An AI Vulnerability Researcher finds previously unknown security flaws in the software that AI depends on. That includes ML frameworks, inference servers, model serialisation formats, notebook environments, vector databases, agent frameworks and the libraries that tie them together. The output is usually a confirmed vulnerability with a proof of concept, a fix or mitigation, and a coordinated disclosure.
Companies hire for this role because the AI stack is young, widely shared and often written for speed rather than security. A single flaw in a popular serving framework or model loader can expose every organisation that uses it. Teams that build or rely heavily on this software want someone who can audit it with the depth of a classic vulnerability researcher and the context of someone who understands how ML systems are deployed.
What does an AI Vulnerability Researcher do?
The role combines code review, fuzzing and exploitation with a working knowledge of ML engineering. An AI Vulnerability Researcher chooses targets based on exposure and risk, studies how they handle untrusted input, and proves whether a weakness can be exploited in a realistic deployment.
- Auditing ML frameworks, inference servers and model hubs for memory safety bugs, injection flaws and authentication weaknesses
- Analysing model file formats and loaders for unsafe deserialisation and arbitrary code execution
- Building fuzzers and harnesses for tokenisers, parsers, model loaders and API endpoints
- Reviewing agent frameworks and plug-in systems for sandbox escapes, command injection and permission bypass
- Writing proof-of-concept exploits that show real-world impact without causing harm
- Managing coordinated disclosure with maintainers and vendors, including requesting CVE identifiers where appropriate
- Exploring ML-assisted vulnerability discovery and evaluating where it helps or misleads
Key skills and backgrounds
Most AI vulnerability researchers come from traditional vulnerability research, exploit development or product security. They bring skills in reverse engineering, fuzzing and low-level debugging, and they have learned the AI stack well enough to know where untrusted data enters it. A smaller group comes from ML infrastructure engineering and has developed strong security skills on top. Either way, candidates should be able to show disclosed vulnerabilities or detailed technical write-ups.
Ask candidates to walk through a bug they found from first suspicion to fix. Their account of triage, exploitability and disclosure tells you more than a list of tools.
- Source code auditing in C, C++, Rust, Python and Go
- Coverage-guided fuzzing and building custom harnesses for complex inputs
- Reverse engineering and debugging of native code, including GPU-adjacent libraries where relevant
- Understanding of ML serving stacks, model formats, containers and orchestration
- Exploit development and the ability to judge real-world exploitability honestly
- Coordinated vulnerability disclosure practice and working with open-source maintainers
- Clear advisories and reports that engineers can act on
Where AI Vulnerability Researchers work
Foundation model labs hire vulnerability researchers to secure their training and serving infrastructure. Cloud and platform providers that host models need them to audit the AI services they offer customers. Security vendors and research teams employ them to find and disclose flaws in widely used open-source AI software. Companies that ship ML frameworks, developer tools or AI hardware hire them into product security teams, and some organisations fund them to work on open-source security as a public good.
AI Vulnerability Researcher vs related roles
The word researcher appears in several AI security titles. These are the clearest distinctions.
- An AI Bug Bounty Hunter usually works externally and reports issues in specific products for rewards, while an AI Vulnerability Researcher is often employed to audit software in depth over a longer period.
- An AI Red Team Engineer tests an organisation's AI systems end to end, including model behaviour, rather than focusing on code-level flaws in the underlying software.
- An LLM Red Teamer works on model outputs and prompt-level attacks, which sit outside the software vulnerability work this role covers.
Salary and market data
Pay for AI vulnerability researchers follows the wider vulnerability research market, adjusted for AI context and the type of employer. For current ranges, see the GenAI and agentic systems salary guide, compare with other roles across our AI and deep tech salary guides, or check an offer using the deep tech salary calculator.
Hiring AI Vulnerability Researchers with DeepRec
DeepRec recruits security specialists into GenAI and agentic systems and AI infrastructure teams across Europe and the US, from London, Berlin, Zurich, Dublin and Boston. We screen candidates on their disclosure record, auditing method and understanding of the AI stack, so you meet researchers who have found real bugs. We recruit on a permanent, contract, retained and executive search basis, and contract audits can suit a defined review of a framework or platform. To brief us, visit Looking to Hire.