Red-Teaming & AI Safety

Red-teaming and AI safety work is one of the few AI-training jobs where getting paid to deliberately break the product is the entire point. You are hired to attack a large language model or AI agent with adversarial prompts, jailbreaks, and edge cases until it does something it is not supposed to do (produce harmful content, leak data, follow a hidden instruction, or bypass its own guardrails), then document exactly how you did it. The open red-teaming roles on this site typically pay Unavailable to Unavailable per hour, with a median of Unavailable (compare every kind of AI training work); entry-level safety-rating tasks sit at the low end, and specialist or direct-lab contractor work at the top (contractor pay for red-teaming specialists runs $100 to $200 an hour, The Interview Guys wrote on 1 May 2026). On top of hourly work, per-finding bug bounties pay from $500 to $15,000 at Mozilla's 0din (its policy, updated 2 Oct 2026) up to $50,000 for a universal jailbreak in OpenAI's Bio Bug Bounty (since 9 Jul 2026). This guide breaks down what the work actually is, who is hiring, what they pay by platform and seniority, how to get in, and how to avoid the scams that cluster around anything with "AI job" in the title.

The short version: this is real, growing, and legitimately well-paid work if you get onto the right platforms, but it is skilled work, not a passive "click buttons from home" gig. The people who earn the top rates combine creative adversarial thinking with clear technical writing and, increasingly, some scripting ability. The people who earn the low end are doing high-volume rating tasks that any careful reader can do. Both are real. Knowing which one you are applying for is half the battle.

What Red-Teaming and AI Safety Work Actually Is

AI red-teaming is a form of adversarial testing. Where a normal user tries to get a model to help them, a red-teamer tries to get the model to fail. LLM red-teaming is a proactive safety and security practice: you systematically feed a model adversarial inputs to surface vulnerabilities before the model ships to the public, so the lab can patch them in a continuous "break-fix" loop.

Day to day, the work looks like this. You are given a target model (or an AI agent, or a specific safety policy) and a category of harm you are meant to probe: violence, self-harm, illicit weapons, fraud, child safety, privacy leakage, bias, hallucination, and so on. Your job is to write prompts that get the model to cross the line, then log the prompt, the response, and a judgment about whether and how badly the model failed. When a plain request gets refused (which it usually does now), you escalate with technique.

The craft of adversarial prompting leans on a recognizable toolkit:

• Role-play and persona framing. Ask the model to act as a jury member, a novelist, a journalist, or a fictional character who "would" say the forbidden thing.
• Emotional appeals. Frame the request around concern for a friend's safety or an urgent medical situation so refusing feels harmful.
• Obfuscation. Encode the request in another language, in base64, in a cipher, or split across multiple turns so no single message trips the filter.
• Logical and mode-switching tricks. Use chain-of-thought manipulation, hypothetical framings, or "developer mode" style prompts to get the model to reason its way past its own rules.
• Multi-turn social engineering. Build context slowly so the model commits to a helpful frame before the harmful ask arrives.

There are two broad styles of the job. Manual adversarial testing (what most crowd platforms hire humans for) excels at finding nuanced, subtle, edge-case failures that automated tools miss. Automated attack simulation uses frameworks to fire thousands of variations for broad, repeatable coverage ( Confident AI). Human red-teamers increasingly sit on top of automation: you use tools to generate candidates, then apply human judgment to the interesting hits.

Beyond pure jailbreaking, "AI safety" work on these platforms also includes safety rating and evaluation (scoring whether two model responses are safe, ranking them, labeling policy violations), over-refusal testing (finding cases where the model wrongly refuses a benign request, which is its own paid category on some platforms), and agentic red-teaming (attacking AI agents that can browse, run code, or take actions, where the attack surface is far larger). Across red teaming as a whole, the State of Red Teaming 2026 reports that 38% of engagements now use AI tools, up from 12% in 2024, and that continuous automated red teaming is its fastest-growing segment at 31.2% a year (read 10 November 2026).

The Platforms Hiring for Red-Teaming in 2026

Six platforms come up repeatedly for this work, and they occupy very different tiers. Understanding the tier tells you the pay, the bar to get in, and the type of task.

