I've been talking about AI security certifications on this blog for a while now. I've covered the certification landscape, compared OSAI against HTB's AI Expert, and walked through the preparation paths for practitioners coming from different backgrounds. A few months ago I actually sat the exam.

This is my honest review ; the course, the challenge labs, the 24-hour exam, and the agent-based workflow that made the difference. If you're a security professional evaluating whether OSAI is worth your time and money, this is the article I wish I'd had before I enrolled.

Who This Certification Is Actually For

Before getting into the review, I want to be direct about the audience fit, because I've seen people waste money on certifications that weren't right for their background or target role.

OSAI is OffSec's entry into AI red teaming. It carries the same philosophy as OSCP: you only earn it by demonstrating the skill under exam conditions, not by recalling knowledge from a multiple-choice question bank. The 24-hour practical exam format is non-negotiable, and that format assumes you arrive with a certain baseline.

If you're coming from a penetration testing background ; OSCP or equivalent hands-on experience , OSAI will feel like familiar methodology applied to a new attack surface. The enumeration discipline, the structured approach to target assessment, the report-quality documentation mindset: all of that transfers directly. What you're adding is the AI-specific attack surface knowledge.

If you're coming from a purely defensive or blue team background without offensive experience, the course material is approachable, but the 24-hour exam will expose gaps. The exam is not a quiz on course content. It's an operational exercise where you're expected to chain techniques, navigate rabbit holes, and adapt when the obvious path doesn't work.

If you're coming from an AI/ML background without security training, you'll understand the underlying technology deeply but may struggle with the offensive methodology. The course teaches the attack techniques, but developing the instincts for enumeration and loot management takes practice that the course alone doesn't fully provide.

My background going in: OSCP and CPTS completed, active offensive security work, plus the AI red teaming lab practice I've documented on this blog. OSAI was my third OffSec certification.

The Course: What It Covers and How to Work Through It

The material aligned with what OffSec advertised. The syllabus covers:

• Introduction to Red Teaming AI Systems
• Reconnaissance for AI Targets
• Attacking AI Agents
• Attacking Multi-Agent Systems and Agent-to-Agent Protocols
• Exploiting RAG Pipelines
• Attacking Embeddings
• Attacking Model Context Protocol and Tool Surfaces
• AI Supply Chain Attacks
• AI Infrastructure and Deployment Exploits
• Threat Modeling for AI-Enabled Targets
• Capstone Red Team Engagement

That's a comprehensive coverage of the AI attack surface as it exists today. The MCP attacks module is particularly current ; I've written about OWASP's MCP Top 10 on this blog and the offensive techniques in that module map directly to real attack surface research from 2025 and 2026.

My honest assessment of the material: Everyone will learn something new from this course. Is it revolutionary? Not necessarily. But OffSec has a specific way of doing things , methodical, practical, focused on reproducible technique over theoretical understanding and that approach serves the exam format well. If you've completed other OffSec courses, you know the style. If you haven't, expect dense technical content with exercises that require actual hands-on execution, not passive reading.

What I'd tell you to do differently from how most people approach it:

Don't rely exclusively on AI tools while studying the course. I know that sounds ironic given the subject matter, but there's a real risk of using an LLM to skip through exercises without building genuine understanding of why the techniques work. The course teaches you to attack AI systems. Understanding those attacks at mechanism level not just executing commands someone else generated is what separates candidates who pass the exam from candidates who don't.

Take notes as you go. Specifically: create summaries of each technique that you can feed to your agent later. This serves two purposes I'll explain in the agent section.

Start building your agent before you reach Module 11 (the capstone). Don't wait until the capstone to figure out your tooling. The agent you build while working through modules 1 through 10 will be significantly better than one you assemble in the final week before the exam.

The Agent: The Most Important Preparation Decision You'll Make

Here's the thing about OSAI that isn't clearly communicated until late in the course: AI tooling is not just allowed during the exam ; it's strongly encouraged. The exam guide confirms this explicitly once you reach the later modules. The exam is designed with the expectation that you're running AI-assisted workflows.

