OSAI (AI-300) exam prep, on a lab that looks like the exam.

OffSec's OSAI (course code AI-300) is a hands-on practical: you attack live AI systems — deployed LLM apps, RAG pipelines, multi-agent workflows and cloud-hosted AI — and write it up. Reading guides can't rehearse that. Attaxium is the hands-on lab that lets you practice the real thing before exam day.

What the OSAI / AI-300 exam actually tests

The OSAI practical drops you into a simulated enterprise environment with real AI attack surface: LLM-backed applications, retrieval-augmented (RAG) pipelines, multi-agent and agent-to-agent (A2A) systems, MCP tool surfaces, and the cloud/model-serving infrastructure underneath. You are expected to recon the environment, chain exploits, pivot, and document a full engagement. It rewards practical tradecraft, not multiple-choice recall.

Why a hands-on lab beats a study guide

Most OSAI prep on the web is theory: attack taxonomies, payload lists, framework summaries (OWASP LLM Top 10, MITRE ATLAS). Useful, but you can't pass a practical by reading. The one thing candidates can't easily get is a realistic environment to attack. Attaxium is exactly that — deliberately-vulnerable AI targets you spin up on demand and break for yourself, with the solution hidden behind a spoiler so you try it first.

The twelve chapters map to the exam's attack surface

▸Ch 1 · The AI Attacker's Mindset. Why classic tradecraft falls short on AI-integrated orgs, and where the new attack surface really lives. MITRE ATLAS, OWASP LLM Top 10, the AI kill chain.
▸Ch 2 · Mapping the AI Attack Surface. Fingerprint deployed models, enumerate agents and RAG pipelines, and harvest exposed keys and deploy tokens, quietly.
▸Ch 3 · Breaking Vector Search & Embeddings. Invert embeddings back to text, dump vector stores, and abuse semantic search to pull data the model was never meant to reveal.
▸Ch 4 · Hijacking LLM Agents. Direct and indirect prompt injection, jailbreaks, guardrail evasion, and poisoning an agent's long-term memory.
▸Ch 5 · Poisoning RAG & Knowledge Pipelines. Plant instructions in documents, leak across users, defeat redaction, and read the retrieval trace to reconstruct the corpus.
▸Ch 6 · Abusing Tool Use & MCP Surfaces. Tool poisoning, path traversal and SSTI through tool calls, and confused-deputy escalation over Open WebUI + MCP.
▸Ch 7 · Turning Agents Against Each Other. Rogue-agent registration, forged workflow history, cross-agent confused-deputy, and LLM-mediated SQL injection.
▸Ch 8 · Weaponizing the Model Supply Chain. Backdoored weights and adapters, pickle-deserialization RCE, poisoned training data, and mining the model repo.
▸Ch 9 · Popping Model Servers & AI Infra. Exploit the serving stack itself: model-server bugs, SSRF, cloud IAM chains, and Kubernetes ML workloads.
▸Ch 10 · Threat-Modeling AI Targets. Turn scattered findings into a plan: assumption registers, AI-specific trust boundaries, and attack-path mapping across a complex AI environment.
▸Ch 11 · Full-Chain Engagement. One realistic environment, no hand-holding: recon → exploit → pivot → post-exploitation, end to end.

OSCP holder moving into AI security?

OSAI expects OSCP-level fundamentals, and OffSec explicitly frames it as the AI step for offensive-security practitioners. If you already hold the OSCP, the gap is the AI-specific attack surface — prompt injection, RAG, agents, MCP, embeddings, model-serving exploitation. That gap is precisely what Attaxium's lab drills, so you convert existing pentest skill into AI red-team practice fast.

Also prepping for HTB COAE?

Hack The Box's Certified Offensive AI Expert (COAE)is complementary to OSAI — it leans more adversarial-ML/mathematical, OSAI more practical-infrastructure. The same Attaxium lab is strong practice for both; name your target and drill the hands-on half neither cert's reading covers.

Frequently asked questions

Attaxium is an independent training provider and is not affiliated with, endorsed by, sponsored by, or otherwise associated with OffSec or Hack The Box. OSAI, AI-300, OSCP, HTB and COAE are trademarks of their respective owners and are referenced here only to describe the certifications this material helps you prepare for.