Model Attack & Red Teaming is the AI security course on LearnToExploit, the browser-based cyber range built by Macksofy. It is a twelve-module, lab-first track that teaches you to find, exploit and report the weaknesses that actually show up in Large Language Model (LLM) applications in 2026: prompt injection, system-prompt and data extraction, guardrail evasion, retrieval-augmented generation (RAG) access-control bypass, unsafe output handling, over-privileged agents, poisoned knowledge bases and the pivot from an AI finding into the cloud account behind it. It costs ₹10,000 one-time, is priced in rupees, and sits in the platform’s Specialist tier, the top rung of its offensive track.
This guide walks through what the course covers module by module, what the nine labs make you do, how it is assessed, who it is for, and how it fits next to the certifications Indian employers already ask for. It is written by the team that built it, so where the course is thin we say so.
Model Attack & Red Teaming at a glance
| Item | Detail |
|---|---|
| Platform | LearnToExploit (Macksofy cyber range), browser-based, no VPN or local lab build |
| Track and tier | Offensive track, Specialist tier |
| Modules | 12, from AI red-team foundations to a full engagement and report |
| Hands-on labs | 9 browser labs, one per attack class, each against a deliberately vulnerable LLM application |
| Frameworks | OWASP Top 10 for LLM Applications (2025) and MITRE ATLAS |
| Recorded content | About 1.4 hours of video; the course is paced by the labs, not the lectures |
| Price | ₹10,000 one-time, billed in INR (no forex markup) |
| Prerequisites | Comfort with HTTP, Burp Suite or browser dev tools and basic web vulnerabilities; no machine-learning background needed |
| Certificate | Course completion on the platform; it is not a proctored certification exam |
Who the course is for
The course was written for three kinds of candidates we meet in our cohorts.
- Web and API pentesters who are being handed a “copilot” or RAG assistant in scope for the first time and need a repeatable methodology instead of improvising prompts.
- Security engineers and SOC analysts whose company is shipping an LLM feature and who need to understand the attack classes well enough to threat-model and test it before release.
- Candidates planning an AI red-team credential such as OffSec’s OSAI (AI-300) or the SecOps Group’s Certified AI/ML Pentester, who want practised hands before paying for an exam. For a direct comparison, see OSAI vs LearnToExploit Model Attack & Red Teaming; for the complete certification landscape, our AI penetration testing certifications guide.
It is not for you if you want to train or fine-tune models, or if you want research-grade adversarial machine learning. The course treats the model as a black box inside an application, which is how an attacker meets it.
The 12 modules
The syllabus follows the order of a real engagement: understand the target, map it, attack the model, attack what the model is connected to, then write it up.
- Foundations of AI Red Teaming and MITRE ATLAS
- Reconnaissance and Attack-Surface Mapping for AI Systems
- Direct Prompt Injection
- Indirect and Stored Prompt Injection
- System-Prompt and Sensitive-Data Extraction
- Jailbreaking and Guardrail Evasion
- RAG and Vector-Store Access-Control Bypass
- Improper Output Handling
- Excessive Agency and Agent-Tool Abuse
- Data and Model Poisoning and Supply Chain
- AI Infrastructure to Cloud and Enterprise Pivot
- Full Engagement and Reporting
Modules 1 and 2: foundations and recon
The first two modules are the only lecture-heavy ones. Module 1 sets the vocabulary: where an LLM application differs from a conventional web target, the OWASP LLM Top 10 as a finding taxonomy, and MITRE ATLAS as the tactic map you will cite in reports. Module 2 is reconnaissance: identifying the model and provider behind an interface, enumerating tools and plugins an agent can call, finding the retrieval layer, and spotting where user content flows into a prompt. Everything after this is practical.
Modules 3 to 6: attacking the model
Direct prompt injection is taught as its own discipline, not a party trick: instruction hierarchy, delimiter and role confusion, and how to tell a real control bypass from a model simply being chatty. Indirect injection moves the payload into documents, web pages and uploads the application reads on your behalf, which is the variant that matters for document assistants and browsing agents. The extraction module covers pulling the system prompt, hidden tool definitions and other users’ data out of context windows. The jailbreaking module is about guardrail evasion with a focus on reproducibility, because a one-off jailbreak is not a finding a client can act on.
Modules 7 to 10: attacking what the model is wired to
This is where the course earns the Specialist tier. The RAG module shows why authorisation written in prose (“only answer HR questions for the current user”) fails, and how to pull documents the retriever should never have surfaced. Improper output handling turns an AI finding into a conventional one: model output rendered without encoding becomes cross-site scripting, output passed to a shell or SQL becomes command or query injection. Excessive agency covers agents with too many tools and too little confirmation, including order-placing and ticketing bots. The poisoning module covers community knowledge bases and supply-chain risks in downloaded models and datasets.
Modules 11 and 12: the pivot and the report
Module 11 follows a deployment agent whose tool gives you server-side request forgery into the surrounding cloud environment, the point at which an AI assessment becomes an infrastructure assessment. Module 12 is the one most self-taught testers skip: scoping an AI engagement, rating severity for non-deterministic findings, capturing evidence that reproduces, and writing a report a client can act on. In our OSCP and OSEP cohorts, reporting is where candidates lose marks, and AI engagements make it harder because the same prompt does not always produce the same result.
