AI Red Teamer Path Review (HTB Academy)
Created: 2026-07-04
Updated: 2026-07-04
I started this path a little before it actually became a path. It has shaped a lot of my work (End of year projects 1 & 2), as well as my vision when it comes to AI.
Here is my experience with the AI Red Teamer Path on HackTheBox.
Path Description and Modules
The AI Red Teamer Job Role Path is a collaboration between HTB and Google, built to train students and professionals in assessing, attacking, and securing AI systems. It’s made up of 12 modules that take you from the fundamentals all the way to advanced attack and defense techniques :
- Fundamentals of AI
- Applications of AI in InfoSec
- Introduction to Red Teaming AI
- Prompt Injection Attacks
- LLM Output Attacks
- AI Data Attacks
- Attacking AI – Application and System
- AI Evasion – Foundations
- AI Evasion – First-Order Attacks
- AI Evasion – Sparsity Attacks
- AI Privacy
- AI Defense
Skills Aqcuired
Fundamentals
The first couple of modules cover a lot of fundamentals when it comes to AI theory, mathematics and development lifecycle. While the first is pure theoretical knowledge, covering notions like Supervised vs Unsupervised learning, Reinforcement learning, Deep learning and GenAI, the second guides you to build different classifiers following through the entire pipeline from raw data to fully functional models.
This gave me a solid foundation, one I kept leaning on both for the rest of the path and for some of my classes at school.
Offensive
8 out of 12 modules cover Red Teaming content.
Attack Surfaces
One thing about these modules is that they collectively altered the way I think about testing an AI system. More precisely, I shifted my focus from the prompt itself to seeing the system in terms of attack surface. Yes, prompting is important (don’t get me wrong I have improved my prompting skills thanks to the course), but a valuable realization for me was that the model itself is just one component in a much broader landscape: the data it was trained on, the application wrapped around it and the infrastructure running underneath. Each layer had its own specificity and could fail under different stresses.
Everything LLMs
On the LLM side specifically, prompt injection and jailbreaking get a lot of coverage online but what stuck with me more was everything that sits underneath the obvious stuff. Indirect injection through data the model processes rather than what the user types directly, exfiltration techniques aimed at leaking the system prompt, abuse attacks that turn the model’s own fluency into a weapon. By the end, jailbreaking felt less like a collection of one-liners and more like a structured methodology with real sub-categories.
Everything Data
The part that demanded the most from me was the data layer. Poisoning attacks, trojan/backdoor injection, clean-label attacks that corrupt a model’s behavior without touching the labels at all , these forced me to think about the full lifecycle of an AI system, not just its runtime behavior. What was it trained on, and can that foundation be compromised before the model ever ships? That’s a different question than anything I was used to asking.
Math Math Math
The evasion trilogy is where the math became unavoidable. FGSM, DeepFool, JSMA, EAD, working through these properly meant getting comfortable with norm constraints, gradient computation, and what it actually means to find a minimal perturbation that crosses a decision boundary. It took time, and I leaned on external resources more than any other part of the path. But the intuition I came out with,being able to reason about why a model can be fooled at a geometric level, not just that it can, felt like a real shift in how I think about these systems. And that’s why this part of the path influenced my second year’s final project and pushed me to research way more advanced techniques beyond what the course is providing. If you’d like to check out my project, I have it all documented in this blog post: From Adversarial Attacks to Defensive Design - A Red Teaming Approach to AI Security (PFA2 PROJECT)
The last thing worth flagging is MCP and agentic attack surfaces. Given where I’m currently pointed with my own work, this was the section that felt most immediately applicable. It’s also the least settled area in the field, which makes it the most interesting one to keep following.
Defensive
The path’s name suggests it is attack-oriented, and it is biased in that sense (2 fundamentals modules, 8 offensive and only 2 dedicated to the defensive part), but that framing doesn’t tell the whole story because defense shows up throughout the offensive modules too, not just at the end. Every attack section is paired with mitigations, so by the time you reach the dedicated defense content, you’re not starting from zero.
The two explicit defense modules cover two distinct layers. AI Privacy focuses on the training side: membership inference attacks and why overfitting causes models to leak information about their training data, then the two main technical countermeasures: DP-SGD and PATE. Both come with real utility tradeoffs, and the module doesn’t gloss over that. Privacy costs accuracy, and understanding that concretely changes how you think about recommending mitigations rather than just listing them.
AI Defense covers the application layer: guardrails, adversarial training, adversarial tuning. A really nice summary to the entire path as it covers defenses, in addition to ways of breaking them.
Two modules out of twelve is light if you came here to learn how to secure AI systems. But that’s not really the point of the path, and for red teaming purposes, the defensive coverage does exactly what it needs to: enough to understand what you’re up against, and enough to write something meaningful at the end of an engagement.
Favourite Modules
My two favourite modules have to be Prompt Injection Attacks and LLM Output Attacks, simply because they were sort of “gamified” challenges, and as someone new to this field, it helped me stay consistent and not give up. Another plus is that these modules leverage some web exploitation skills, so they keep you engaged because you’re practically applying similar techniques in a different scope.
Rating
Definitely 5 Stars.
⭐⭐⭐⭐⭐
Well-structured, challenging and overall enjoyable.
I can’t wait to get my hands on the associated COAE certification.
Can I borrow $210 ?
:)))
Please share with your friends !