PASS THE OSAI CERT: A Guide Series for OffSec's AI Red Teamer Certification

This is the home page for PASS THE OSAI CERT, our study series for OffSec’s OSAI (OffSec AI Red Teamer) certification, the practical exam that follows the AI-300 “Advanced AI Red Teaming” course. OSAI is a 24-hour, proctored, open-book exam, and it’s a full red team engagement against an AI-enabled enterprise environment, not an isolated LLM sandbox. You start from a public entry point, pivot into an internal network, and work through recon, exploitation, privilege escalation, and lateral movement across hosts that converge on a Domain Controller, with AI-focused targets (LLM apps, agents, RAG pipelines, and the infrastructure behind them) sitting next to traditional ones. The exam expects you to use AI as part of your own toolkit the whole way through, and you need 75 of 100 points to pass. It rewards people who can think like an attacker about a stack most pentesters have never had to map, without letting the classic network and Active Directory work slip.

We wrote this series for the person staring at that syllabus wondering where to even start. Each module takes one phase of the engagement and turns it into something you can actually practice, with the commands, the signals to look for, and the reasoning behind each one.

Who this is for

You’re comfortable with classic pentesting (think OSCP-level recon, enumeration, and exploitation) and you want to extend that muscle to AI systems: LLM APIs, RAG pipelines, agent frameworks, vector databases, and self-hosted model servers. You don’t need to be a machine-learning engineer. You do need to be willing to learn what these components are, how they talk to each other, and where they leak.

The modules

The series grows one module at a time, following the shape of a real engagement.

Reconnaissance

Before you can exploit an AI system, you have to find it and map it. This module covers the whole recon phase, from understanding the stack to pulling it apart passively and actively.

1. Recon Part 1: Mapping the AI Attack Surface. The anatomy of an AI-enabled system and a recon taxonomy to organize everything that follows.
2. Recon Part 2: Passive Reconnaissance of AI Systems. Fingerprinting the stack from HTTP responses and mining public code and artifacts, all without touching the target adversarially.
3. Recon Part 3: Active Reconnaissance of AI Systems. Service discovery, model fingerprinting, and RAG pipeline mapping with direct probes.

Exploitation: attacking single agents

Once you’ve mapped the system, the agent is the first thing you break. This module takes one agent apart: what it’s made of, and every way untrusted text becomes an instruction it acts on.

1. Agents Part 1: Anatomy and Attack Surface of a Single Agent. The components, the reasoning loop, and a map of every injection channel.
2. Agents Part 2: Direct Prompt Injection. Extracting the system prompt past an output filter, and hijacking the agent’s goal into a tool call you chose.
3. Agents Part 3: Indirect Prompt Injection. The attacks where you never talk to the agent: poisoned documents, concealed web content, and the files a code agent reads on its own.
4. Agents Part 4: Memory Attacks. Making an injection outlive the session by poisoning long-term memory, and reading across sessions and tenants.

Exploitation: multi-agent systems and A2A

Once you can break one agent, the next target is the system of agents around it. Real deployments split work across many agents that coordinate over the Agent-to-Agent (A2A) protocol, which adds a trust boundary teams rarely defend: one agent’s output becoming another agent’s input.

1. Multi-Agent Part 1: Architecture and the A2A Protocol. The coordination patterns, the frameworks that build them, and the A2A messages that wire agents together over the network.
2. Multi-Agent Part 2: Enumerating A2A Workflows. Sweeping the network for agents, reading their Agent Cards, and mapping the graph before you touch it.
3. Multi-Agent Part 3: Attacking A2A Workflows (publishes 26 Oct). Speaking the protocol yourself: bypassing the orchestrator, injecting through every message part type, and turning push notifications into SSRF.
4. Multi-Agent Part 4: Abusing Orchestrated Workflows (publishes 2 Nov). Laundering malicious links into a rendered answer, and steering a SQL agent toward operating-system command execution.
5. Multi-Agent Part 5: Rogue Agents and Identity Spoofing (publishes 9 Nov). Registering an agent the orchestrator will trust, and hijacking a legitimate one through DNS.
6. Multi-Agent Part 6: Indirect Prompt Injection via Data Poisoning (publishes 16 Nov). Planting a payload in the data the agents read, and letting it hop from agent to agent as trusted internal content.

Links go live as each part publishes.

Coming later

Post-exploitation (privilege escalation and lateral movement across the AI-enabled environment) follows the same structure. We’ll add it here as it publishes, so bookmark this page as your index.

DSEC Labs runs offensive engagements against real AI systems for a living. If you want the professional version of what this series teaches, see our AI red teaming work.