How to show Hash-Then-Encrypt is not AE-secure (E,D) is a CPA-secure cipher defined over (K,M,C).H: C → T is collision resistant hash functions.
E(k,m):=E(k,m), H(c)), D=(k,c1,c2):=D(k,c1) if H(c1)==C2 otherwise Reject.
ps:the question is from the book  &lt;A Graduate Course in Applied Cryptography[Boneh]&gt; exercise 9.2
can use cpa and cca to proof
first one is simple as ${H_1(m)}$ leaks the information about the message in the ciphertext. So it is not CPA secure.

second one , the scheme will be under CCA. as @SEJPM mentioned attacker can modify the c1 such that new ciphertext c2 will be the result of ${H_2(c1)=c2}$, so ciphertext integrity is not preserved, required in AE.