As AI agents take on high-stakes decisions and research, security must be built into how they are trained and evaluated.
Build security environments
Complex, realistic multi-agent scenarios with live services, persistent state, and verifiable outcomes.
Adversarial training
Attacker and defender agents are trained against one another inside these environments.
Adaptive benchmarking
We use the resulting agents to benchmark how other AI agents operate under realistic adversarial conditions.
Built on years of AI safety research.
Our team has worked on AI safety and security for nearly a decade, with more than 20 papers at leading AI conferences over the last five years. Our work includes contributions to the International AI Safety Report and benchmarks such as AgentHarm, OS-Harm, JailbreakBench, and RobustBench.
The entity responsible for data processing on this website is:
Exponential Security Labs GmbH Naman Singh / Anselm Paulus Horemer 24 72076 Tübingen, Germany
For questions or requests concerning your personal data, contact contact@expsec.ai.
The controller alone or jointly with others determines the purposes and means of the processing of personal data (e.g. names, contact details, etc.).
Withdrawal of Your Consent to Data Processing
Some data processing operations are only possible with your express consent. You may withdraw consent you have already given at any time. An informal notification by email is sufficient. The lawfulness of any data processing carried out before the withdrawal remains unaffected.
Right to Lodge a Complaint with the Competent Supervisory Authority
If a breach of data protection law has occurred, you have the right to lodge a complaint with the competent supervisory authority. The competent supervisory authority for data protection matters is the state data protection officer of the federal state in which our company is based. The following link provides a list of data protection officers and their contact details: https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html.
Right to Data Portability
You have the right to have data that we process automatically on the basis of your consent or in performance of a contract handed over to you or to a third party. The data is provided in a machine-readable format. If you request the direct transfer of the data to another controller, this will only be done insofar as it is technically feasible.
Right to Information, Correction, Blocking, Deletion
Within the framework of the applicable legal provisions, you have the right at any time to free information about your stored personal data, its origin, its recipients and the purpose of the data processing and, if applicable, a right to correction, blocking or deletion of this data. For this purpose, as well as for further questions on the subject of personal data, you can contact us at any time using the contact options listed in the imprint.
SSL / TLS Encryption
For security reasons and to protect the transmission of confidential content that you send to us as the site operator, our website uses SSL or TLS encryption. This means that data you transmit via this website cannot be read by third parties. You can recognise an encrypted connection by the „https://“ in your browser's address bar and by the lock symbol in the browser bar.
Server Log Files
In server log files, the provider of the website automatically collects and stores information that your browser automatically transmits to us. These are:
Page visited on our domain
Date and time of the server request
Browser type and browser version
Operating system used
Referrer URL
Hostname of the accessing computer
IP address
This data is technically necessary for us to display our website to you and to ensure stability and security. (The legal basis for the processing is Art. 6(1)(f) GDPR.) This data is not merged with other data sources.
Job Applications (Ashby and Google Workspace)
Nature and Scope of Processing
We use Ashby, Inc. to manage job applications and our recruitment process. Our role pages link to application forms hosted by Ashby. When you open an application form, your browser connects to Ashby, which receives technical information such as your IP address and browser information. When you apply, your name, email address, CV, links to profiles or work, answers to application questions, and any other information you provide voluntarily are transmitted to Ashby and made available to our hiring team.
Recruitment correspondence is received and processed through Google Workspace, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. This correspondence may also be stored in Ashby to manage the same recruitment process. Please submit applications through the application form for the relevant role.
We process this data solely for the purpose of conducting the application and selection process. It is not passed on to third parties for other purposes without your consent.
Purpose and Legal Basis
The legal basis for processing your applicant data is the initiation or establishment of an employment relationship in accordance with Art. 6(1)(b) GDPR and Section 26(1) BDSG. Insofar as you voluntarily provide us with information beyond this, the processing is carried out on the basis of your consent in accordance with Art. 6(1)(a) GDPR.
Following an unsuccessful application, limited retention to establish, exercise, or defend legal claims is based on our legitimate interests under Art. 6(1)(f) GDPR.
Transfer to Third Countries
Ashby is based in the USA, and applicant data may be processed there or by its sub-processors. Information about Ashby's processing and international transfers is available in Ashby's privacy policy. You can contact us to request information about the safeguards applicable to your applicant data.
When using Google Workspace, personal data may be transferred to servers of Google LLC in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework (EU-U.S. DPF); the transfer to the USA therefore takes place in accordance with Art. 45(1) GDPR on the basis of the adequacy decision of the European Commission. Standard contractual clauses (Art. 46(2)(c) GDPR) are used as an additional safeguard.
Storage Period
Your applicant data is stored for the duration of the application process. If no employment relationship is established, we delete it no later than six months after you receive our rejection or withdraw your application. Longer storage requires a separate basis, such as your explicit consent to a talent pool, a statutory obligation, or an ongoing legal claim. For more information, please see Google's privacy policy: https://policies.google.com/privacy.
Hosting (Vercel)
Nature and Scope of Processing
Our website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. Vercel stores the website files and delivers them to your browser through its globally distributed servers.
When you visit our website, your browser connects to servers of Vercel Inc., whereby your IP address, the page requested, the date and time of the request and, where applicable, browser data such as your user agent are transmitted. Vercel uses this data to deliver the website and to maintain its security and functionality. The server log files described above are collected through this service.
Purpose and Legal Basis
The use of Vercel is based on our legitimate interests, i.e. an interest in the secure, reliable and efficient provision of our online offering in accordance with Art. 6(1)(f) GDPR.
Personal data may be transferred to the USA. Vercel Inc. is certified under the EU-U.S. Data Privacy Framework (EU-U.S. DPF); the transfer to the USA therefore takes place in accordance with Art. 45(1) GDPR on the basis of the adequacy decision of the European Commission.
Storage Period
Request logs available to us in our Vercel account are currently kept for one day and then deleted. We do not forward these logs to any other service. Vercel may retain data for longer for its own purposes, such as security and abuse prevention. For more information, please see Vercel's privacy notice: https://vercel.com/legal/privacy-notice.
Cloudflare Web Analytics
Nature and Scope of Processing
We use Cloudflare Web Analytics, a service provided by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, to measure how often our pages are visited. When a page loads, your browser loads a script from Cloudflare's servers and sends Cloudflare information about the page view, such as the page visited, the referrer URL, page load timing, and browser and device type. In doing so, your IP address and user agent are transmitted to Cloudflare.
According to Cloudflare, Web Analytics does not use cookies or local storage and does not identify individual visitors by fingerprinting. We only see aggregated statistics, such as the number of page views per page.
Purpose and Legal Basis
The use of Cloudflare Web Analytics is based on our legitimate interests, i.e. an interest in understanding how our website is used in order to improve it, in accordance with Art. 6(1)(f) GDPR.
Personal data may be transferred to the USA. Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework (EU-U.S. DPF); the transfer to the USA therefore takes place in accordance with Art. 45(1) GDPR on the basis of the adequacy decision of the European Commission.
Storage Period
The specific storage period of the processed data cannot be influenced by us, but is determined by Cloudflare, Inc. For more information, please see Cloudflare's privacy policy: https://www.cloudflare.com/privacypolicy/.
