Red-Teaming & AI Safety

Red-teaming and AI safety work is one of the few AI-training jobs where getting paid to deliberately break the product is the entire point. You are hired to attack a large language model or AI agent with adversarial prompts, jailbreaks, and edge cases until it does something it is not supposed to do (produce harmful content, leak data, follow a hidden instruction, or bypass its own guardrails), then document exactly how you did it. On the crowd platforms that hire for this in 2026, pay typically runs $30 to $120 per hour, with entry-level safety-rating tasks closer to $20 to $30/hr and specialist or direct-lab contractor work reaching $150 to $300/hr ( The Interview Guys, Braintrust guide). On top of hourly work, per-finding bug bounties pay from a few hundred dollars up to $100,000 for an exceptional discovery ( OpenAI). This guide breaks down what the work actually is, who is hiring, what they pay by platform and seniority, how to get in, and how to avoid the scams that cluster around anything with "AI job" in the title.

The short version: this is real, growing, and legitimately well-paid work if you get onto the right platforms, but it is skilled work, not a passive "click buttons from home" gig. The people who earn the top rates combine creative adversarial thinking with clear technical writing and, increasingly, some scripting ability. The people who earn the low end are doing high-volume rating tasks that any careful reader can do. Both are real. Knowing which one you are applying for is half the battle.

What Red-Teaming and AI Safety Work Actually Is

AI red-teaming is a form of adversarial testing. Where a normal user tries to get a model to help them, a red-teamer tries to get the model to fail. LLM red-teaming is a proactive safety and security practice: you systematically feed a model adversarial inputs to surface vulnerabilities before the model ships to the public, so the lab can patch them in a continuous "break-fix" loop.

Day to day, the work looks like this. You are given a target model (or an AI agent, or a specific safety policy) and a category of harm you are meant to probe: violence, self-harm, illicit weapons, fraud, child safety, privacy leakage, bias, hallucination, and so on. Your job is to write prompts that get the model to cross the line, then log the prompt, the response, and a judgment about whether and how badly the model failed. When a plain request gets refused (which it usually does now), you escalate with technique.

The craft of adversarial prompting leans on a recognizable toolkit:

• Role-play and persona framing. Ask the model to act as a jury member, a novelist, a journalist, or a fictional character who "would" say the forbidden thing.
• Emotional appeals. Frame the request around concern for a friend's safety or an urgent medical situation so refusing feels harmful.
• Obfuscation. Encode the request in another language, in base64, in a cipher, or split across multiple turns so no single message trips the filter.
• Logical and mode-switching tricks. Use chain-of-thought manipulation, hypothetical framings, or "developer mode" style prompts to get the model to reason its way past its own rules.
• Multi-turn social engineering. Build context slowly so the model commits to a helpful frame before the harmful ask arrives.

There are two broad styles of the job. Manual adversarial testing (what most crowd platforms hire humans for) excels at finding nuanced, subtle, edge-case failures that automated tools miss. Automated attack simulation uses frameworks to fire thousands of variations for broad, repeatable coverage ( Confident AI). Human red-teamers increasingly sit on top of automation: you use tools to generate candidates, then apply human judgment to the interesting hits.

Beyond pure jailbreaking, "AI safety" work on these platforms also includes safety rating and evaluation (scoring whether two model responses are safe, ranking them, labeling policy violations), over-refusal testing (finding cases where the model wrongly refuses a benign request, which is its own paid category on some platforms), and agentic red-teaming (attacking AI agents that can browse, run code, or take actions, where the attack surface is far larger). The State of Red Teaming 2026 reports that agentic testing is the fastest-growing slice as agents move into production.

The Platforms Hiring for Red-Teaming in 2026

Six platforms come up repeatedly for this work, and they occupy very different tiers. Understanding the tier tells you the pay, the bar to get in, and the type of task.

