Please read this entire document carefully before beginning your exam!

In this article, you will find relevant information on:

• OSAI Exam Introduction
• Section 1: Exam Requirements
• Section 2: Exam Information
• Section 3: Submission and Results

OSAI Exam Introduction

This guide explains the objectives of the OffSec AI Red Teamer (OSAI) exam certification. Section 1 describes the requirements for the exam, Section 2 provides important information and suggestions, and Section 3 specifies instructions after the exam is complete.

You will have 24 hours to complete the exam. Once your exam has started, you will see a timer at the bottom of your screen.

Once the exam is finished, you will have another 24 hours to upload your documentation within the OffSec Portal. Details on how to submit your files are provided below.

All OSAI exams are proctored.

Please make sure to read the proctoring tool learner manual and the proctoring FAQ at the following URL: https://help.offsec.com/hc/en-us/sections/360008126631

SECTION 1: EXAM REQUIREMENTS

Objectives

The exam simulates a real-world, twenty-four (24) hour red team engagement against an AI-enabled enterprise environment.

You are tasked with performing a hands-on offensive assessment that evaluates your ability to identify and exploit both AI-focused and traditional attack vectors. The environment is segmented into two independent attack chains, each beginning from a single publicly accessible entry point that allows you to pivot into the internal network. Each chain spans three machines, and both ultimately converge on the same Domain Controller. A separate standalone host with an AI-focused vector also resides on the internal network and becomes reachable once you have established a foothold from either chain.

Documentation Requirements

You are required to write a report describing your exploitation process for each target in the environment.

Your report must document all of your attacks, including every step taken, all commands issued, any code or scripts written, and the relevant console output. Where you use an existing script or exploit, you must provide a link to its source or a copy of the code, along with documentation of any modifications you made to it. Each stage of your attack should also be supported by screenshots showing the various steps and stages of the exploitation process.

In addition, your report must include a summary and overview of the vulnerabilities identified, the attacks performed, and the overall exploitation process. Your documentation should be thorough enough that your attacks can be replicated step-by-step, via a copy/paste approach, by a technically competent reader.

The documentation requirements are very strict and failure to provide sufficient documentation will result in reduced or zero points being awarded. Please note that once your exam report is submitted, your submission is final. If any screenshot or other information is missing, you will not be allowed to send them and we will not request them.

Exam Restrictions

The exam is entirely open book. You are free to consult any documentation, reference material, or notes you wish, and there are no restrictions on the tools you may use — you may employ any tooling, framework, or technique you find appropriate to complete the objectives.

Above all, this exam is designed to be completed with the active use of AI, and we strongly encourage you to leverage it throughout every stage of your attack, from reconnaissance and vulnerability identification through exploitation, privilege escalation, and lateral movement.

AI is treated as a core part of the modern red teamer's toolkit rather than an optional aid, and the environment has been built with the expectation that you will use it to its fullest. You should be comfortable directing AI to assist with analyzing targets, crafting and adapting payloads, troubleshooting failed attempts, and interpreting the AI-focused vectors you encounter.

Learners who choose not to make use of AI will likely find the exam extremely challenging.

NOTE: While you may use Discord as a resource for searching for information during the exam, under no circumstances are you permitted to seek or receive assistance from others on the platform.

Downloading any applications, files, or source code from the exam environment to your local machine is strictly forbidden. An exception is made for material you need to process locally on your Kali VM — for example, password hashes or encrypted keys you crack offline. For more information, please refer to the https://www.offsec.com/legal-docs/

SECTION 2: EXAM INFORMATION

Exam Connection

Your connection to the exam is to be done primarily via the OffSec Portal. Target machines can be accessed via a local Kali machine and Tailscale. We are unable to provide any technical connectivity support if you choose to use another setup. 

1. Exam Connection using Tailscale

1. Install Tailscale if it’s not already installed on your local Kali Linux VM.
   ┌──(kali㉿kali)-[~]

   └─$ curl -fsSL https://tailscale.com/install.sh | sh

2. Once installed, in the Portal start the Exam Lab and then click on "Connect with Tailscale".
3. Copy the command displayed in the box
4. Paste and enter the command in a terminal in your Kali Linux VM to connect to the exam environment.

Point Allocation

The exam environment consists of ten machines: six target machines distributed across two attack chains, one standalone host, one Domain Controller, and two intentionally not vulnerable machines. The  intentionally not vulnerable machines carry no points and are present to add realism to the environment. The eight scored targets total a maximum of 100 points.

Points are allocated by target type: each AI-vector machine is worth 15 points, each traditional-vector machine is worth 10 points, and the standalone AI-focused machine is worth 15 points. The Domain Controller holds a flag worth 5 points; because both chains converge on the DC by different routes, this flag can be submitted only once, even if you complete both chains. 

You must achieve a minimum score of 75 points to pass the exam and receive the OffSec AI Red Teamer (OSAI) certification. Points will be awarded for each target based on submitting the correct answer and the completeness of your findings in the exam report, including adherence to the Documentation Requirements.

