HackTheBox Certified Offensive AI Expert (COAE) Review

What is COAE?

The Certified Offensive AI Expert (COAE) is Hack The Box's certification for attacking AI systems. It's their first one in this space.

To qualify for the exam you complete the AI Red Teamer path on HTB Academy, which is 12 modules. After the 28 modules of the Penetration Tester path, 12 sounds like a weekend. It isn't. The modules are individually much heavier than what I was used to on Academy.

The path covers roughly:

Something to know before you buy anything: this path does not teach you application security. When a module chains into command injection or a path traversal or an XSS sink, it does that without slowing down to explain it. It expects you to already recognise it.

I came in with the PortSwigger Web Security Academy behind me, plus the HTB Academy modules that cover those same topics, so that part was fine for me. If you don't have that background, this is the wrong cert to start with, and you'll spend your time learning web fundamentals off-platform instead of learning what you paid for.

COAE Exam Overview

The format is the usual HTB setup. Fictional client, a Letter of Engagement that defines your scope, a set of tasks that you tick off through flags, and each flag carries a point value. Then a professional report on top of it.

There's no VPN this time. You point your /etc/hosts at the relevant domains and subdomains and you're working.

The 7 days are calendar days, not 7 days of you sitting at your desk, so you can fit it around a job. It's tighter than the 10 you get for CPTS, but this exam also needs less of them.

My Opinion on the Materials

My opinion here is genuinely split, so I'll take it in two halves.

If AI is new to you, this is some of the best material you'll find.

The opening modules assume nothing. They start at AI as a field, then narrow into machine learning, then deep learning, then LLMs. What a model actually is. What training actually does. Where the data comes from and what that means. How all of those words that get thrown around interchangeably actually relate to each other.

I'll say something stronger than that: this part of the path is worth reading even if you have no interest in the offensive side at all. It's a clean, well-sequenced introduction to a subject that most people in security discuss constantly and understand loosely. I came out of it with a real mental model of what I'm poking at when I'm testing an LLM, and that changed how I approach the work more than any single technique in the path did.

So on the fundamentals I have nothing bad to say. That half is excellent.

The offensive half is where I start arguing with it.

The Math Problem

The thing that frustrated me most about this path is how much math is in it.

There are sections where you are not being given intuition, you are being given notation. Formal formulas, full symbolic treatment, the university lecture version.

And I kept asking the same question while reading it: who is this for?

We're talking about pentesting AI models. Nobody in this line of work is going to sit down and learn the math. That's not a criticism of anyone, it's just what the job looks like. What a pentester needs is enough understanding to know what an attack does, why it works, what conditions have to be true for it to work, and what to look for on a target. That is a couple of paragraphs of plain English. It does not require notation.

Instead the useful part ends up sitting underneath a wall of symbols that most people in this field have never had a reason to read, and a lot of readers are going to bounce off before they reach it.

Credit where it's due: HTB does keep the concept and the implementation separate, and they hand you most of the code. In several sections you're really just connecting blocks they've already written. So the math isn't a hard requirement to finish the modules or to pass.

But that's exactly my problem with it. If you can pass without engaging with it, then it isn't load-bearing, and presenting it that heavily just makes the material feel more academic and less approachable than it actually is.

The path also leans hard on programming. Lots of Python, lots of working directly with model code. If that isn't your strong suit it'll slow you down, though realistically there's nothing in there you can't get through with an AI assistant open next to you. Which I did. Which is a slightly ridiculous sentence to write in a review of an AI security certification.

What I Actually Used at Work

I've been critical, so let me be equally clear about the good part.

Several things from this path have gone straight into real LLM engagements for me. Not "broadened my perspective". Actually used, on actual client work, and found things with.

The material on prompt injection, on how model output gets handled, and on how AI features get bolted into the rest of an application is where the money is. That third one especially. In real testing, the interesting findings are almost never about whether the model agrees to say something naughty. They're in everything around the model:

This path covers that properly, and it lines up with what you'll actually meet on an engagement.

Where I'm less sold is the model-level evasion content. It's the most interesting material in the path intellectually, and if research is what you want it's a solid on-ramp. But it mostly assumes a level of access to the model that I have never once had on a paid engagement. In the real world you get an endpoint, a chat box, maybe a rate limit and an API key. You do not get the weights. So it's fascinating reading that I don't expect to bill hours against.

Exam Experience

I'll be blunt: this was nowhere near CPTS.

CPTS is still the hardest thing I've done. Days where I got nothing. Days where I was on the right path and the environment wouldn't give me anything until I reset it. Real moments of thinking about quitting. COAE was not that experience at all. I got through it with room to spare.

The difference for me came down to how much doubt there was. On CPTS, being stuck means going back through an enormous pile of notes with no idea whether the problem is your exploit, a vulnerability class you forgot exists, or a piece of information you haven't found yet in a completely different part of the network. That doubt is what makes it brutal, and it's also what makes it feel like a real engagement.

COAE didn't put me in that position. When I was stuck, I generally knew roughly what kind of thing I was stuck on. The environment is also much tighter. There's far less of it to wander around in, so there are far fewer rabbit holes available to lose a day to.

COAE vs CPTS: how the two exams compare

I did hit some instability along the way, and I want to be upfront that I can't rule out that some of it was on my end rather than HTB's. I'm mentioning it because it shaped part of my run, not because I want to make a claim about the platform. Other people say theirs ran perfectly, and that was true for CPTS too. Everyone's experience is different.

The lesson I took from CPTS applies here just the same: if something smells broken, open a ticket early instead of spending six hours proving to yourself that you're the problem.

Is It Worth It?

Two separate questions here, and I'd answer them differently.

Is the training worth it? Yes. Without hesitation. I learned things I've since used on paid work, and the fundamentals half is better than most standalone AI introductions I've read. If AI security is something you want to get into, go through the path.

Is the certification worth it? That's the part I'm not sure about.

Certifications are a signal, and a signal only works if the person reading your CV recognises it. HTB's certs are excellent and still fairly niche, and COAE is the newest of them. Nobody I've dealt with professionally is screening candidates on it yet.

The other thing is that this particular field doesn't seem to run on certifications at all. Credibility in AI security comes from doing the work in public, writing things up, publishing research, talking about what you found. A badge doesn't substitute for that.

So my honest position is: buy it for the knowledge. If the badge is the reason you're buying it, think a bit harder about what you expect it to do for you.

Final Thoughts

COAE has the best on-ramp to AI I've come across for someone arriving from a security background, and its practical LLM material has already paid for itself in my actual work. I don't want that buried under the complaints, because it's the thing I'd tell a colleague first.

But the complaints hold:

Want to learn how to attack AI systems? Do the path.

Want a certification that opens doors? Keep your expectations low.