HTB COAE prep: rehearse the LLM and practical half, hands-on.

Hack The Box's Certified Offensive AI Expert (COAE) ends in a 7-day hands-on practical against live AI systems. It spans two halves: an LLM / application side and a deep adversarial-ML math side. Attaxium is a hands-on lab for the LLM and practical half: prompt injection, LLM output, data and system attacks, so you rehearse that part on real targets before exam day. (For COAE's adversarial-ML mathematics, use HTB's own modules.)

What the HTB COAE exam covers

COAE is the capstone of Hack The Box's AI Red Teamer path, built with Google and aligned to the Secure AI Framework (SAIF). Its twelve modules run from AI fundamentals into two halves: the LLM / application side (prompt injection, LLM output attacks, AI data attacks, application and system attacks) and a heavily mathematical adversarial-ML side: the “evasion trilogy” of gradient-based attacks (FGSM, DeepFool, JSMA, EAD), plus data poisoning, membership inference and differential privacy. The exam is a 7-day practical engagement with a commercial-grade report.

Where Attaxium helps with COAE, and where it doesn't

Be honest about the fit: Attaxium is strongest on COAE's LLM and system half: prompt injection, LLM output exploitation, data and application/system attacks, and the hands-on tradecraft of attacking a live AI environment under time. That is real, transferable practice for a large part of the exam.

What Attaxium does not teach is COAE's deep adversarial-ML mathematics: the gradient-based evasion trilogy (FGSM, DeepFool, JSMA, EAD), membership inference and differential privacy. For that half, use HTB's own modules; use Attaxium to rehearse the LLM/practical side hands-on. If your focus is production-infrastructure red teaming (RAG, agents, MCP, deployment), the closer match is the OffSec OSAI (AI-300) exam, which Attaxium maps to much more completely.

The chapters that overlap with COAE

These map to COAE's LLM, data and system modules (its adversarial-ML math is out of scope here):

▸Ch 1 · The AI Attacker's Mindset. Why classic tradecraft falls short on AI-integrated orgs, and where the new attack surface really lives. MITRE ATLAS, OWASP LLM Top 10, the AI kill chain.
▸Ch 2 · Mapping the AI Attack Surface. Fingerprint deployed models, enumerate agents and RAG pipelines, and harvest exposed keys and deploy tokens, quietly.
▸Ch 4 · Hijacking LLM Agents. Direct and indirect prompt injection, jailbreaks, guardrail evasion, and poisoning an agent's long-term memory.
▸Ch 5 · Poisoning RAG & Knowledge Pipelines. Plant instructions in documents, leak across users, defeat redaction, and read the retrieval trace to reconstruct the corpus.
▸Ch 8 · Weaponizing the Model Supply Chain. Backdoored weights and adapters, pickle-deserialization RCE, poisoned training data, and mining the model repo.
▸Ch 9 · Popping Model Servers & AI Infra. Exploit the serving stack itself: model-server bugs, SSRF, cloud IAM chains, and Kubernetes ML workloads.
▸Ch 11 · Full-Chain Engagement. One realistic environment, no hand-holding: recon → exploit → pivot → post-exploitation, end to end.

Why a lab beats reading the modules twice

HTB's modules are strong reference material, but a practical exam is passed with hands on keys, not more reading. Attaxium gives you deliberately-vulnerable AI targets you spin up on demandand break for yourself, with the solution hidden behind a spoiler so you attempt it first, the rehearsal the reading can't provide.

Frequently asked questions

Attaxium is an independent training provider and is not affiliated with, endorsed by, sponsored by, or otherwise associated with OffSec or Hack The Box. OSAI, AI-300, OSCP, HTB and COAE are trademarks of their respective owners and are referenced here only to describe the certifications this material helps you prepare for.