Surge AI

Surge AI is a premium, invitation-heavy human-data platform that works directly with frontier labs including Anthropic on safety data and red-teaming workflows. It is highly selective: Surge reports contracting with more than 20,000 professionals, many with doctoral degrees, including researchers, physicians, and engineers ( Surge AI review). Surge does not publish standard rates and operates through managed contracts rather than an open task board, so it is not a good "sign up today" option for beginners. If you have a strong specialist background, it is one of the highest-quality places to do this work.

Mercor

Mercor runs an open, AI-driven hiring funnel and posts red-teaming and AI-safety listings frequently. Its pay is unusually transparent because rates appear on individual job listings. Entry-level "AI Safety Expert / Specialist" roles have listed at $20 to $26/hr ( Himalayas listing), while dedicated " AI Red-Teamer" roles have ranged from $50 to $111/hr depending on project, client, and content category. Mercor reported an average expert pay of roughly $85/hr across its platform as of late 2025 ( Contrary Research). This is probably the single best starting point for someone who wants a real red-teaming role with a clear rate attached.

Braintrust

Braintrust is a talent network that publishes red-teaming pay bands openly at $50 to $120/hr, and it is one of the few platforms that charges the worker zero fees (the client pays the platform fee), so your quoted rate is your take-home ( Braintrust guide). Rates across its AI roles run up to $200+/hr for senior work. Because it is fee-free to talent, a $120/hr Braintrust rate nets you more than a nominally similar rate on a platform that skims 20%.

Mindrift

Mindrift is a freelance AI-training platform (part of Toloka) with a dedicated red-teaming track paying $30 to $100+/hr. General evaluation tasks sit at the lower end ($15 to $30/hr) while domain-expert reviews in STEM, law, or medicine reach the top ( Mindrift pay guide). Compensation is shown before you start each task, payments run bi-weekly, and it pays via Payoneer, Papara, or partner Mellow for regions without Payoneer. Mindrift is one of the more accessible on-ramps because it accepts "professional experience in any domain" rather than requiring a security background.

Pareto AI

Pareto AI is an expert-labeling company producing human data (RLHF, evaluation, annotation, prompt engineering) for AI labs, positioned around vetted specialists rather than an open crowd. It publishes a red-teaming pay band of $50 to $120/hr. Screening is a 15 to 20 minute AI-led video interview, and eligibility is region-limited (US, Canada, UK, EU, Mexico, Brazil, India, Japan, South Korea, Singapore; Africa is currently excluded) ( RemoWork).

Respondent

Respondent is a research-participant marketplace with a dedicated AI training and evaluation track. It is structured around studies rather than ongoing task work, and studies commonly pay $50 to $400+ each depending on length and type ( Side Hustle Nation). Red-teaming-style AI studies appear here as one-off sessions with custom rates set by the researcher. It is best treated as a supplement, not a primary income stream, but the per-hour effective rate on a good study is high.

Pay by platform, at a glance

Rates are as reported by the platforms and third-party trackers in 2025 to 2026; actual offers vary by project, client, content category, and your location.

Pay by Seniority: From $20/hr Rating to $300/hr Consulting

Red-teaming pay spreads across a wide band because "red-teaming" covers everything from careful reading to deep adversarial ML research. Mapping the ladder helps you target the right rung.

At the bottom, entry-level safety rating and evaluation tasks pay roughly $20 to $30/hr. This is high-volume work: read a prompt-response pair, judge whether it violates policy, label the category. It requires care and consistency, not a security background. This is where most newcomers start, and where the ZipRecruiter US average of about $67.60/hr (with most workers between roughly $60 and $78/hr) is dragged upward by the more skilled roles above it.

In the middle, crowd-platform red-teaming (the core of this article) pays $30 to $120/hr. You are actively crafting jailbreaks and writing up findings. Domain expertise (medicine, law, chemistry, biology, cybersecurity) pushes you toward the top of the band because labs pay more for experts who can probe specialized harm categories credibly.