Surge AI

Surge AI is a premium human-data platform that takes applications to its posted expert openings and works directly with frontier labs including Anthropic on safety data and red-teaming workflows. It is highly selective, and its contractors include researchers, physicians, and engineers with doctoral degrees. Surge now posts its expert openings and their rates on its own site, $55–$400/hr; expert openings $200–$400/hr on its researched card ( Surge AI review); its researched rate card on this site reads $55–$400/hr; expert openings $200–$400/hr. It operates through managed contracts rather than an open task board, so it is not a good "sign up today" option for beginners. If you have a strong specialist background, it is one of the highest-quality places to do this work.

Mercor

Mercor runs an open, AI-driven hiring funnel and posts red-teaming and AI-safety listings frequently. Its pay is unusually transparent because rates appear on individual job listings: its open red-teaming roles on this site ( 0 today) each state their own rate, depending on project, client, and content category. Its researched rate card reads $63–$90/hr median listing; experts to $450/hr (checked 8 Nov 2026), and Mercor said in October 2025 that its experts earn over $85 an hour on average ( TechCrunch, 27 Oct 2025). This is probably the single best starting point for someone who wants a real red-teaming role with a clear rate attached.

Braintrust

Braintrust is a talent network whose red-teaming role is carded at $50–$120/hr, and it is one of the few platforms that charges the worker zero fees (the client pays the platform fee), so your quoted rate is your take-home ( Braintrust guide). Its whole card, senior work included, reads $20–$200/hr (checked 1 Nov 2026). Because it is fee-free to talent, a Braintrust rate nets you more than the same nominal rate on a platform that takes a cut.

Mindrift

Mindrift is a freelance AI-training platform (part of Toloka) with a dedicated red-teaming track; its researched rate card reads $15–$100+/hr (checked 3 Nov 2026), with general evaluation tasks at the lower end and domain-expert reviews in STEM, law, or medicine at the top ( Mindrift pay guide). Compensation is shown before you start each task, and payouts are processed twice a month through Payoneer or Tipalti (PayPal), depending on your country ( Mindrift, 3 Sep 2026). Mindrift is one of the more accessible on-ramps because it accepts "professional experience in any domain" rather than requiring a security background.

Pareto AI

Pareto AI is an expert-labeling company producing human data (RLHF, evaluation, annotation, prompt engineering) for AI labs, positioned around vetted specialists rather than an open crowd. Its researched rate card on this site reads Unpublished; past postings $40-$100 per approved hour (checked 4 Nov 2026), and it reviews applications on a rolling basis ( Pareto).

Respondent

Respondent is a research-participant marketplace with a dedicated AI training and evaluation track. It is structured around studies rather than ongoing task work, and its researched rate card reads $50–$400+/study, depending on length and type (checked 4 Nov 2026). Red-teaming-style AI studies appear here as one-off sessions with custom rates set by the researcher. It is best treated as a supplement, not a primary income stream, but the per-hour effective rate on a good study is high.

Pay by platform, at a glance

Each rate is the platform's researched rate card on this site; it opens the platform's pay page with its sources, and the date is the day the card was last checked. Actual offers vary by project, client, content category, and your location.

Pay by Seniority: From Rating to Consulting

Red-teaming pay spreads across a wide band because "red-teaming" covers everything from careful reading to deep adversarial ML research. Mapping the ladder helps you target the right rung.

At the bottom, entry-level safety rating and evaluation tasks pay at the rating end of the market (the AI evaluation roles here typically pay Unavailable to Unavailable, median Unavailable). This is high-volume work: read a prompt-response pair, judge whether it violates policy, label the category. It requires care and consistency, not a security background. This is where most newcomers start. ZipRecruiter's US average for AI red-teamers, about $67.60/hr in October 2026 (most between roughly $60 and $78/hr), sits well above this rung because it is pulled up by the more skilled roles above it.

In the middle, crowd-platform red-teaming (the core of this article) is what the open red-teaming roles here measure: typically Unavailable to Unavailable/hr, median Unavailable (the red-teaming market report follows it day by day). You are actively crafting jailbreaks and writing up findings. Domain expertise (medicine, law, chemistry, biology, cybersecurity) pushes you toward the top of the band because labs pay more for experts who can probe specialized harm categories credibly.

