HTB COAE: Course And Certification Review

I recently passed the Hack The Box Certified Offensive AI Expert (COAE) exam. It took me about two days to complete, and I submitted my report with four days and 20 hours remaining.

The course material was intimidating because of how much math it contained. I found the exam easier than CWEE, although that might be because I’d already completed CWEE before taking this one.

I think COAE is a great learning experience for people who want to learn more about attacking AI systems. As with my CWEE review, I’ll cover the course, the exam, and some recommendations without sharing exam targets, flags, or solutions.

At A Glance


Provider	Hack The Box Academy
Course	AI Red Teamer Job Role Path
Certification	HTB Certified Offensive AI Expert (COAE)
Path structure	12 modules, 230 sections
Path difficulty	Hard
Exam format	Seven-day practical AI security assessment
Deliverable	Professional technical report
My reporting tool	SysReptor
My completion time	About two days
Time remaining when I submitted	Four days and 20 hours
My result	Passed

The AI Red Teamer path, COAE announcement, and report requirements have more detail on the format. These details reflect September 2026. Check the Academy portal before starting your attempt.

Part 1: The AI Red Teamer Path

Overall Course Review

The AI Red Teamer path starts with how AI models work and moves into attacks against models, data, applications, and infrastructure. HTB developed it in collaboration with Google and aligned it with Google’s Secure AI Framework (SAIF).

There is quite a bit to work through. The early modules cover preparing data, training models, and evaluating results. Later modules use that foundation to explain how those systems can be attacked. If you are coming from application security, expect to spend time learning the model side of the system too.

The Math Can Be Intimidating

The amount of math stood out to me. It’s something I’d want someone considering the course to know before starting. There is a lot more going on than sending different prompts to a chatbot.

For example, the evasion material gets into gradients and limits on how much an input can change. AI Privacy covers membership inference and differential privacy. Those topics take the course into how models learn, make predictions, and expose information about their training data.

I’d recommend working through the examples alongside the theory. Look at what the code changes and how the result is measured. If a section isn’t making sense, spend more time with it before moving on. Completing the module is only useful if you can still understand and apply the material afterward.

Course Structure

The path contains 12 modules and 230 sections. These are the main areas it covers:

Module	Main Focus
Fundamentals of AI	Learning methods and core model concepts
Applications of AI in InfoSec	Python environments, datasets, training, and evaluation
Introduction to Red Teaming AI	Assessing models and their supporting components
Prompt Injection Attacks	Manipulating LLM instructions and behavior
LLM Output Attacks	Insecure consumption of generated output
AI Data Attacks	Poisoning, backdoors, and model artifact risks
Attacking AI - Application and System	Application vulnerabilities, infrastructure, and MCP security
AI Evasion - Foundations	Input manipulation against model predictions
AI Evasion - First-Order Attacks	Using gradients to construct adversarial inputs
AI Evasion - Sparsity Attacks	Changing a limited set of input features
AI Privacy	Membership inference and privacy defenses
AI Defense	Adversarial training, tuning, and LLM guardrails

The full syllabus is available on the AI Red Teamer path page.

Working Through The Material

In Applications of AI in InfoSec, you prepare data, train models, and evaluate results using Python, JupyterLab, scikit-learn, and PyTorch.

That helps put the later attacks in context. If a prediction changes, you need to understand what the model received, what happened to the input before it reached the model, and how the result compares with normal behavior.

I would approach the labs the same way I recommend approaching other exploitation practice: read the code, understand the assumptions, and make sure you can explain why the result happened. Keep those explanations with your notes so you can come back to them later.

The Application Around The Model Still Matters

The application and system module brings the work back to access control, injection, deployment configuration, and MCP security.

An AI application still has permissions, APIs, storage, dependencies, and code that decides what happens next. A model response may end up in a database query, a command, or a tool call. The security review needs to follow it far enough to understand the consequence.

This is where the material connects to product security work. You still need to understand which input is trusted, what permissions are available, and where a missing or weak control could let someone do something they shouldn’t.