At the top, direct-lab contractors and consultancy specialists command $100 to $300/hr. The Interview Guys' 2026 breakdown puts full-time AI red-team researchers at $180,000 to $280,000+ and contractor equivalents at $150 to $200/hr, with red-team leads reaching $175 to $250/hr as contractors and $200,000 to $300,000+ salaried ( The Interview Guys).

Salaried and contractor figures from The Interview Guys and Knowledgehut, 2026.

The important insight for a newcomer: the jump from $30/hr to $120/hr on the same platform is not about tenure, it is about demonstrated skill and, above all, domain expertise. A physician red-teaming medical-advice failures or a chemist probing weapons-synthesis refusals is worth far more per hour than a generalist, because the lab genuinely needs their judgment.

Pay by Geography

Red-teaming rates vary sharply by country, driven by local demand, cost of living, and how much AI investment a market has. The US, Canada, UK, Australia, Germany, Singapore, and the UAE sit at the top; emerging markets pay less in absolute terms but often more relative to local wages ( Knowledgehut).

Two practical notes. First, many crowd platforms pay a global rate for a given task rather than adjusting to your local cost of living, which is why a $60/hr red-teaming task is life-changing money in some markets and solid side income in others. Second, geography gates access as much as pay: Pareto and parts of Mindrift restrict eligible countries, and African applicants in particular find fewer open doors on the premium platforms even though the general AI-training market in Africa is active on Surge, DataAnnotation, and Outlier ( ProGigFinder).

The Skills and Qualifications You Actually Need

The honest answer on qualifications: it depends entirely on which tier you are targeting. Entry-level rating work needs care, strong reading comprehension, and reliability. The well-paid red-teaming work needs a genuine skill stack.

Do you need a degree? No, not universally. Mindrift explicitly welcomes "professional experience in any domain," and the crowd platforms care more about demonstrated skill than credentials. But the premium end skews heavily credentialed: Surge's pool is dense with PhDs and specialists, and domain expertise (which often comes with a degree) is the single biggest lever on your rate.

The core skill set for well-paid roles:

• Creative adversarial thinking. The ability to think like an attacker and imagine the framing that slips past a filter. This is the non-negotiable core and cannot be faked.
• Technical writing. Every finding is only as valuable as your writeup. You must reproduce the failure clearly, explain why it matters, and rate its severity. Labs pay for reports they can act on.
• Understanding of how LLMs work. Training, RLHF, and inference behavior. You do not need to build models, but you need to understand why they fail.
• Domain expertise. Medicine, law, chemistry, biology, finance, or cybersecurity. This is what moves you from the $30 band to the $100+ band.
• Scripting (increasingly). Python for automated testing and for the tooling-assisted roles.
• Regulatory literacy. Familiarity with the EU AI Act and the NIST AI Risk Management Framework helps for the compliance-adjacent roles.

The tools of the trade are worth knowing by name even if you start manual. The open-source red-teaming stack includes Promptfoo (open-source LLM red-teaming), plus Microsoft's PyRIT, NVIDIA's Garak, and IBM's Adversarial Robustness Toolbox. Getting hands-on with even one of these turns a generalist application into a credible technical one.

For people coming from cybersecurity, existing credentials (OSCP, CEH, CISSP) transfer well; add hands-on PyRIT or Garak experience and you are competitive quickly. For people coming from AI/ML, add threat-modeling fundamentals. For non-technical applicants, the realistic entry point is AI safety evaluator work plus a public track record from competitions (below).

How to Get Started and Pass the Assessments

There is a repeatable path into this work, and it is worth following in order.

1. Build a public portfolio through competitions. This is the highest-leverage move for a beginner, because it produces evidence you can point to. Gray Swan Arena runs recurring agent red-teaming competitions with large prize pools (a recent Agent Red-Teaming Challenge had a $171,800 pool sponsored by the UK AI Safety Institute, OpenAI, Anthropic, and Google DeepMind; a 2026 Safeguards Challenge had $140,000). HackAPrompt is a global prompt-hacking competition whose dataset holds 600k+ real jailbreak submissions. Even a modest placement in one of these is a real credential.