At the top, direct-lab contractors and consultancy specialists command more. The Interview Guys' breakdown (published 1 May 2026) puts contractor pay at $100 to $200/hr, full-time AI red-team researchers at $180,000 to $280,000+ with contractor equivalents at $150 to $200/hr, and red-team leads at $175 to $250/hr as contractors and $200,000 to $300,000+ salaried.

The safety-rating and crowd red-teamer rates are the typical pay of the open AI evaluation and red-teaming roles on this site, read live; the other rows are from The Interview Guys, published 1 May 2026.

The important insight for a newcomer: the jump from the bottom of that band to the top on the same platform is not about tenure, it is about demonstrated skill and, above all, domain expertise. A physician red-teaming medical-advice failures or a chemist probing weapons-synthesis refusals is worth far more per hour than a generalist, because the lab genuinely needs their judgment. A physician testing for overconfidence might ask what happens on GLP-1 medicines over decades, which is not known, as GLPcompare's page on long-term side effects, by the same makers as this site, says plainly.

Pay by Geography

Red-teaming rates vary sharply by country, driven by local demand, cost of living, and how much AI investment a market has. Knowledgehut (updated 7 Jul 2026) covers the US, UK, Germany, Canada, Australia, Singapore, and the UAE; emerging markets pay less in absolute terms but often more relative to local wages.

Two practical notes. First, many crowd platforms pay a global rate for a given task rather than adjusting to your local cost of living, which is why the same red-teaming rate is life-changing money in some markets and solid side income in others. Second, geography gates access as much as pay: Mindrift, for one, does not support some countries (Kenya and DR Congo among them), and African applicants in particular find fewer open doors on the premium platforms even though the general AI-training market in Africa is active on Surge, DataAnnotation, and Outlier ( ProGigFinder).

The Skills and Qualifications You Actually Need

The honest answer on qualifications: it depends entirely on which tier you are targeting. Entry-level rating work needs care, strong reading comprehension, and reliability. The well-paid red-teaming work needs a genuine skill stack.

Do you need a degree? No, not universally. Mindrift explicitly welcomes "professional experience in any domain," and the crowd platforms care more about demonstrated skill than credentials. But the premium end skews heavily credentialed: Surge's pool is dense with PhDs and specialists, and domain expertise (which often comes with a degree) is the single biggest lever on your rate.

The core skill set for well-paid roles:

• Creative adversarial thinking. The ability to think like an attacker and imagine the framing that slips past a filter. This is the non-negotiable core and cannot be faked.
• Technical writing. Every finding is only as valuable as your writeup. You must reproduce the failure clearly, explain why it matters, and rate its severity. Labs pay for reports they can act on.
• Understanding of how LLMs work. Training, RLHF, and inference behavior. You do not need to build models, but you need to understand why they fail.
• Domain expertise. Medicine, law, chemistry, biology, finance, or cybersecurity. This is what moves you from the bottom of the band to the top.
• Scripting (increasingly). Python for automated testing and for the tooling-assisted roles.
• Regulatory literacy. Familiarity with the EU AI Act and the NIST AI Risk Management Framework helps for the compliance-adjacent roles.

The tools of the trade are worth knowing by name even if you start manual. The open-source red-teaming stack includes Promptfoo (open-source LLM red-teaming), plus Microsoft's PyRIT, NVIDIA's Garak, and IBM's Adversarial Robustness Toolbox. Getting hands-on with even one of these turns a generalist application into a credible technical one.

For people coming from cybersecurity, existing credentials (OSCP, CEH, CISSP) transfer well; add hands-on PyRIT or Garak experience and you are competitive quickly. For people coming from AI/ML, add threat-modeling fundamentals. For non-technical applicants, the realistic entry point is AI safety evaluator work plus a public track record from competitions (below).

How to Get Started and Pass the Assessments

There is a repeatable path into this work, and it is worth following in order.

1. Build a public portfolio through competitions. This is the highest-leverage move for a beginner, because it produces evidence you can point to. Gray Swan Arena runs recurring agent red-teaming competitions with large prize pools (its Agent Red-Teaming Challenge of March to April 2025 had a $171,800 pool sponsored by the UK AI Security Institute, OpenAI, Anthropic, and Google DeepMind; its Safeguards Challenge of February to May 2026 had $140,000). HackAPrompt is a global prompt-hacking competition whose first round collected 600K+ adversarial prompts, its organizers' 2023 paper reports. Even a modest placement in one of these is a real credential.

