AI Security & Safety Research

David Schmotz

Max Planck Institute for Intelligent Systems · ELLIS Institute Tübingen · Tübingen AI Center

I work on the security of AI systems that act in the world. Most of my research is offensive: I look for the attack surfaces that appear once a model can read untrusted files, call tools, and hide its own reasoning — and then measure how badly frontier systems fail against them.

The goal is defensive. Attacks that are cheap to run and easy to reproduce are the ones that get fixed, so I try to build benchmarks and demonstrations that make a vulnerability impossible to wave away.

Research

  1. Agentic AI security

    Prompt injection stopped being a toy problem the moment agents began loading third-party skills, reading repositories, and executing shell commands. I study the injection vectors that show up in real deployments, and how permission systems get bypassed by attacks that look like ordinary work.

  2. AI control & monitoring

    If a capable model cannot be trusted, the question becomes whether a weaker monitor can still catch it. I build evaluations where an untrusted agent attempts hidden sabotage in realistic R&D tasks and measure what oversight actually detects.

  3. Automated attacks with RL

    Hand-crafted jailbreaks do not scale and do not cover the space. I am interested in learned attack policies — using reinforcement learning to search for exploits automatically, so that red-teaming keeps pace with the systems it evaluates.

  4. Distillation through model APIs

    Providers hide chain-of-thought precisely because it is the raw material for distillation. I study what an interface still gives away — reasoning traces, signatures, cached state — and how cheaply that residue can be turned back into the capability it was meant to protect.

Publications

  1. 2026

    Decoding Encrypted Reasoning Traces in Proprietary LLM APIs In preparation

    Alexander Panfilov*, David Schmotz*, Ilia Shumailov, Luca Beurer-Kellner, Ameya Prabhu, Jonas Geiping, Maksym Andriushchenko

    Providers hide chain-of-thought behind opaque encrypted blobs, but those blobs are portable across sessions, users and models. We replay a captured trace into a weaker compatible model and make it transcribe the hidden reasoning verbatim — recovering a strong model's chain-of-thought without ever attacking it directly.

    A preliminary scan of publicly posted agent traces recovered 61 API keys, 36 passwords and 32 personal emails from encrypted reasoning fields.

    • Reasoning traces
    • Privacy
    • Model extraction
  2. 2026

    ResearchArena: Evaluating Sabotage and Monitoring in Automated AI R&D

    Lena Libon, Ben Rank, Jehyeok Yeon, David Schmotz, Jeremy Qin, Daniel Donnelly, Derck Prinzhorn, Maksym Andriushchenko

    A control-style benchmark for automated AI research: an untrusted agent tries to sabotage safety training, capability work, kernel and server optimisation while a monitor tries to catch it. Sabotage hidden in training data is flagged less than half the time.

    • AI control
    • Monitoring
    • Sabotage
  3. 2026

    Skill-Inject: Measuring Agent Vulnerability to Skill File Attacks

    David Schmotz, Luca Beurer-Kellner, Sahar Abdelnabi, Maksym Andriushchenko

    A benchmark of 202 attack scenarios against agents that load third-party skills, from blatant injections to subtle context-embedded ones. Frontier agents execute harmful instructions — exfiltration, destructive actions, ransomware-like behaviour — in up to 80% of cases, and scaling or input filtering does not fix it.

    • Benchmark
    • Prompt injection
    • Agent security
  4. 2025

    Agent Skills Enable a New Class of Realistic and Trivially Simple Prompt Injections

    David Schmotz, Sahar Abdelnabi, Maksym Andriushchenko

    Agent Skills let anyone ship markdown instruction files into a coding agent's context. We show malicious instructions buried in long skill files and their referenced scripts extract credentials and internal documents — and that a benign "Don't ask again" approval silently authorises closely related harmful actions.

    First demonstration of prompt injection through agent skill files.

    • Prompt injection
    • Agent skills
    • Coding agents

* denotes equal contribution.

About

My work is driven by the belief that as AI systems become more powerful and more widely deployed, their safety and reliability stop being a research curiosity and become infrastructure. I am always glad to hear from people working on adjacent problems.

I am deeply grateful to my PhD supervisor, Maksym Andriushchenko, whose guidance and generosity have shaped every project on this page.

Education

Contact

The fastest way to reach me is by email at davidschmotz@gmail.com. My full CV is available as a long or short PDF.