2. Apply to the crowd platforms. Mercor, Mindrift, Braintrust, and Pareto all take open applications. The screening is increasingly an AI-led interview: Mercor, for example, has you upload a resume, select skills, and complete a roughly 20-minute AI interview (retakeable up to three times) plus role-specific written and practical tasks that test annotation accuracy, quality-control judgment, and logical reasoning rather than theoretical ML knowledge ( RemoWork). For the AI interview: use a computer with a working camera and mic, test both first, keep your face visible and your voice clear, and answer with concrete examples.

3. Pass the qualification task. Legitimate platforms give you a short sample task. For red-teaming, that usually means demonstrating you can produce a working adversarial prompt and, crucially, write it up cleanly: reproduction steps, the response, the policy it violates, and a severity judgment. Reviewers are looking for clarity and calibrated severity, not just a flashy jailbreak.

4. Move up to bug bounties. Once you have a finding or a placement, the AI labs open up. The recommended sequence from practitioners: start with Mozilla's 0din (broad LLM scope, open submissions, low friction, payouts $500 to $15,000), compete in HackAPrompt or Gray Swan Arena, then submit to Anthropic (now open on HackerOne with no NDA, up to $35,000 for a novel universal jailbreak) and OpenAI's safety bounty (up to $100,000 for exceptional critical findings). A critical mistake to avoid: do not submit jailbreaks to Google's AI VRP, which explicitly excludes prompt injection, jailbreaks, and alignment issues.

The OpenAI Red Teaming Network is a separate, credential-gated program that recruits domain experts in cohorts (applications open and close in rounds). It is worth an application if you have real subject-matter depth.

Realistic Earnings

What can you actually make? The realistic answer depends on your tier, your hours, and how much of your time is billable (finding tasks, waiting for review, and ramping all eat into effective hourly).

• Casual entry-level. Safety rating a few hours a week at $20 to $30/hr is a few hundred dollars a month. Steady but modest.
• Committed crowd red-teamer. At a realistic $40 to $80/hr on Mindrift, Mercor, or Braintrust, 15 to 20 productive hours a week lands you roughly $2,500 to $6,000/month when work is available. Availability is the catch: task volume fluctuates by project, so most people run two or three platforms at once to smooth the gaps.
• Domain specialist. A credentialed expert at $100 to $120/hr working 20 hours a week can clear $8,000 to $10,000/month during active projects.
• Bug bounty hunter. Highly variable and lumpy. Most findings are small; a rare exceptional finding can pay five figures. Treat bounties as upside on top of hourly work, not a salary.

The single biggest determinant of monthly income is not your rate, it is your utilization. A $60/hr rate with reliable weekly work beats a $120/hr rate that only fires two projects a quarter.

Taxes and Payment Logistics

Almost all of this work is done as an independent contractor, which has real tax consequences you should plan for from day one.

In the US, platforms that pay you $600 or more in a year send a 1099-NEC, but you owe tax on all income regardless of whether a form arrives ( Payoneer). As a contractor you pay self-employment tax of 15.3% (12.4% Social Security plus 2.9% Medicare) on net earnings, on top of ordinary income tax, because there is no employer covering half ( IRS). If you expect to owe $1,000 or more, the IRS requires quarterly estimated payments. You can deduct ordinary and necessary business expenses (internet, home office, equipment), which materially lowers the bill, so keep records.

On payment mechanics: platforms pay through a mix of Payoneer, PayPal, direct bank transfer, and regional partners. Mindrift, for example, pays bi-weekly via Payoneer, Papara, or Mellow depending on your region. Keep your own log of every payment from every platform, because reconciling multiple 1099s (and income that never generated one) at tax time is otherwise painful. Outside the US, the same principle applies under local self-employment rules: you are responsible for declaring and paying, and the platform is not withholding for you.

