Offensive Security Advanced AI Red Teaming (OSAI+/OSCP+)

This course is designed to prepare learners for the Advanced AI Red Teaming (OSAI+) - AI-300: Advanced AI Red Teaming certification by simulating real exam conditions through high-quality, scenario-based multiple-choice questions.

As artificial intelligence becomes deeply integrated into modern systems, the attack surface has expanded beyond traditional applications to include models, agents, pipelines, and AI-driven infrastructure. This course focuses on helping learners understand, analyze, and exploit these systems from an adversarial perspective.

Rather than teaching theory alone, this course emphasizes practical thinking, attack reasoning, and real-world scenarios, enabling learners to approach AI security challenges with a red team mindset.

Each domain reflects a critical phase in modern AI offensive operations, from initial reconnaissance to full-scale compromise.

Domain 1: Foundations & AI Threat Landscape

This domain introduces the core principles of AI red teaming and establishes the foundation for understanding how AI systems are targeted. Learners explore how artificial intelligence changes the traditional attack surface and how adversaries adapt their techniques accordingly. The domain also covers structured threat modeling approaches tailored to AI-enabled environments.

Key areas include identifying high-value AI assets, mapping trust boundaries, and aligning AI threats with the red team lifecycle. By the end of this domain, learners will be able to reason about AI-specific risks and prioritize targets based on impact and exposure.

Covers:

• Introduction to Red Teaming AI Systems

• Threat Modeling for AI-Enabled Targets

Focus:
Understanding AI attack surfaces, adversarial mindset, and identifying high-value targets.

Skills:

• AI security fundamentals

• Red team lifecycle mapping

• Trust boundaries & risk prioritization

• Threat modeling for AI systems

  
  

Domain 2: AI Reconnaissance & Enumeration

In this domain, learners focus on discovering and mapping AI components within a target environment. Modern infrastructures often expose machine learning models, APIs, vector databases, and orchestration layers that can be identified through careful reconnaissance.

This section develops the ability to analyze environments from an attacker’s perspective, using both passive and active techniques to uncover AI assets without triggering detection mechanisms. Learners gain experience in identifying dependencies, understanding system architecture, and building a complete picture of the AI attack surface before exploitation begins.

Covers:

• Reconnaissance for AI Targets

Focus:
Discovering and mapping AI assets within target environments.

Skills:

• Identifying AI/ML components

• Mapping exposed services and APIs

• Dependency discovery (models, vector DBs, pipelines)

• Passive and active reconnaissance techniques

  
  

Domain 3: AI Application Exploitation I

This domain shifts into offensive techniques, focusing on direct interaction with AI applications. Learners explore how AI agents can be manipulated through crafted inputs, malicious instructions, and abuse of orchestration layers such as tool integrations and context management systems.

The domain covers prompt injection, instruction hijacking, and the exploitation of model context protocols. It emphasizes how attackers can escalate privileges or execute unintended actions by abusing how AI systems interpret and process user input.

Covers:

• Attacking AI Agents

• Attacking Model Context Protocol and Tool Surfaces

Focus:
Exploiting AI applications through direct interaction and orchestration abuse.

Skills:

• Prompt injection & instruction hijacking

• Context manipulation

• Tool/function abuse

• Privilege escalation via AI integrations

  
  

Domain 4: AI Application Exploitation II

Building on previous concepts, this domain explores more advanced and interconnected AI systems. Learners analyze multi-agent architectures and understand how trust relationships between agents can be exploited.

Additionally, this section covers retrieval-augmented generation (RAG) pipelines, demonstrating how attackers can manipulate retrieval mechanisms or poison knowledge sources to control model outputs. The focus is on complex attack paths where multiple components interact, requiring deeper reasoning and strategic exploitation.

Covers:

• Attacking Multi-Agent Systems and A2A Protocols

• Exploiting RAG Pipelines

Focus:
Attacking complex AI architectures and trust relationships.

Skills:

• Agent impersonation & message tampering

• Multi-agent trust exploitation

• Retrieval manipulation

• Knowledge base poisoning

  
  

Domain 5: Model & Data-Level Attacks

This domain targets the machine learning layer itself, moving beyond application-level attacks into the core of AI systems. Learners study how embeddings can leak sensitive information and how adversaries can extract or reconstruct data from models.

The course also examines supply chain risks, including dataset poisoning, malicious model weights, and compromised dependencies. This domain highlights how attacks can be introduced before deployment, making them difficult to detect and highly impactful.

Covers:

• Attacking Embeddings

• Supply Chain Attacks on AI/ML Systems

Focus:
Targeting the machine learning layer and data pipeline.

Skills:

• Embedding inversion & data leakage

• Dataset poisoning

• Model backdooring

• Malicious model artifacts and dependencies

  
  

Domain 6: AI Infrastructure Exploitation & Capstone Engagement

The final domain brings everything together in a full-spectrum red team context. Learners identify and exploit vulnerabilities in AI infrastructure, including cloud environments, model servers, and containerized machine learning workloads.

The capstone engagement simulates a real-world scenario where multiple attack techniques are chained together to compromise an AI-enabled system. This domain reinforces the ability to think like an adversary, combining reconnaissance, exploitation, and lateral movement into a cohesive attack strategy.

Covers:

• AI Infrastructure and Deployment Exploits

• Assembling The Pieces – Capstone Red Team Engagement

Focus:
Full-spectrum attacks against real-world AI environments.

Skills:

• Cloud and model server exploitation

• Containerized ML workload attacks

• End-to-end attack chaining

• Realistic red team engagement execution

Course Approach

This practice exam course is designed to reflect the style and difficulty of the OSAI+ certification. Questions are scenario-driven and require analytical thinking rather than memorization. Learners will develop the ability to interpret complex situations, identify vulnerabilities, and choose the most effective attack strategies.

By completing this course, learners will not only be prepared for the certification exam but will also gain a deeper understanding of how modern AI systems can be assessed and exploited in real-world environments.


Disclaimer:

This course is not affiliated with, endorsed by, or sponsored by Offensive Security. OSAI® and OffSec® are registered trademarks of Offensive Security.

This course is designed solely to help learners prepare for Offensive Security certifications by offering complementary knowledge and practice. No official materials or proprietary content from OffSec are used.