The path also includes AI Defense, covering adversarial training, tuning, and LLM guardrails. For someone working on the defensive side, being able to connect an attack to a possible fix is an important part of the learning.

Part 2: The COAE Certification

Certification Overview

If you’re not familiar with COAE, it is a seven-day practical assessment in a simulated corporate environment. You assess AI systems and document the work in a professional technical report.

Before getting started, read through the briefing and make sure you understand the scope, the deadline, and the reporting requirements.

My Exam Experience

I completed the exam in about two days and submitted with four days and 20 hours remaining. That time covers the exam, not the course and preparation.

For comparison, CWEE took me most of the available exam window. I didn’t get my first flag until day four, and I submitted the report with only a few hours left. With COAE, I had already submitted before that point.

The shorter exam experience doesn’t change my opinion of the course. I still think there is a lot of value in working through the material and learning how these attacks work.

The Report Is Part Of The Work

I used SysReptor for the COAE report, the same reporting platform I used for CWEE.

I’d recommend documenting as you go. Your report needs to explain the access you had, what you controlled, the steps you took, and the evidence showing the result. For model behavior, include the inputs, relevant settings, and enough context to explain what changed from the baseline.

I underestimated reporting during CWEE. It took multiple long days even though I had collected notes and screenshots. That is advice I’d carry into any practical exam: leave yourself time to write and review the report, and test the export process before you need it.

COAE Compared With CWEE

I felt that COAE was easier, but having completed CWEE first may have helped. CWEE was my first HTB certification exam, so even starting the instances and figuring out the exam process was new to me then.

As I described in my CWEE review, that exam demanded source review, application logic, custom exploit code, and long exploitation chains. The COAE path adds model behavior, data attacks, evasion, and privacy to the application security work.

I wouldn’t use my completion time alone to decide which one to take. Look at the material and the skills you want to build. Someone with a different background could have a different experience with either exam.

Preparation And Recommendations

Be Comfortable Reading And Writing Python

Be comfortable reading Python and working in notebooks. HTB lists Python, Jupyter, and neural network concepts among the evasion prerequisites, and AI Privacy also expects familiarity with PyTorch and model evaluation.

While working through a lab, make sure you understand the code that prepares the data and measures the result. Try changing an input and explaining what happened. Being able to modify the example is useful practice for applying the same idea somewhere else.

Keep Notes You Can Use Again

Keep the preconditions alongside the code. Record what access the attack needs, what it changes, what worked, and what the result proves.

You may understand all of that while working through the module, but it is easy to forget the details later. A working script and a short explanation of its assumptions will be more useful than a payload with no context.

Document As You Go

Save the relevant requests, scripts, inputs, outputs, and configuration while you are working. For experiments affected by randomness, record the seed where applicable and note whether repeated runs behave consistently.

Write down the steps while you can still reproduce them. If you capture a screenshot, explain what it shows and why it matters. The person reading your report should be able to follow the work without having been there while you did it.

Prepare The Environment And Reporting Workflow

Use the course to get your environment working. HTB recommends a local setup in its environment guidance. The AI Defense module also explains which training exercises are optional and can require more powerful hardware.

Generate a test report before starting the exam. Check the code blocks, screenshots, headings, and links in the exported file. Leave time to read the finished report before submitting it.

Who Is COAE For?

I think COAE is a good fit for people who want practical experience attacking AI systems. For application and product security engineers, the course expands the work into models, training data, and the ways those components can fail.

If you already know web security, you may need to spend more time on Python and machine learning. If you work with models, you may need more practice with application security and reporting. Either way, I would look through the syllabus and make sure you’re willing to spend time on the unfamiliar parts.

Final Verdict

Overall, I think COAE is a great learning experience for people who want to learn more about attacking AI systems. The math can be intimidating, but I would still recommend working through the course. Take the time to understand the material, keep notes you can use again, and give the report the attention it needs.

For related material, see my CWEE course and certification review and AI Security Review Notes.