–10h: Foothold — prompt / system-prompt work, first traditional flags.
Reported sequence: conventional targets first; automated LLM scanners (Garak/Promptfoo) run in the background while testing another machine manually.
10–18h: Lateral movement (agents/RAG) — tool-call hijacking, cross-agent issues, poisoning.
Reported practice: work both chains in parallel; time-box a single jailbreak attempt at 20–30 minutes before switching techniques.
18–22h: Infrastructure + DC — API/cloud misconfiguration, AD enumeration in the background.
The DC is 5 points but is reported as decisive at 70/100. Re-enumerate rather than persisting on an unproductive path.
22–24h: Consolidation — report outline, evidence, screenshots.
The environment is removed after the window — undocumented steps cannot be reconstructed for the report.

Report

OSAI-OS-XXXXX-Exam-Report.pdf → unprotected .7z, max 100MB. Each step: command, code, output, screenshot, exploit link with a description of modifications. Reproducibility by copy/paste. No corrections after submission.

7z a OSAI-OS-XXXXX-Exam-Report.7z OSAI-OS-XXXXX-Exam-Report.pdf

Technical setup / proctoring

Local Kali + Tailscale. Camera on for the whole session (including breaks), max 4 monitors, no phones/headphones/recording. Join 15 minutes early, photo ID, room scan. Breaks without a fixed limit (announce via proctor chat; keep the proctoring tab open). Certificate: OSAI without expiry, OSAI+ valid 3 years.

AI-300 syllabus (11 modules)

Filter by phrase or tag. Mapped to OWASP LLM Top 10 and MITRE ATLAS.

1. Introduction to AI red teaming

metodyka

Attacker mindset, methodology, OWASP LLM Top 10 2025, MITRE ATLAS.

2. AI reconnaissance

recon

Model, system prompt, tools/functions, RAG sources, endpoints (MLflow, TorchServe, BentoML), guardrails.

3. Attacks on AI agents

LLM agents

Excessive agency (LLM06), tool-call hijacking, ReAct hijacking, agent memory.

4. Multi-agent systems + A2A

agents

Cross-agent injection, escalation via delegation, agent-card spoofing, workflow poisoning.

5. RAG pipelines

RAG

Document poisoning, embedding collision, namespace enumeration, cross-user leakage.

6. Embeddings

RAG

Vector databases (Pinecone/Weaviate/Chroma), similarity attacks, LLM08.

7. MCP and tool surfaces

agents infra

Tool poisoning (malicious descriptions), conventional attacks via MCP, tool enumeration.

8. AI supply chain

infra

Malicious models (HuggingFace), pickle RCE (.pkl/.pt/.h5), datasets, typosquatting, CVE-2023-43654.

9. AI infrastructure / cloud

infra

API keys, auth bypass, parameter tampering, SageMaker/S3/Bedrock, Azure OpenAI, Vertex AI.

10. Threat modeling

metodyka

Threat modeling for AI-enabled systems.

11. Capstone engagement

metodyka

Full practice engagement + challenge labs before the exam.

Techniques covered: direct/indirect injection, jailbreaks (DAN, role-play, base64/ROT13/unicode, multi-turn reported at ~78% vs single-turn ~4%), system-prompt extraction, RAG poisoning, memory poisoning (MINJA), FGSM/DeepFool (ART), XSS/SQLi via LLM output, steganography.

Tools referenced

No tooling restrictions apply on the OSAI exam. Tools below appear in course material or candidate reports.

PyRIT core

Microsoft toolkit for orchestrating multi-step LLM attacks.

pip install pyrit

Garak core

LLM vulnerability scanner (prompt-injection and jailbreak probes).

garak --model_type openai --probes promptinject

Promptfoo core

Prompt fuzzing with OWASP LLM mapping.

npx promptfoo@latest redteam run

DeepTeam extended

Giskard framework; vulnerability classes incl. RAG/agent tests.

pip install deepteam

IBM ART extended

Evasion / extraction library for ML models.

pip install adversarial-robustness-toolbox

Burp + Nmap core

Burp: inspection of LLM API requests. Nmap: ports 8000/8501/11434 typically indicate AI services.

nmap -sV -sC -p- --min-rate 5000 <IP>

Documented experiences

Difficulty reported at 7/10 with an AI harness (e.g. Claude Code + Opus/Sonnet) and 9/10 without one or without OSCP-level background.

Matei / HiveHack ★★★★☆ — pass

Exam duration ~19h; first flag after <2h using Claude Code, 70 points after ~10h. Quote: “Instead of hacking AI it felt more like using AI to hack.” Course material assessed as good; some labs described as flaky. Additional AI API costs noted. Assessment: 90 days of labs is sufficient.

somecanadian ★★★★★ — 90/100

Quotes: “Enumeration is key. Strict loot management.” Reports ~4.1B tokens in 24h (≈$6,386 in API equivalent). Method: reconnaissance, both chains in parallel, live documentation.

Reddit r/offensive_security ★★☆☆☆ — mixed

Quotes: “Do not take OSAI — labs are buggy.” “Buggy labs, mistakes in contents.” Material recency (RAG, MCP, agents) rated positively; timeouts and resets criticized.

