> For the complete documentation index, see [llms.txt](https://eslam3kl.gitbook.io/blog/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://eslam3kl.gitbook.io/blog/certificates-reviews/htb-certified-offensive-ai-expert-coae.md).

# HTB Certified Offensive AI Expert - COAE

Quick and honest review of COAE without wasting your time :)

## Certificate & Badge

I was honored to be among the first professionals to earn the COAE certification. **At the time of writing this**, only 22 people worldwide have successfully achieved it :tada:

<figure><img src="https://3235815904-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FaajIXL4hyMVEViygzqgu%2Fuploads%2FFiC8Ai52yp5ptU7S3DEh%2FBadge.png?alt=media&amp;token=a954cf9c-14ca-4ef4-acf2-46af1e9ed1f5" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3235815904-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FaajIXL4hyMVEViygzqgu%2Fuploads%2FlSbkBkRGFZ26jAjqHo70%2Fcertificate.png?alt=media&amp;token=1950023d-0aa5-48da-ae39-34011b2f82d9" alt=""><figcaption></figcaption></figure>

## Why COAE?&#x20;

What makes COAE different from traditional certifications is that it doesn’t focus on theory alone. Instead, it dives deeply into practical offensive security techniques against AI systems and Large Language Models (LLMs). With AI becoming integrated into almost every modern application, understanding how these systems can be attacked is becoming a very valuable skill for red teamers and security researchers.

## Exam Details

* The exam duration is 7 days, including testing and reporting.
* The exam is not proctored, so you are free to conduct your own research during the assessment.
* Passing requires at least 85/100 points, at least in my case.
* Submitting flags alone is not enough to pass, a professional report is required, documenting your methodology, findings, and attack paths.
* You are also expected to include the scripts, payloads, and techniques used during the engagement.
* The report should demonstrate how vulnerabilities were chained together to achieve maximum impact.

## Honest Opinion

I found the exam to be hard but doable with the right mindset and preparation. It really tests your ability to think like a real attacker and document everything properly, not just solve isolated tasks.

Most of the challenges felt realistic, although I would say one or two had a more CTF-style design rather than a fully real-world scenario. Still, overall it stays close to practical offensive security work.

The exam duration is fair, with 7 days allocated for both solving and reporting. The reporting part is well structured and usually takes up to a day. I used the provided format and simply filled in the details like descriptions, screenshots, risks, and so on, which made the process smooth and straightforward.

That leaves almost 6 days for collecting flags, which feels balanced. The overall difficulty is hard but manageable if you approach it methodically.

Finally, one thing that can really help during the exam is having strong personal course notes. Building well-structured notes for scripts, core attack patterns, prompts, and techniques makes a big difference when you need to quickly recall or reuse methods during the assessment.

Thanks for taking the time to read this.&#x20;