You will work across AI security, machine learning, and research engineering alongside the core team. You will take ownership of a technically ambitious project in agent security, from designing and implementing the approach to running experiments and communicating the results.
What you’ll work on
Develop and evaluate security environments, agent training methods, attacks, or defenses
Run controlled experiments with clear baselines and verifiable outcomes
Analyze model behavior and communicate the results to the team
Contribute code, evaluations, and research findings that remain useful after the internship
What we’re looking for
Current study or recent work in machine learning, computer science, security, or a related field
Strong programming skills and experience building or evaluating machine-learning systems
Curiosity about AI agents and the discipline to investigate failures carefully
Ability to work independently and ask for feedback early
Useful experience
LLMs, reinforcement learning, or agentic systems
Adversarial machine learning, red teaming, or AI safety evaluations
Research codebases, reproducible experiments, or open-source contributions
A previous research project, thesis, or technical publication
The entity responsible for data processing on this website is:
Exponential Security Labs GmbH Naman Singh / Anselm Paulus Horemer 24 72076 Tübingen, Germany
For questions or requests concerning your personal data, contact contact@expsec.ai.
The controller alone or jointly with others determines the purposes and means of the processing of personal data (e.g. names, contact details, etc.).
Withdrawal of Your Consent to Data Processing
Some data processing operations are only possible with your express consent. You may withdraw consent you have already given at any time. An informal notification by email is sufficient. The lawfulness of any data processing carried out before the withdrawal remains unaffected.
Right to Lodge a Complaint with the Competent Supervisory Authority
If a breach of data protection law has occurred, you have the right to lodge a complaint with the competent supervisory authority. The competent supervisory authority for data protection matters is the state data protection officer of the federal state in which our company is based. The following link provides a list of data protection officers and their contact details: https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html.
Right to Data Portability
You have the right to have data that we process automatically on the basis of your consent or in performance of a contract handed over to you or to a third party. The data is provided in a machine-readable format. If you request the direct transfer of the data to another controller, this will only be done insofar as it is technically feasible.
Right to Information, Correction, Blocking, Deletion
Within the framework of the applicable legal provisions, you have the right at any time to free information about your stored personal data, its origin, its recipients and the purpose of the data processing and, if applicable, a right to correction, blocking or deletion of this data. For this purpose, as well as for further questions on the subject of personal data, you can contact us at any time using the contact options listed in the imprint.
SSL / TLS Encryption
For security reasons and to protect the transmission of confidential content that you send to us as the site operator, our website uses SSL or TLS encryption. This means that data you transmit via this website cannot be read by third parties. You can recognise an encrypted connection by the „https://“ in your browser's address bar and by the lock symbol in the browser bar.
Server Log Files
In server log files, the provider of the website automatically collects and stores information that your browser automatically transmits to us. These are:
Page visited on our domain
Date and time of the server request
Browser type and browser version
Operating system used
Referrer URL
Hostname of the accessing computer
IP address
This data is technically necessary for us to display our website to you and to ensure stability and security. (The legal basis for the processing is Art. 6(1)(f) GDPR.) This data is not merged with other data sources.
Job Applications (Ashby and Google Workspace)
Nature and Scope of Processing
We use Ashby, Inc. to manage job applications and our recruitment process. Our role pages link to application forms hosted by Ashby. When you open an application form, your browser connects to Ashby, which receives technical information such as your IP address and browser information. When you apply, your name, email address, CV, links to profiles or work, answers to application questions, and any other information you provide voluntarily are transmitted to Ashby and made available to our hiring team.
Recruitment correspondence is received and processed through Google Workspace, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. This correspondence may also be stored in Ashby to manage the same recruitment process. Please submit applications through the application form for the relevant role.
We process this data solely for the purpose of conducting the application and selection process. It is not passed on to third parties for other purposes without your consent.
Purpose and Legal Basis
The legal basis for processing your applicant data is the initiation or establishment of an employment relationship in accordance with Art. 6(1)(b) GDPR and Section 26(1) BDSG. Insofar as you voluntarily provide us with information beyond this, the processing is carried out on the basis of your consent in accordance with Art. 6(1)(a) GDPR.
Following an unsuccessful application, limited retention to establish, exercise, or defend legal claims is based on our legitimate interests under Art. 6(1)(f) GDPR.
Transfer to Third Countries
Ashby is based in the USA, and applicant data may be processed there or by its sub-processors. Information about Ashby's processing and international transfers is available in Ashby's privacy policy. You can contact us to request information about the safeguards applicable to your applicant data.
When using Google Workspace, personal data may be transferred to servers of Google LLC in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework (EU-U.S. DPF); the transfer to the USA therefore takes place in accordance with Art. 45(1) GDPR on the basis of the adequacy decision of the European Commission. Standard contractual clauses (Art. 46(2)(c) GDPR) are used as an additional safeguard.
Storage Period
Your applicant data is stored for the duration of the application process. If no employment relationship is established, we delete it no later than six months after you receive our rejection or withdraw your application. Longer storage requires a separate basis, such as your explicit consent to a talent pool, a statutory obligation, or an ongoing legal claim. For more information, please see Google's privacy policy: https://policies.google.com/privacy.
Cloudflare CDN
Nature and Scope of Processing
To properly deliver the content of our website, we use Cloudflare CDN. Cloudflare CDN is a service provided by Cloudflare, Inc., which functions as a content delivery network (CDN) on our website.
A CDN helps to deliver the content of our online offering, in particular files such as graphics or scripts, more quickly with the help of regionally or internationally distributed servers. When you access this content, you establish a connection to servers of Cloudflare, Inc., whereby your IP address and, where applicable, browser data such as your user agent are transmitted. This data is processed exclusively for the purposes stated above and to maintain the security and functionality of Cloudflare CDN.
Purpose and Legal Basis
The use of the content delivery network is based on our legitimate interests, i.e. an interest in the secure and efficient provision and optimisation of our online offering in accordance with Art. 6(1)(f) GDPR.
We intend to transfer personal data to third countries outside the European Economic Area, in particular the USA. The transfer of data to the USA takes place in accordance with Art. 45(1) GDPR on the basis of the adequacy decision of the European Commission. The US companies involved and/or their US sub-processors are certified under the EU-U.S. Data Privacy Framework (EU-U.S. DPF).
Storage Period
The specific storage period of the processed data cannot be influenced by us, but is determined by Cloudflare, Inc. For more information, please see the privacy policy for Cloudflare CDN: https://www.cloudflare.com/privacypolicy/.