Suggested Documentation Templates

Ideally, one of the following templates should be used for the exam report:

• Microsoft Word
• OpenOffice/LibreOffice

You may use your own template as long as the information is presented in a structured, professional manner and follows all other requirements outlined above.

Guidelines for Handling Unforeseen Factors During the Exam

This subsection of the exam guide documents what you should do in case you are unable to complete your exam due to severe external factors.

Please make sure to read and understand it carefully.

The exam lab is a dedicated environment with no learners connected other than yourself. The total allotted time of 24 hours does take life and its situations into consideration:

• You are welcome to take rest breaks, eat and drink
• You are also expected to have a contingency plan in the event that there is an issue outside your control. (e.g. ensure you have access to a backup Internet connection, power etc.)

If you have a legitimate issue, please send an email with your OSID to "challenges AT offsec DOT com" immediately. Make sure to include all of the necessary details and supporting information - such as a letter from your power company, ISP, or any other relevant documentation.

Please note that we are only able to extend the exam time if the issues you experience are present on our side and only when the exam subnet is not immediately in use by another learner following your exam. In the event of an issue on our side and the exam subnet is scheduled immediately following your exam we will provide a free exam retake attempt. We work diligently to ensure that our environments are highly available and issues are very rare.

Contact Protocol

If you encounter any connectivity problems with the VPN or target machines, inform us immediately, directly in the proctoring chat.

Should you not be able to access the proctoring tool, please contact us via the live chat available at https://chat.offsec.com/ or via email to "help AT offsec DOT com"

Please note that we will not be able to assist with, or give hints on, any exam objectives and will only be available for technical problems during the exam.

SECTION 3: SUBMISSION AND RESULTS

Submission

The exam report upload menu is built directly into the learning portal, so there's no need to visit any external websites. Once you click to end the exam or when your exam time runs out, a pop-up will appear for submitting your exam report. Simply click the 'Submit Exam Files' button at the bottom right. Please note that after submission, you will not be able to make any changes to your report. This step is final, so be sure to review your exam thoroughly before submitting.

Learners must submit their report within 24 hours of completing the exam. Failure to meet this deadline will result in an automatic exam failure.

Submission Checklist:

• Your exam report is in PDF format
• You have used the following format for the PDF file name
  "OSAI-OS-XXXXX-Exam-Report.pdf", where "OS-XXXXX" is your OSID
• Your PDF has been archived into a .7z file (Please DO NOT archive it with a password)
• You have used the following format for the .7z file name
  "OSAI-OS-XXXXX-Exam-Report.7z", where "OS-XXXXX" is your OSID
• You have made sure that your archive is not more than 100MB

Submission Format and Name

Your exam report must be submitted in PDF format archived into a .7z file. Please make sure to include all your queries as text inside the exam report PDF file itself. No other file formats will be accepted within the .7z file other than PDF file format.

If you submit your report in any other file format, we will not request or remind you to send a PDF report archived into a .7z file and your exam report will not be scored.

Before submitting your exam report, please review the PDF document to ensure the format and content appear as it did in your original edition document and that there are no formatting errors.

After uploading your exam file, the site will provide you with the MD5 hash of your uploaded file.

Please make sure to verify that you have uploaded your report correctly by checking and comparing the MD5 hashes of your uploaded exam file and the file you have locally.

If the values do not match, that means your file did not upload successfully. Click on "Select a new file" and upload your archive again.

┌──(kali㉿kali)-[~]
└─$ md5sum OSAI-OS-XXXXX-Exam-Report.7z 
f7feecea01ac1eca9ee522906b087d5e
OSAI-OS-XXXXX-Exam-Report.7z

Archive File

Please do not archive your .7z and PDF(s) files with a password. Our system will not accept should you upload a password-protected files.

You must submit your documentation in a .7z file. Please use your Kali machine to create your .7z file.

┌──(kali㉿kali)-[~] 
└─$ 7z a OSAI-OS-XXXXX-Exam-Report.7z OSAI-OS-XXXXX-Exam-Report.pdf

7-Zip 9.20 Copyright (c) 1999-2010 Igor Pavlov 2010-11-18 p7zip Version 9.20
(locale=en_US.UTF-8,Utf16=on,HugeFiles=on,2 CPUs)

Scanning

Updating archive OSAI-OS-XXXXX-Exam-Report.7z

Everything is Ok

Additional Required Information

In the unlikely event that we require additional clarification on your exam report, we will get in contact with you via email. You must submit the requested information within 24 hours from the time we have requested it.

Results

You will receive your certification exam results (pass/fail) within ten (10) business days after submitting your documentation.

You can then access your digital credentials via the OSAI tile on your Achievements Page.

In the event of a failing result, you can schedule another attempt if you still have a valid OSAI exam attempt on your account. If you do not have a valid attempt left, you will need to purchase a new exam attempt. For further guidance or questions, please refer to the OSAI Exam FAQ page.