2. Apply to the crowd platforms. Mercor, Mindrift, Braintrust, and Pareto all take open applications. The screening is increasingly an AI-led interview: Mercor, for example, has you upload a resume, select skills, and complete a roughly 20-minute AI interview (retakeable up to three times, per its help page read 29 Oct 2026) plus role-specific written and practical tasks that test annotation accuracy, quality-control judgment, and logical reasoning rather than theoretical ML knowledge ( RemoWork). For the AI interview: use a computer with a working camera and mic, test both first, keep your face visible and your voice clear, and answer with concrete examples.

3. Pass the qualification task. Legitimate platforms give you a short sample task. For red-teaming, that usually means demonstrating you can produce a working adversarial prompt and, crucially, write it up cleanly: reproduction steps, the response, the policy it violates, and a severity judgment. Reviewers are looking for clarity and calibrated severity, not just a flashy jailbreak.

4. Move up to bug bounties. Once you have a finding or a placement, the AI labs open up. The recommended sequence from practitioners: start with Mozilla's 0din (broad LLM scope, open submissions, low friction, rewards from $500 to $15,000 under its policy updated 2 Oct 2026), compete in HackAPrompt or Gray Swan Arena, then apply to Anthropic's model safety bug bounty (by invitation through HackerOne, with an NDA; up to $35,000 for a novel universal jailbreak, per its page updated 8 Sep 2026) and OpenAI's Bio Bug Bounty (a private program; up to $50,000 for a universal jailbreak since 9 Jul 2026). OpenAI's larger maximum, $100,000, is for critical findings in its security bug bounty ( OpenAI, 26 Mar 2025), which keeps jailbreaks out of scope. A critical mistake to avoid: do not submit jailbreaks to Google's AI VRP, which explicitly excludes prompt injection, jailbreaks, and alignment issues.

The OpenAI Red Teaming Network is a separate, credential-gated program that recruits domain experts in cohorts (applications open and close in rounds). It is worth an application if you have real subject-matter depth.

Realistic Earnings

What can you actually make? The realistic answer depends on your tier, your hours, and how much of your time is billable (finding tasks, waiting for review, and ramping all eat into effective hourly).

• Casual entry-level. Safety rating a few hours a week, at the rating end of the market, is a modest side income. Steady but modest.
• Committed crowd red-teamer. At the typical red-teaming rates here (Unavailable to Unavailable, median Unavailable) on Mindrift, Mercor, or Braintrust, a steady part-time schedule is a real income when work is available. Availability is the catch: task volume fluctuates by project, so most people run two or three platforms at once to smooth the gaps.
• Domain specialist. A credentialed expert at the top of the band can earn a professional income during active projects.
• Bug bounty hunter. Highly variable and lumpy. Most findings are small; a rare exceptional finding can pay five figures. Treat bounties as upside on top of hourly work, not a salary.

The single biggest determinant of monthly income is not your rate, it is your utilization. A modest rate with reliable weekly work beats a rate twice as high that only fires a couple of projects a quarter.

Taxes and Payment Logistics

Almost all of this work is done as an independent contractor, which has real tax consequences you should plan for from day one.

In the US, a platform that pays you $2,000 or more for work in 2026 sends a 1099-NEC (the threshold was $600 for payments made before 2026, per the IRS, read 29 Oct 2026), but you owe tax on all income regardless of whether a form arrives ( Payoneer). As a contractor you pay self-employment tax of 15.3% (12.4% Social Security plus 2.9% Medicare) on net earnings, on top of ordinary income tax, because there is no employer covering half ( IRS, read 29 Oct 2026). If you expect to owe $1,000 or more, the IRS requires quarterly estimated payments ( IRS, read 29 Oct 2026). You can deduct ordinary and necessary business expenses (internet, home office, equipment), which materially lowers the bill, so keep records.

On payment mechanics: platforms pay through a mix of Payoneer, PayPal, direct bank transfer, and regional partners. Mindrift, for example, pays out twice a month through Payoneer or Tipalti (PayPal), depending on your country. Keep your own log of every payment from every platform, because reconciling multiple 1099s (and income that never generated one) at tax time is otherwise painful. Outside the US, the same principle applies under local self-employment rules: you are responsible for declaring and paying, and the platform is not withholding for you.