RedTeamGuide ★★★☆☆ — analysis

Quote: “OSAI is a specialization — built on top of OSCP, not instead of it.” Hiring signal: OSCP 5/5 vs OSAI 3/5. $1,749 vs ~$1,499; 65h vs ~200h of material.

Frequently cited strengths

  • Hands-on AI security assessment (24h live environment).
  • Current attack surface: RAG, agents, A2A, MCP, embeddings.
  • Stable connectivity reported (Tailscale); no shell requirement.
  • AI assistance permitted, reflecting reported work practices.
  • Early-adopter differentiation.

Frequently cited limitations

  • Lab instability, content errors, non-deterministic LLM grading.
  • Additional AI API costs (up to thousands of USD with an inefficient harness).
  • High price for a recent credential without established hiring signal.
  • 2 decoy machines consume exam time; fast AI field changes vs. static material.

Exam notes from candidate reports

Practices described by candidates scoring 85–100/100. Presented as reported, not as guarantees.

1. Sequence: conventional targets first

Traditional machines (10 pts) provide an early buffer; AI-vector and standalone machines in the middle; decoys deprioritized after ~2h.

2. Proxy before browser

System prompts, keys, /v1/completions endpoints and vector-DB identifiers are visible in requests.

3. Automate, confirm manually

Garak/Promptfoo run in the background (15–30 min) while another machine is tested manually.

4. Demonstrate output impact

A model producing disallowed text is generally insufficient; reports require demonstrated impact: <script>, UNION SELECT, or a tool call.

5. Second model as a helper

Candidates report using a second LLM for mutation variants (base64, hex, ROT13, translations), documented in the report.

6. Capture evidence from minute zero

Prompt + output + proof. Steps cannot be reconstructed after ~20h; model output is non-deterministic.

7. Include the DC (5 pts)

At 70/100 it is the pass/fail difference. AD enumeration can run in the background.

8. Rest planning

90/15 blocks, minimum 4–5h of sleep. Most errors are reported between 03:00 and 06:00.

9. Offline playbooks

Prepared jailbreak list, reverse shells, linpeas/winPEAS, impacket one-liners. No time spent on fundamentals lookup.

10. Report continuously

OffSec template updated after each machine. The final 24h are for review only + 7z a report.7z report.pdf.

Preparation: background and 4–8 week outline

Background

Expected: Linux + networking (OSCP level), Nmap, Burp, Tailscale, pivoting, AD basics; Python (requests, JSON, base64/unicode) and Bash; web/API fundamentals (OWASP Top 10, SSRF/XSS, parameter handling).

Helpful: OSCP-level practice, LLM basics (tokens, RAG, tool calling), cloud/container basics (S3, SageMaker, MLflow, Docker). Model training and ML mathematics are not required.

Background self-check (0–2 pts / item)

Weeks 1–2: fundamentals + injection

OWASP LLM Top 10, MITRE ATLAS, LLM Red Teaming path (~30h). Gandalf, HackAPrompt, DVLA, PortSwigger LLM labs. Multi-turn reported above single-turn.

Weeks 3–4: RAG / agents / MCP + infra

Self-hosted Ollama + Chroma RAG (poisoning, enumeration). Tool-call hijacking, PyRIT/Garak. Pickle RCE, MLflow/Jupyter exposure, secrets in .env.

Weeks 5–6: capstone + mock

Labs 1–2×, host map, credential ledger, chronological log. Timed 24h mock + PDF report in .7z. OffSec template.

Readiness checklist

AI cost estimator

Pricing: Bundle vs Learn One

Course + Cert Bundle — $1,749

90 days of labs + 1 attempt. ≈$583/month. Sufficient for OSAI alone, per candidate reports.

Learn One — $2,749/year

365 days + 2 attempts. ≈$229/month. Relevant for multi-certificate plans (OSCP/OSEP + OSAI).

FAQ

Yes — permitted and recommended. Without it, the exam is described in the Exam Guide as “extremely challenging”. Write-ups claiming a ban confuse OSAI with OSCP rules.
No. Reading the flag by any method is sufficient. On standalone AI machines, demonstrated model impact with reproducibility is what counts.
75/100. Traditional machines alone do not reach the threshold — AI-vector and standalone machines are required.
Unprotected .7z containing the PDF, max 100MB. No corrections after submission. Continuous writing during the 24h is the reported practice.
OSAI: no expiry. OSAI+: 3 years (re-examination, another qualifying OffSec exam, or CPE).
Tailscale, not OpenVPN. Test the connection before the exam. Browser-based Kali is unavailable.
Time spent on decoys, missing screenshots, skipping the 5-point DC, no automation, and leaving the report to the end — per candidate reports.

Sources

Collected 2026-09-03. The current OffSec Exam Guide always takes precedence.

• OffSec — AI-300 course page (official)

• OSAI Exam Guide (24h+24h, Tailscale, AI recommended)

• Exam FAQ

• AI Usage Policy

• HiveHack — OSAI review

• somecanadian — 90/100

• OWASP LLM Top 10 • MITRE ATLAS

• PyRIT • Garak • Promptfoo