Exam Prep

OSAI Exam Format

• Duration: 48 hours practical engagement
• Format: Red team a realistic AI-enabled enterprise environment
• Deliverable: Full penetration test report within 24 hours of exam end
• Target systems: LLM apps, RAG pipelines, agent systems, AI infrastructure
• Scoring: Points for compromises + report quality

Key Focus Areas (Exam Priority Order)

1. Prompt injection (direct + indirect) — always present
2. System prompt extraction — points for intelligence gathering
3. Agent/tool abuse — high points, realistic scenario
4. RAG exploitation — likely in enterprise scenarios
5. Infrastructure exposure — bonus points, less common
6. Insecure output handling — often combined with injection

Report Writing Checklist

OSAI ENGAGEMENT REPORT TEMPLATE
================================

EXECUTIVE SUMMARY
- Overall risk rating
- Number of findings by severity
- Key recommendations (3-5 bullets)

SCOPE & METHODOLOGY
- Target systems and AI components tested
- Attack techniques used (OWASP LLM, MITRE ATLAS references)
- Testing duration and constraints

FINDINGS (per finding):
┌─────────────────────────────┐
│ Finding ID: OSAI-001        │
│ Title: Indirect Prompt Injection via Email Processing │
│ Severity: HIGH              │
│ OWASP: LLM01               │
│ CVSS: 7.5                  │
├─────────────────────────────┤
│ Description                 │
│ Affected Component          │
│ Proof of Concept (steps)    │
│ Evidence (screenshots/logs) │
│ Impact Analysis             │
│ Remediation (specific)      │
└─────────────────────────────┘

APPENDIX
- Tool output
- Raw payloads used
- Timeline of engagement

Mindset for the Exam

• Enumerate first, exploit second — understand the full AI stack before attacking
• Multi-vector thinking — combine injection + insecure output + tool abuse
• Document as you go — screenshots and payload logs, not from memory after
• Reliability over quantity — one reliable, well-documented critical finding > five unreliable ones
• Think indirect — if direct injection is blocked, where does the LLM read data from?
• Infrastructure is in scope — always check for exposed serving endpoints
• Probabilistic attacks — run jailbreaks 5-10x to establish reliability before reporting

Key Resources to Read Before Exam

AI systems are just software. The same fundamental principles apply — trust boundaries, input validation, least privilege, defense in depth. The novelty is the natural language interface and the probabilistic behavior. Master the fundamentals of offense, then learn how LLMs break the assumptions those fundamentals rely on. That's how you pass OSAI.