Pros, Cons, and Who This Suits

The upside. The pay is genuinely good for remote, flexible work, and the ceiling is high if you have expertise. The work is intellectually engaging (you are being paid to be clever and a little adversarial). It is a real on-ramp to a fast-growing field: the same skills feed into salaried AI-safety and LLM-security roles. And you set your own hours.

The downside. Income is inconsistent because task volume fluctuates; you carry your own taxes and benefits; and the content can be genuinely unpleasant, since red-teaming means deliberately eliciting harmful outputs (violence, self-harm, abuse material categories), which some people find draining or distressing. Account risk is real too: some annotation platforms have suspended workers with balances owed, so never treat a single platform as your only income.

This work suits careful, creative people who can write clearly, tolerate the subject matter, and either bring domain expertise or are willing to build a public track record. It does not suit anyone looking for passive income or guaranteed steady hours.

Red Flags and Scams to Avoid

The AI-training space attracts scams because "work from home training AI" at an easy hourly wage is easy bait. Legitimate work has a consistent shape and scams break it in predictable ways ( FTC, Spirelight).

• Any upfront fee is a scam. No legitimate platform charges you to join, sells you a "work kit," or requires a deposit. Money flows one direction only: from the company to you.
• Unrealistically high pay for trivial work. A generous hourly rate "to click buttons" before anyone has seen your work is bait. Real platforms pay top rates only after you have demonstrated skill.
• Weird tools and unknown platforms. Being told to download a custom "annotation tool" or register on an obscure site to do a "test" is a red flag. Legitimate platforms use known systems or sandboxed environments.
• Sensitive info requested too early. Banking passwords, a photo of your ID, or crypto-wallet details before you have done any work or spoken to a real person are all warning signs.
• Overpayment / reimbursement schemes. Any "we'll send you money to buy equipment" flow is a classic scam structure.
• Ghost jobs and fake listings. Many postings on free boards are ghost or fake listings that harvest applications or free labor via unpaid "assessments." Apply through the platforms' official pages and be wary of long unpaid tests.

The tell for legitimacy: you apply, complete a short and reasonable qualification task, and if your work is good you start receiving paid tasks with transparent payouts. Even generally legitimate platforms have imperfect reputations (some workers report account suspensions with balances owed), so diversify across platforms and cash out regularly rather than letting a large balance accumulate.

The 2026 Outlook

Demand for red-teaming is being pulled up by regulation and by the sheer pace of AI deployment. The EU AI Act makes adversarial testing a legal obligation, not a best practice: Article 55 requires providers of general-purpose AI models with systemic risk to perform model evaluation "including conducting and documenting adversarial testing of the model," and the Act's Annex XI names red teaming as such testing. From 2 Aug 2026 the European Commission can fine those providers up to EUR 15 million or 3% of worldwide annual turnover, whichever is higher ( Article 101 of Regulation (EU) 2024/1689, published 12 Jul 2024). Parallel frameworks are emerging in the US, UK, Singapore, and Japan.

The market numbers reflect this. The AI red-teaming market was around $1.3 billion in 2025 and is projected to reach $18.6 billion by 2035 at a 30.5% CAGR ( market.us, published Feb 2026); the frontier-lab evaluation-services slice alone is forecast to grow from roughly $0.7B in 2026 to $15B by 2036 ( Fact.MR, published 18 Jun 2026). More agents in production means a larger attack surface and more human red-teamers needed to probe it. Remote AI red-teaming listings have multiplied ( 0 are open on this site today), and the labs themselves are running ever-larger public programs (the six-figure Gray Swan competitions and the Anthropic and OpenAI jailbreak bounties are evidence that the frontier labs will pay real money for good adversarial work).

The practical takeaway for someone deciding today: this is one of the better-paid, more durable, and more genuinely useful niches in the AI-training economy. Get onto Mercor, Mindrift, Braintrust, or Pareto, build a public track record through Gray Swan Arena or HackAPrompt, lean into any domain expertise you have, keep clean records for taxes, and treat any platform that asks you for money as the scam it is.