On 20 July 2026, I officially passed the Hack The Box Certified Offensive AI Expert (COAE) exam and became the first Malaysian to earn the certification. That made the result feel even more special to me.
Straight to the point, I think the certification is worth the money. The material is broad, the labs are practical and it goes much deeper than basic prompt injection. My biggest complaint is the amount of math in the course. Some of it felt unnecessarily tedious for an offensive security certification, and I do not think you need to master every formula to pass. Understand the theory, know what the techniques are doing and focus on applying them.
Useful and impressively broad, but too dense and math-heavy in places.
A challenging, practical assessment that rewards a solid methodology.
What Is the COAE?
COAE is the certification attached to Hack The Box Academy’s AI Red Teamer job-role path. At the time of writing, the path contains 12 modules and more than 200 sections covering the offensive and defensive sides of AI security.
The scope is much wider than LLM security. Across the path, you will encounter:
- AI and machine learning fundamentals
- Python, Jupyter, scikit-learn and PyTorch
- Direct and indirect prompt injection
- Jailbreaking and insecure LLM output handling
- AI agents, tool abuse and Model Context Protocol (MCP)
- Data poisoning, backdoors and malicious model artifacts
- Adversarial machine learning and model evasion
- AI privacy, guardrails and defensive concepts
The exam is a seven-day practical assessment followed by a professional technical report. There are no multiple-choice questions, and one voucher includes two attempts.
The Course
The opening modules cover machine learning fundamentals, model training, datasets, preprocessing, evaluation metrics and common architectures. They give you the vocabulary needed for the later attacks. You do not need to be an AI engineer, but basic Python skills and the ability to read unfamiliar code will help a lot.
The LLM, agent and application-security material was the most immediately relevant part of the path for me. It covers direct and indirect prompt injection, jailbreaking, tool abuse, insecure output handling and traditional web vulnerabilities chained through LLM applications. The MCP content is especially important because it teaches you to assess the complete application, including the tools, data and actions connected to the model, instead of staring endlessly at the chat box.
The path also moves into poisoning datasets, manipulating labels, planting backdoors and abusing model artifacts. These modules make it clear that the attack surface includes the data, training pipeline, model files and deployment process, not just the visible application. The labs are properly hands-on, so you will modify code, observe model behavior, troubleshoot failures and work out why an attack succeeded.
Then you reach the math dungeon. The adversarial machine learning modules explain how carefully chosen changes to an input can cause a model to make the wrong prediction. The ideas are interesting, but the course leans too heavily into gradients, optimization and perturbation mathematics for the average pentester or red teamer. This became dumb and tedious for me at times.
My advice is to skim the densest equations if they are stopping your progress. Based on my experience, you do not need to understand the math in depth to pass. Know what each technique does, why it works, when to use it and how to adapt the methodology. Do not skip the practical evasion material, because it is important for the exam. The final modules then cover privacy attacks, guardrails, adversarial training and other defensive concepts, which help you explain root causes and recommend useful remediation.
What the Course Gets Right
COAE could easily have been a shallow course rushed out during the AI hype cycle, but it is not. Hack The Box treats AI security as a complete discipline involving applications, models, data and infrastructure. The best sections make you build, break and debug actual systems. The skill assessments feel closer to CTF challenges than knowledge checks, forcing you to combine techniques instead of repeating a command from the previous page.
The inclusion of agents, tool use and MCP also makes the path relevant to systems being deployed now. It teaches an important lesson: AI vulnerabilities rarely exist in isolation. The interesting attack paths appear when a model is connected to APIs, databases, tools and traditional web applications.
Considering the amount of material, the practical labs, two exam attempts and a real reporting component, I think COAE offers good value. The Silver Annual subscription is especially attractive if you also plan to use Academy for other paths.
What Could Be Better
The amount of math is easily my biggest issue. Adversarial ML belongs in an expert-level AI security path, but the balance between mathematical detail and operational application could be much better. The difficulty can also jump sharply between modules. Some pages seem to expect familiarity with PyTorch and machine learning research while the path is still teaching those foundations.
The environments can test your patience too. AI-backed labs do not always behave like normal web targets. Model responses and cloud environments can be slow or inconsistent, and sometimes a reset is the most productive troubleshooting step. These issues are why I rate the course a 6/10 even though its overall coverage is strong.
The Exam, Without Spoilers
I will not discuss targets, flags, exact objectives or attack chains. The exam is still active and ruining it for future candidates would be lame. At a high level, though, the format is exactly what I want from a technical security certification. You are given a realistic environment, asked to identify and exploit weaknesses, and expected to turn your work into a commercial-grade report. The course gives you the techniques, but the exam expects you to recognize where and how to apply them.
The difficulty felt fair for an expert-level certification and rewards methodology more than memorization. If you treat every target as “just prompt injection,” you will get stuck. Step back, map the full application, understand the data flow and look at how the model interacts with the surrounding components.
The reporting requirement is not an afterthought. Document as you go, capture clean evidence, record reproduction steps, explain the root cause and propose remediation that matches the actual issue. Leaving all of that until the final day is an excellent way to turn a fun exam into a miserable writing marathon. Overall, the exam was the strongest part of the certification and earns a 9/10 from me.
How I Would Prepare
- Have some web pentesting knowledge. Be comfortable with Burp Suite, requests, APIs, authentication, access control and common web vulnerabilities. Weak web fundamentals can make you struggle before reaching the AI-specific attack.
- Be comfortable with Python and Jupyter. You should be able to read, edit and debug scripts. Keep tested notebook examples organized by attack type so you can adapt them later.
- Understand MCP properly. Learn how clients, servers, tools, resources and prompts interact. If you only understand prompt injection at the chatbot level, the wider application can become confusing.
- Take the evasion modules seriously. You can skim the densest equations, but understand the workflow, preprocessing, constraints and how to confirm an adversarial input succeeded. Weak MCP or evasion knowledge will make the exam much harder.
- Focus on data flow and methodology. Know what enters the system, how it is transformed, what the model sees and where its output goes next.
- Take useful notes and document the exam as you go. Record assumptions, inputs, expected outputs and common failure modes during the course. During the exam, capture clean evidence and reproduction steps while they are fresh.
Once you have finished the path and understand the attack workflows, take the exam. Your voucher includes two attempts. I would rather skim the math, finish the labs and make an honest attempt than burn out trying to master every symbol.
Was It Worth It?
For me, yes. The course is technically deep, the practical work is strong and the exam validates more than surface-level LLM knowledge. Passing it does not make someone an AI security expert overnight, but it does show that they can work through a broad AI attack surface and communicate the results professionally.
My biggest criticism remains the math. I question how much of that depth is useful for most real pentests, and several sections could be shorter without weakening the path. Even so, I would rather have a course that is slightly too deep than one that sells AI hype with no substance. COAE is not perfect, but it is one of the more interesting certifications I have completed. If you are interested in where offensive security is heading, it is worth your time and money.
And if the equations start looking like ancient lobster runes, skim them, understand the attack at a high level and keep moving.
