AI Security & Control Researcher

The Opportunity

Apollo Research works with most frontier AI companies to test their models before deployment and collaborate on fundamental scheming research. Our coding agent security product, Watcher, is deployed in production and monitors billions of agent tokens per month across engineering teams at agent-building scale-ups and enterprises.

We are looking for a security & control expert to help us design better threat models and control protocols against AI adversaries, and improve the effectiveness and security of Watcher.

This is truly a "start-up role" in the sense that you have significant say in shaping the direction of the role. This is an individual contributor role but could lead to management responsibilities eventually, if desired.

Key Responsibilities

Threat modeling for coding agents

• Develop threat models for coding agents under the assumption that they could be misaligned or compromised. This includes near-term threats like AI agents leaking private internal data and long-term threats like agents sabotaging safety research.
• Treat coding agents through the lens of insider risk: they have credentials, access to code, network access, and the ability to execute arbitrary actions, just like a malicious insider would (see Control agenda).
• Map out kill chains and attack progressions similar to frameworks like MITRE ATT&CK, adapted for agentic AI. See e.g. the Agentic Loss-of-Control Threat Matrix for an example of a high-quality contribution.
• Build and maintain our "coding agent security levels" which define what level of robustness Watcher provides against different categories of failure modes. These levels should be concrete, testable, and usable both internally (to guide product priorities) and externally (to communicate our security posture to customers).

• Maintain our library of coding agent failure modes and keep it comprehensive, accurate, and current.
• Stay up to date with the academic and industry literature on coding agent security, AI security, and adjacent fields (prompt injection, deception, accidental security implications, supply chain attacks on AI systems, etc.).

• Design realistic attack trajectories and example exploits for monitor development and backtesting, work with the research team to ensure monitors are trained and evaluated against credible adversarial behavior.

• Serve as security adjudicator for flagged trajectories. When monitors flag ambiguous agent behavior, determine whether it represents a genuine attack, a benign-but-unusual workflow, or needs deeper investigation, and feed those judgments back into monitor improvement.

• Red-team and improve Watcher's monitors and policies, document findings, and feed them into product improvement.
• Work with the technical research staff to build adversarial test suites into the backtesting pipeline.

This role is distinct from the AI Security Researcher role on Apollo's Infra & Security team, which threat-models Apollo's own internal systems and the agents operating on them.

Representative Projects

• Develop a comprehensive coding agent threat model:
  Think deeply about all the ways in which coding agents could attack an organization. Compare this threat model to conventional threats from human insiders. Publish a detailed research piece describing the threat model building on existing research, e.g. from Redwood Research.

• Improve our database of failure modes:
  We have an internal database of 50+ failure modes of coding agents with detailed reports for all of them. For this project, you would provide an expert view on the current state of that database and suggest improvements. In the long run, you would maintain that database and be responsible for integration of new failures.

• Prioritize failure modes that Watcher should cover:
  Different parts of Watcher attempt to cover different threat models and attack strategies. Based on the results of the threat model project above, we want to ensure that each part of Watcher covers the most important failure modes in the most efficient way. For example, not all monitors require blocking…