Pros, Cons, and Who This Suits

The upside. The pay is genuinely good for remote, flexible work, and the ceiling is high if you have expertise. The work is intellectually engaging (you are being paid to be clever and a little adversarial). It is a real on-ramp to a fast-growing field: the same skills feed into salaried AI-safety and LLM-security roles paying $150k to $300k+. And you set your own hours.

The downside. Income is inconsistent because task volume fluctuates; you carry your own taxes and benefits; and the content can be genuinely unpleasant, since red-teaming means deliberately eliciting harmful outputs (violence, self-harm, abuse material categories), which some people find draining or distressing. Account risk is real too: some annotation platforms have suspended workers with balances owed, so never treat a single platform as your only income.

This work suits careful, creative people who can write clearly, tolerate the subject matter, and either bring domain expertise or are willing to build a public track record. It does not suit anyone looking for passive income or guaranteed steady hours.

Red Flags and Scams to Avoid

The AI-training space attracts scams because "work from home training AI for $40/hr" is easy bait. Legitimate work has a consistent shape and scams break it in predictable ways ( Digital Biz Talk, Spirelight).

• Any upfront fee is a scam. No legitimate platform charges you to join, sells you a "work kit," or requires a deposit. Money flows one direction only: from the company to you.
• Unrealistically high pay for trivial work. "€40/hr to click buttons" before anyone has seen your work is bait. Real platforms pay top rates only after you have demonstrated skill.
• Weird tools and unknown platforms. Being told to download a custom "annotation tool" or register on an obscure site to do a "test" is a red flag. Legitimate platforms use known systems or sandboxed environments.
• Sensitive info requested too early. Banking passwords, a photo of your ID, or crypto-wallet details before you have done any work or spoken to a real person are all warning signs.
• Overpayment / reimbursement schemes. Any "we'll send you money to buy equipment" flow is a classic scam structure.
• Ghost jobs and fake listings. Many postings on free boards are ghost or fake listings that harvest applications or free labor via unpaid "assessments." Apply through the platforms' official pages and be wary of long unpaid tests.

The tell for legitimacy: you apply, complete a short and reasonable qualification task, and if your work is good you start receiving paid tasks with transparent payouts. Even generally legitimate platforms have imperfect reputations (some workers report account suspensions with balances owed), so diversify across platforms and cash out regularly rather than letting a large balance accumulate.

The 2026 Outlook

Demand for red-teaming is being pulled up by regulation and by the sheer pace of AI deployment. The EU AI Act makes adversarial testing a legal obligation, not a best practice: Article 55 requires providers of general-purpose AI models with systemic risk to "perform adversarial testing, including through red teaming," with key obligations landing in 2026 and non-compliance penalties reaching EUR 35 million or 7% of global turnover ( Cybersecurity Switzerland). Parallel frameworks are emerging in the US, UK, Singapore, and Japan.

The market numbers reflect this. The AI red-teaming market was around $1.3 billion in 2025 and is projected to reach $18.6 billion by 2035 at a 30%+ CAGR ( MarketIntelo); the frontier-lab evaluation-services slice alone is forecast to grow from roughly $0.7B in 2026 to $15B by 2036 ( Fact.MR). More agents in production means a larger attack surface and more human red-teamers needed to probe it. Remote AI red-teaming listings have multiplied, and the labs themselves are running ever-larger public programs (the six-figure Gray Swan competitions and the open Anthropic and OpenAI bounties are evidence that the frontier labs will pay real money for good adversarial work).

The practical takeaway for someone deciding today: this is one of the better-paid, more durable, and more genuinely useful niches in the AI-training economy. Get onto Mercor, Mindrift, Braintrust, or Pareto, build a public track record through Gray Swan Arena or HackAPrompt, lean into any domain expertise you have, keep clean records for taxes, and treat any platform that asks you for money as the scam it is.