COAE Study Tracker

A day-by-day path through the AI Red Teamer Job-Role Path: 12 modules, 230 sections, ending with the 7-day COAE exam.

Start date: Timeline:

0%Complete

0 / 0 tasks done

Days Done

of 30

Best Streak

days in a row

—

Today Is

not started

—

Current Phase

Set your start date to begin tracking your pace.

Weekly Progress

Phase Breakdown

What is the HTB COAE?

The HTB Certified Offensive AI Expert (COAE) is Hack The Box's professional certification for AI red teaming, launched in April 2026. It tests advanced, hands-on skills in attacking and securing AI and ML systems, and was built with Google to align with Google's Secure AI Framework (SAIF).

You earn it by completing the AI Red Teamer Job-Role Path (12 modules, 230 sections, rated Hard) and then passing the exam. You have to finish 100% of the path before the exam unlocks.

The exam

The COAE exam is a 7-day practical engagement: you assess a complex AI-driven infrastructure, then submit a commercial-grade technical report. It covers adversarial ML, LLM prompt injection and jailbreaking, LLM output exploitation, AI application and system security, AI privacy, and AI defense.

HTB recommends the Silver Annual subscription, which includes the full path plus an exam voucher. You get a second attempt only if you submitted a report on the first, and results with feedback arrive within 20 business days.

The 12 modules in order

AI/ML Core: Fundamentals of AI · Applications of AI in InfoSec
LLM Attacks: Introduction to Red Teaming AI · Prompt Injection Attacks · LLM Output Attacks
Data & System Attacks: AI Data Attacks · Attacking AI - Application and System
Adversarial Evasion: AI Evasion - Foundations · AI Evasion - First-Order Attacks · AI Evasion - Sparsity Attacks
Privacy & Defense: AI Privacy · AI Defense

Top tips from people who passed

Treat the report as half the exam. Flags alone won't earn the COAE, so use the official template in SysReptor, add clear screenshots, and explain what you tested and how you confirmed it. (0xsaboten, dragkob)
Write it so someone could reproduce it. Report findings separately, show how they chain together, and move large scripts to appendices. (ByteBreach)
Budget extra time for the math. The First-Order and Sparsity evasion modules are the heaviest, so decode unfamiliar symbols as you go. (dragkob, Jacob Krell)
Code along instead of just reading. Solve the exercises in your own Jupyter notebooks and keep a reusable code block for every technique. (Jacob Krell)
Shore up web basics first. Command injection, path traversal, and XSS come up, so do PortSwigger's Web Security Academy or similar before you start. (ByteBreach, Dušan Jevtić)

The full list of tips is at the bottom of the Resource Library tab.

How to use this tracker

Set your start date at the top. Every day's calendar date and your pace indicator are computed from it.
Pick a timeline (30/35/45/70/90 days). They all cover the same curriculum, just packed into more or fewer days, and your progress carries across when you switch.
Tick each task as you finish it. A day is marked complete when all its tasks are done.
Use the Notes field on each day as a journal for what you learned, payloads that worked, and things to revisit.
All progress is saved in your browser. Use Export backup regularly to keep a copy.

Don't rush the Hard modules. AI Data Attacks and the three evasion modules are the steepest stretch of the path, so budget extra time there, rebuild the key attacks yourself in PyTorch, and practice the report before exam week. If you fall behind, extend the timeline rather than skipping the hands-on labs.

This is an independent study aid and is not affiliated with or endorsed by Hack The Box. Always confirm current module counts, exam format, and pricing on the official HTB Academy site.

Forked from mattrfield's coae-study-tracker.