Ai-Security

A cautious operator controls a cheerful square-headed robot with marionette strings.

OSAI: testing AI and learning to work with it

My experience with OffSec AI-300 and the OSAI exam: useful material, challenging but unreliable labs, and what I learned about using AI in my own offensive security workflow.

agent-inject: An Open-Source AI Agent Security Training Range

An open-source AWS training range for learning agentic AI security. Deploy a realistic AI agent, toggle six misconfigurations via Terraform, and run five attack scenarios covering prompt injection, RAG poisoning, data exfiltration, and a full kill chain.

Building an AI Agent Security Lab - Part 3

Part 3 of building agent-inject: manual validation of every attack scenario. The biggest challenge was not breaking things. It was building a working product and securing it while making insecure scenarios realistically demonstrate impact.

Building an AI Agent Security Lab - Part 2

Part 2 of building agent-inject: automated testing against a live Bedrock agent. 41 tests across 6 scenarios revealed that the gap between expected and actual agent behaviour is where the real lessons are.

Building an AI Agent Security Lab - Part 1

Part 1 of building agent-inject: an intentionally vulnerable AI agent on AWS Bedrock, designed to teach prompt injection and agentic AI attacks. This post covers the full secure baseline, from repo scaffold to a working chat UI.