The nine labs
Each lab is a small, intentionally vulnerable LLM application running in the browser. You do not install anything. The labs are, in order:
- A naive support chatbot with a secret in its system prompt (direct injection and extraction)
- A document assistant that executes instructions hidden in uploaded files (indirect injection)
- A customer-facing assistant with layered guardrails to evade reproducibly (jailbreaking)
- An HR knowledge base whose access control is enforced in the prompt rather than the retriever (RAG bypass)
- An assistant whose output is rendered and executed by the host application (improper output handling)
- An order-placing agent with more tools than it needs (excessive agency)
- A community knowledge base that accepts poisoned contributions (data poisoning)
- A deployment agent whose tooling reaches into the cloud account behind it (infrastructure pivot)
- A full engagement against a composite target, ending in a written report (module 12)
Walkthroughs unlock after you solve a lab, so you can compare your path with the intended one. Expect the labs, not the lectures, to take your time: most candidates spend an hour or two per lab and a weekend on the final engagement.
Price, access and what you need
The course is ₹10,000, one-time, billed in Indian rupees through the LearnToExploit course page. There is no subscription, no lab-time meter and no exam voucher to budget for, which is a different model from the OffSec courses priced in US dollars that most of our red-team certification guides cover. You need a modern browser and an understanding of HTTP requests; Burp Suite Community or your browser’s developer tools are enough for every lab.
How it fits with AI security certifications
Model Attack & Red Teaming is a course with labs, not a proctored certification. If your employer needs a credential, use it as the practical layer under one. Our guide to AI and LLM security certifications in India ranks the options; the two it pairs with best are:
- OffSec OSAI (AI-300). OSAI is the deeper programme: it adds agent-to-agent protocols, embedding inversion, Model Context Protocol internals and a full cloud and Kubernetes pivot, examined under 24-hour proctoring. LearnToExploit covers the application-layer attack classes behind OSAI’s modules and adds several OSAI does not teach as modules, including system-prompt extraction, jailbreaking, output handling and report writing. It prepares the application half of the exam; it does not replace the OffSec labs for the platform half.
- SecOps Group C-AI/MLPen and C-AgAIPen. Both are practical, affordable exams whose syllabi line up closely with modules 3 to 9 here, so the labs double as exam practice.
If your interest is specifically in agent tooling, read our explainer on how MCP servers get hacked after module 9; the course covers tool abuse but not the MCP transport itself.
A four-week plan that works alongside a job
| Week | Modules | Target |
|---|---|---|
| 1 | 1 to 3 | Vocabulary, recon checklist, first lab solved without the walkthrough |
| 2 | 4 to 6 | Indirect injection, extraction and a reproducible jailbreak, each written up as a finding |
| 3 | 7 to 10 | RAG bypass, output handling, agent-tool abuse and poisoning labs |
| 4 | 11 and 12 | Cloud pivot lab, then the full engagement and a report you would send to a client |
Candidates in our mentored AI security track submit the module 12 report for review; a report a mentor would sign off as client-deliverable is the bar we set before anyone books OSAI or a SecOps Group exam.
Frequently asked questions
Is the LearnToExploit Model Attack & Red Teaming course a certification?
No. It is a twelve-module course with nine hands-on labs and a completion record on the platform. It is designed to be the practical layer under a certification such as OffSec OSAI or the SecOps Group Certified AI/ML Pentester, not a substitute for one.
How much does the Model Attack & Red Teaming course cost in India?
₹10,000, one-time, billed in Indian rupees. There is no subscription, no lab-time meter and no separate exam fee.
Do I need a machine-learning background?
No. The course treats the model as a black box inside an application. You need to understand HTTP requests and basic web vulnerabilities; Burp Suite Community or browser developer tools are enough for every lab.
Does finishing the course prepare me for OSAI?
It covers the application-layer attack classes behind the AI-300 modules and adds reporting practice, which is the half of the exam most candidates fail. It does not cover agent-to-agent protocols, embedding inversion, MCP internals or the cloud and Kubernetes depth OSAI examines, so do it first, then the OffSec material.
How long does the course take?
The recorded content is about an hour and a half; the labs set the pace. Most working professionals finish in three to four weeks at a few evenings a week, with a weekend for the final engagement and report.
References & further reading
Authoritative resources cited or relevant to the topics covered above:
- Model Attack & Red Teaming on LearnToExploit
- OWASP Top 10 for LLM Applications (2025)
- MITRE ATLAS
- OffSec AI-300 (OSAI) course page
- OSAI vs LearnToExploit Model Attack & Red Teaming, compared module by module
Related reading: AI red teaming is one specialisation a penetration tester grows into. See the whole path in our roadmap to becoming a penetration tester in India (2026), and the red-team certification ladder most of our AI-track candidates come from.
About the author — Yasir Arafat
Founder and Lead Instructor, Macksofy Trainings
Yasir designs OSCP, CEH v13 and SOC-200 curriculum at Macksofy Trainings, an EC-Council Accredited Training Center in Mumbai, and mentors candidates through practical certification exams.
