Most founders sell something that works. Leonard Tang sells the proof that it doesn't.
Haize Labs, the company Tang co-founded in 2023 and runs as CEO, builds automated systems that hunt for the moment a language model says something it was never supposed to say. The trick that makes a chatbot leak, lie, or go off the rails. Then it does that at scale, thousands of attacks an hour, across models that millions of people are about to use. The company calls the practice red-teaming. Everyone else calls it breaking things on purpose.
The wild part is who is buying. Frontier labs like OpenAI and Anthropic - the same companies racing to ship the smartest models on earth - hire Haize to attack those models first. AI21, Scale AI, Deloitte, MongoDB, and Weights & Biases have all leaned on the platform as a kind of reliability insurance. The pitch is blunt: you cannot trust a system you have never tried to break.
Tang has been circling this idea since undergrad, when adversarial attacks and robustness were the kind of thing you wrote papers about, not companies. He turned the papers into a product, and the product into a business that frontier AI now treats as a pre-flight checklist.
The name is part of the joke and part of the thesis. To haize a model is to haze it - to subject it to relentless, slightly merciless trials until it shows you what it is really made of. A fraternity pledge gets hazed to see if they crack under pressure. A language model gets haized for the same reason, except the stakes are a customer-facing chatbot dispensing legal advice or a medical assistant that can be talked into the wrong answer. Tang's wager is that the failure you find in a lab on a Tuesday is infinitely cheaper than the one your users find in the wild.
Safety is really about trust - making sure AI systems do what you intend them to do.
Here is the detail that gives the whole thing away: at Harvard, Tang thought startups were a distraction. They pulled smart people away from the only thing he cared about, which was machine learning research. He was going to do the serious version of a life in AI. He had the Stanford PhD offer to prove it, set to start that September.
He did not go. He watched a wave of AI companies ship systems that sounded confident and behaved unpredictably, and decided the reliability problem was too urgent to study from a desk for six years. So he kept the research instinct and pointed it at a market. The PhD became a company.
It was not his first swing. An earlier idea - a hardware functional-verification tool, the kind of thing that checks whether a chip does what its blueprint promised - got into Y Combinator before he pivoted. Verifying that complex systems behave as designed turned out to be the theme. He just swapped silicon for language models.
The resume reads like a tour of where AI actually gets made.
The formative one. Working under a CEO who pioneered probabilistic inference chips, Tang watched how market needs shape research and how research feeds back into product. The lesson stuck.
Where he dug into AI vulnerabilities - the soft spots in models that would later become Haize's whole reason to exist.
Stints at two of the companies building the engine room of modern AI, from silicon to scale.
Add the co-founders - Harvard classmates Richard Liu and Steve Li - and you get the founding shape of Haize: three undergrads who met in the same hallways, convinced that the gap between what AI promises and what AI reliably delivers was a business, not just a research footnote.
There is a tidy logic to the whole arc. The Gamalon mentorship taught him that research and market are not opposites but a loop - each one sharpening the other. The Allen Institute work gave him the raw material: a working knowledge of where models actually fail. The big-tech internships showed him the scale at which those failures would eventually matter. Haize is what happens when you stop treating those three as separate chapters and braid them into one company.
A human red-teamer can think of a few hundred clever ways to trip up a model. Haize automates the imagination. Its systems generate adversarial prompts, push them through multi-turn conversations, and escalate until something breaks - then log exactly how.
The research is not hidden behind a sales deck. Haize has openly published techniques like bijection learning, a method for getting models to follow encoded instructions they would otherwise refuse, and bodies of work on multi-turn red-teaming, where the attack unfolds across a whole conversation rather than a single clever line. Showing the exploit, not just claiming it, is part of the credibility.
When OpenAI prepared its o1 model, Tang was on the external red team probing it before release. That is the business in one sentence: the people building the future of AI want him to attack it first.
The open approach is a deliberate strategic choice, not naivety. In security, the labs that publish their attacks tend to be the labs everyone trusts, because the publishing is itself a proof of capability - you cannot fake a working jailbreak in front of an audience that can run the code. By putting techniques like bijection learning into the open, Haize signals that it is on the frontier of finding failures, which is exactly the credential a frontier lab is shopping for when it picks who gets to break its model first.
It also reframes a debate that usually gets stuck in abstraction. A lot of AI safety talk lives in the realm of philosophy - alignment, existential risk, the long term. Tang drags it back to something an engineer can act on this quarter: does the system do what you intended, under pressure, when a clever adversary is actively trying to make it misbehave? Safety, in his telling, is not a virtue you bolt on at the end. It is reliability, and reliability is just trust with the receipts attached.
Building the trust, safety, and reliability layer for AI.
You cannot trust a system you have never tried to break - so Haize tries to break all of them.
The aspiration is not subtle: become the default trust, safety and reliability layer that sits under every serious AI deployment. The infrastructure nobody sees but everyone depends on. If Tang is right, the most important question in AI is not "how smart is it?" but "how do you know it won't break?" - and he wants to own the answer. It is a strange thing to build a career on the failures of the most celebrated technology of the decade. It is stranger still that the makers of that technology agree, and pay for the privilege of being told where they are wrong. Whatever else you make of him, Leonard Tang found the one job in the AI boom where being the pessimist in the room is the entire value proposition.