This changes the preparation calculus entirely. The question isn't "how do I memorize the techniques." The question is how do I build an agent that can operationalize those techniques effectively under exam conditions.

My agent setup by exam day looked like this:

osai-challenge-operator/
├── agents/
│   └── openai.yaml
├── references/
│   ├── environment.md
│   ├── operations.md
│   ├── [additional technique references]
├── scripts/
│   ├── operator_checkpoint.py
│   ├── report_evidence.py
│   └── [additional automation]
├── tests/
│   ├── test_operator_helpers.py
│   └── [additional tests]
└── SKILL.md

The references/ directory is where your course notes live in agent-consumable format. The environment.md captures what the agent needs to know about the target environment in the current engagement. The operations.md captures the techniques, their prerequisites, and when to apply them.

The most important lesson I learned about agent design: start small and iterate. A bigger agent does not produce better results. An agent bloated with every technique reference and every script you've ever written will be slower, less focused, and more prone to hallucinating irrelevant approaches than a well-structured smaller agent with clean, specific references.

After completing each challenge lab, I ran a planning session with my agent to identify gaps: what did it get wrong, what context was it missing, what technique references were incomplete. That iterative improvement process is how you arrive at exam day with an agent that actually helps rather than one that generates plausible-looking but incorrect attack chains.

The note-taking suggestion I made above connects directly to this: your course summaries become the reference material your agent can consume. Well-structured technique summaries in your references/ directory are worth more than raw course notes you can re-read yourself.

The Challenge Labs: Useful, But Not a Proxy for the Exam

At the time of writing, the OSAI course includes four challenge labs. Each lab contains multiple targets. I completed each challenge twice , once to solve it, once to evaluate how my agent performed and identify improvements.

My honest assessment: the challenges are on the easier side. One was noticeably harder than the others, but a well-built agent should get you through all of them. The techniques they test are representative of what you'll encounter in the exam. The approach required is different.

In the challenge labs, you receive clear objectives and the intended path is relatively clear. The content mirrors the course modules. If you've studied the material and your agent has good references, the challenges feel achievable even if they require technique chaining.

The exam is not like this. There are rabbit holes. There are entry points that look promising and don't lead anywhere. There are flags that require you to connect information across different stages of the engagement in ways that aren't telegraphed by the objective description.

This is the main criticism I'd make of the challenge labs: they're good for validating that you understand the techniques, but they don't prepare you for the exam's ambiguity. If you complete the challenges, feel confident, and then sit the exam expecting a similar experience — you'll be surprised.

My recommendation: after completing the challenges with your agent, deliberately practice with scenarios where the path isn't clear. The open-source AI red teaming lab I've set up and documented on this blog is useful for this. Working through challenges where you have to enumerate without being given objectives forces the kind of adaptive thinking the exam requires.

The Exam: 24 Hours, 90 Points, and Two Lessons Learned

By coincidence, this was the second OSAI exam ever administered , the very first scheduled exam date was July 15.

The exam format: 24 hours, practical engagement, multiple flag types, two entry points. Refer to the public exam guide on OffSec's website for the detailed structure ; I can't share specifics beyond what's public.

Lesson 1: Enumeration is everything.

This is the OSCP lesson applied to AI systems, and it's just as true here. I moved past some targets too quickly after finding an initial foothold. The AI-specific attack surface has layers; the application layer, the model layer, the infrastructure layer, the agent tool layer and each layer can contain separate vulnerabilities that compound into more significant findings. I underenumerated two targets and paid for it in points.

The specific implication for AI red teaming: when you identify an LLM-powered application, don't stop at the first successful prompt injection or information disclosure. Enumerate the tool surface. Check what functions the agent can call. Investigate the RAG data sources. Look at the infrastructure serving the model. Each of these is a separate attack surface with its own findings.

