AI Security & Safety Research
David Schmotz
Max Planck Institute for Intelligent Systems · ELLIS Institute Tübingen · Tübingen AI Center
I work on the security of AI systems that act in the world. Most of my research is offensive: I look for the attack surfaces that appear once a model can read untrusted files, call tools, and hide its own reasoning — and then measure how badly frontier systems fail against them.
The goal is defensive. Attacks that are cheap to run and easy to reproduce are the ones that get fixed, so I try to build benchmarks and demonstrations that make a vulnerability impossible to wave away.
Research
-
Agentic AI security
Prompt injection stopped being a toy problem the moment agents began loading third-party skills, reading repositories, and executing shell commands. I study the injection vectors that show up in real deployments, and how permission systems get bypassed by attacks that look like ordinary work.
-
AI control & monitoring
If a capable model cannot be trusted, the question becomes whether a weaker monitor can still catch it. I build evaluations where an untrusted agent attempts hidden sabotage in realistic R&D tasks and measure what oversight actually detects.
-
Automated attacks with RL
Hand-crafted jailbreaks do not scale and do not cover the space. I am interested in learned attack policies — using reinforcement learning to search for exploits automatically, so that red-teaming keeps pace with the systems it evaluates.
-
Distillation through model APIs
Providers hide chain-of-thought precisely because it is the raw material for distillation. I study what an interface still gives away — reasoning traces, signatures, cached state — and how cheaply that residue can be turned back into the capability it was meant to protect.
Publications
-
ResearchArena: Evaluating Sabotage and Monitoring in Automated AI R&D
A control-style benchmark for automated AI research: an untrusted agent tries to sabotage safety training, capability work, kernel and server optimisation while a monitor tries to catch it. Sabotage hidden in training data is flagged less than half the time.
-
Skill-Inject: Measuring Agent Vulnerability to Skill File Attacks
A benchmark of 202 attack scenarios against agents that load third-party skills, from blatant injections to subtle context-embedded ones. Frontier agents execute harmful instructions — exfiltration, destructive actions, ransomware-like behaviour — in up to 80% of cases, and scaling or input filtering does not fix it.
-
Agent Skills Enable a New Class of Realistic and Trivially Simple Prompt Injections
Agent Skills let anyone ship markdown instruction files into a coding agent's context. We show malicious instructions buried in long skill files and their referenced scripts extract credentials and internal documents — and that a benign "Don't ask again" approval silently authorises closely related harmful actions.
First demonstration of prompt injection through agent skill files.
* denotes equal contribution.
About
My work is driven by the belief that as AI systems become more powerful and more widely deployed, their safety and reliability stop being a research curiosity and become infrastructure. I am always glad to hear from people working on adjacent problems.
I am deeply grateful to my PhD supervisor, Maksym Andriushchenko, whose guidance and generosity have shaped every project on this page.
Education
- 2025 – PhD — advised by Maksym Andriushchenko, at the Max Planck Institute for Intelligent Systems, the ELLIS Institute Tübingen and the Tübingen AI Center
- 2023 – 2024 University of Cambridge — Part III, MASt in Mathematics
- 2022 ETH Zürich — Visiting student, Mathematics
- 2018 – 2023 University of Göttingen — BSc Mathematics & BSc Computer Science
Contact
The fastest way to reach me is by email at davidschmotz@gmail.com. My full CV is available as a long or short PDF.