OffSec is introducing a mandatory AI-Resistant (AI-R) submission standard for all labs to keep learning hands-on and practical.
What Is Changing?
- Mandatory AI-R Standard: All new UGC lab submissions must be AI-Resistant.
- Difficulty: Attack vectors retain their intended difficulty. The changes only increase processing complexity, session length, and token costs for automated AI solvers.
How to Build an AI-Resistant Lab
AI agents are fundamentally limited by context windows, session length, and token costs. By inflating the environment's volume and structural noise, the AI route becomes too expensive and unreliable, whereas a human barely notices the difference.
Primary Techniques
(Note: Numbers are guidelines and should be adapted to fit your specific scenario.)
| Technique | Description | Examples |
| Volume Inflation | Increase the size of the target environment to overwhelm AI context windows. |
• Web Apps: 50–80+ realistic pages (instead of 10) • Databases: Thousands to hundreds of thousands of rows • Active Directory: ~200 groups / ~2,000 users |
| Realistic Breadth | Add realistic paths that a human can easily filter out using instinct, forcing AI agents to waste tokens testing every path. |
• Believable alternative paths and services • Avoid obvious artificial noise or malicious rabbit holes |
Advanced Techniques (Optional)
- Depth: Conceal critical artifacts deep within large data sets (e.g., hiding a single valid credential inside a massive data dump).
- Chaining: Require exploitation steps to depend on specific artifacts discovered much earlier in a long testing session.
Key Rule: If a concept is solid but simple, extend it using data padding. The core vulnerability (e.g., SQL Injection) does not change - there is simply too much data for imprecise, automated AI queries to succeed economically.
Quick FAQ
Is AI-R mandatory for all submissions?
Yes. All future human-user UGC labs must adhere to the AI-R standard.
Does this make labs more difficult for human students?
No. The primary attack vector and human difficulty remain identical; the changes only burden automated solvers.
Do I need to test my lab against an AI model before submitting?
No. AI testing is not required due to the associated API costs. Simply apply the volume and breadth principles during lab construction.