Lesson 2: Strict loot management.

In a 24-hour engagement across multiple targets with two entry points, you will collect a significant amount of information. Credentials, API keys, model configurations, system prompt contents, tool definitions, file paths, network addresses. If you're not tracking exactly where each piece of information came from and where you've tested it, you will waste time and you may miss connections between pieces of information that point to a critical finding.

I estimate that better enumeration and stricter loot management would have saved me three to four hours during the exam. At 90 points, those hours likely cost me a perfect score.

Both of these lessons sound obvious written down. They're harder to execute at 3am in hour 18 of a 24-hour exam when you've been context-switching across multiple targets. Build the habits before exam day, and build them into your agent's workflow ; an automated checkpoint script that prompts you to update your loot tracking at regular intervals is worth building.

The Token Usage

In the days before my exam, Codex released a new model, and my account showed five rate-limit reset credits each one resetting my weekly limits. Combined with my existing subscription, I had significant runway.

I tracked everything with OpenUsage, which reads local Codex logs and estimates API-equivalent token values. The final number across the two calendar days the exam spanned: approximately 4.1 billion tokens, with an estimated API-equivalent value of roughly US$6,386.

That was not my actual bill. That's the estimated API value of the tokens consumed if I'd been paying API rates rather than running on a subscription with reset credits. I want to be clear about this because the number sounds alarming out of context.

What does 4.1 billion tokens in 24 hours actually mean operationally? It means my agent was running continuously throughout the exam, processing large context windows containing target documentation, attack outputs, loot tracking, and technique references. It means I was iterating on attacks with the agent in tight loops ; executing, feeding output back, refining the approach, re-executing. It means the agent was generating reports and evidence captures throughout.

For candidates who don't have access to equivalent rate-limit credits, the practical implication is this: plan your AI tooling budget before exam day. If you're running on API billing, aggressive agent usage across a 24-hour exam can accumulate meaningful costs. If you're on a subscription, know your rate limits and how quickly they might be hit.

The exam is designed for this level of AI tool usage. If you're planning to sit the exam while treating AI tools as an occasional assist rather than a continuous operational workflow, you're leaving significant capability on the table.

Who Should Pursue OSAI and When

Based on my experience, here's the honest guidance:

Pursue OSAI now if: You hold OSCP or equivalent practical penetration testing experience, you're working in or targeting offensive AI security roles, and you want the most credible practical AI red teaming credential available today. The 24-hour exam format and OffSec brand will carry weight with employers who understand offensive security credentials.

Pursue OSAI after preparation if: You have AI/ML background but limited offensive security experience. In this case, I'd recommend working through the foundational AI security course material I've linked in previous articles, spending time with the open-source AI red teaming labs to build enumeration habits, and then enrolling.

Consider alternatives first if: You're primarily defensive in your role and are exploring AI security as an extension rather than a transition. The OSAI is purely offensive — there's no defensive content in the certification. The HTB CDSA or CDSA-equivalent defensive credentials are better fits for that profile.

On timing: Start building your agent on day one of course access, not during the final week. The agent is the most important tool in your exam toolkit, and it needs the full course period to mature through iterative improvement across the challenge labs.

Finally

OSAI is the real thing. The course covers the AI attack surface comprehensively, the challenge labs provide useful technique validation, and the 24-hour exam is a genuine assessment of operational AI red teaming capability rather than a knowledge quiz.

The OffSec brand carries weight in offensive security hiring decisions. OSAI inherits that trust. For practitioners targeting AI red teaming engagements, AI security consulting, or offensive AI research roles, this credential is worth the investment.

The one thing I'd change: I'd start building the agent earlier and take more deliberate notes during the course modules. The candidates who will do best on this exam are the ones who treat the course period as agent development time, not just learning time.

If you're planning to pursue OSAI, feel free to reach out. I'm happy to discuss preparation approaches and what worked for me in more detail.

Thanks to OffSec for building something that actually challenged me. ✌️