AI red teaming jobs pay people to find ways to make an AI model break its rules, so the lab can fix them. The pay comes in three forms: hourly project work (Outlier lists offensive security experts at up to $70 an hour), bug bounties (Anthropic pays up to $35,000 per novel universal jailbreak through HackerOne) and prize contests (Gray Swan's October 2026 challenge offered $300,000 in prizes). Most of it is occasional, under NDA and not guaranteed.
- "Red teaming jobs" has two meanings. In cybersecurity, a red team attacks a company's own systems. AI red teaming tests an AI model's safety. This page covers the AI kind.
- Paid routes: hourly projects on platforms such as Outlier, invite-only bug bounties such as Anthropic's on HackerOne, and public prize contests such as Gray Swan Arena.
- You do not always need a technical background. Gray Swan's top early red teamer was a lawyer, but agent testing now needs more technical skill.
- Expect NDAs, disturbing content and irregular work. OpenAI says its network members might contribute as few as 5-10 hours in a year.
AI red teaming jobs vs security red team jobs
Searches for "red teaming jobs" mix two different careers. In cybersecurity, NIST defines a red team as "A group of people authorized and organized to emulate a potential adversary's attack or exploitation capabilities against an enterprise's security posture" (NIST). That kind of red team protects an organization's own systems, and it is a cybersecurity career rather than AI training work.
AI red teaming jobs test an AI model instead of a network. OpenAI notes that "The term red teaming has been used to encompass a broad range of risk assessment methods for AI systems" (OpenAI): trying to get a model to give harmful instructions, leak data, follow hidden commands or ignore its rules. This page covers that work, which is mostly paid per project, per finding or per contest.
What AI red teamers do
On contract platforms, much of the work is writing harmful or tricky prompts to a rubric and judging how the model responds. Business Insider reported on leaked Outlier training documents for this kind of AI red teaming, with one freelancer telling the outlet "they were paid $55 an hour" (Business Insider). A Scale AI spokesperson said contributors are "always given advance notice of sensitive content" and the "option to opt out of a project at any time", and the report noted "Outlier offers wellness sessions to taskers on the project".
Technical red teaming is closer to security work. Outlier's offensive security listing seeks experts "to design realistic attack environments, evaluate AI-generated attempts, and distinguish authentic security reasoning from superficial recall" (Outlier). Testing AI agents now often happens inside simulated workplaces called RL environments.
Who pays for AI red teaming?
These are the paid routes we could confirm on each program's own page or in a named outlet on 12 November 2026.
| Route | Who runs it | How you are paid | Published amount | How to get in |
|---|---|---|---|---|
| Outlier projects | Scale AI | Hourly, paid via PayPal or Airtm | Up to $70/hr (offensive security, US, master's degree) | Apply on Outlier |
| Model Safety Bug Bounty | Anthropic, via HackerOne | Per accepted jailbreak | Up to $35,000 per novel universal jailbreak | Apply; invite via HackerOne |
| Gray Swan Arena | Gray Swan | Contest prizes; invited engagements | $300,000 prize pool (IPI Black, Oct 2026) | Open public challenges |
| OpenAI Red Teaming Network | OpenAI | Paid per project | Not published | Applications closed 1 Dec 2023 |
How much do AI red teaming jobs pay?
Hourly work. Outlier advertises that offensive security experts can "earn up to $70/hr putting your offensive security expertise to work shaping AI", and the listing states "PAY RATE Up to $70 USD/hr DEGREE REQ. Masters" (Outlier).
Bug bounties. Anthropic says: "We will pay up to $35,000 per novel, universal jailbreak identified." Its program "is run through HackerOne", and "All Program participants are required to sign a non-disclosure agreement" (Anthropic). A bounty pays only for a qualifying finding, so hours spent without one earn nothing.
Prize contests. Fortune describes Gray Swan's Arena as "an online platform where participants compete for prize money by trying to trick AI models into violating their guardrails". Its October 2026 challenge ran "with $300,000 in prizes sponsored by Anthropic, Meta, Google DeepMind, and Reflection AI" (Fortune). Prizes go to the top of a leaderboard, not to everyone who takes part.
Lab networks. OpenAI says "All members of the OpenAI Red Teaming Network will be compensated for their contributions when they participate in a red teaming project", but involvement "could be as few as 5-10 hours in one year", and "Applications for this phase of the OpenAI Red Teaming Network closed on December 1, 2023" (OpenAI).
Do you need a technical background for AI red teaming?
Not always. OpenAI says "Prior experience with AI systems or language models is not required, but may be helpful" (OpenAI). Fortune reports that "The top-performing red teamer on the original Arena was a lawyer from Melbourne", and Gray Swan's chief executive said an undergraduate, "even one not from a technical field", could become competent without years of experience (Fortune).
The bar is rising for agent testing. The same article says "Configuring these test environments and setting up the attacks now requires significantly more technical expertise", and that "the pool of people both capable and willing to red team frontier AI models has gotten smaller". Domain expertise helps too: OpenAI listed fields from chemistry and biology to law, finance and cybersecurity (OpenAI).
Expect confidentiality. Anthropic, OpenAI and Gray Swan's private arenas all use non-disclosure agreements, so you may not be able to list specific findings on a resume.
How to start in AI red teaming
There is no single application. These steps follow the routes above, in order of how open they are.
- Practice on a public arena. Fortune reports Gray Swan's relaunched Arena offers "beginner-friendly challenges that run even when major competitions aren't live", "training certificates participants can use to show their skills" and "a route for top performers to be invited into Gray Swan's red-teaming community to work on real-world testing engagements" (Fortune).
- Apply to a bounty program. Anthropic says "We review applications on a rolling basis. If accepted, you will receive an invite via HackerOne" (Anthropic). Anthropic asks applicants without a HackerOne account to "please create one before applying to the Program".
- Join a contract platform in your field. Safety and red teaming projects appear on platforms that also run AI evaluation jobs; read our Scale AI and Outlier review before you join.
- Keep a public record you can share: certificates, arena rankings and non-confidential write-ups.
Tell us what you do. We'll send you the paid AI work that fits your field, wherever you live. It's free.
How to tell a real AI red teaming job from a fake one
The US Federal Trade Commission says "Reported losses to job scams increased more than threefold from 2020 to 2023" and gives one rule above all: "Never pay anyone to get paid." It adds that "Real employers will never contact you that way" about job offers sent by unexpected text or WhatsApp (FTC). The programs agree. Appen's CrowdGen says "We will never ask you to pay anything to join our projects" (CrowdGen), and DataAnnotation names "requirements to purchase starter kits" among its red flags (DataAnnotation).
For red teaming in particular, a real program will name itself, point you to its own page or HackerOne, and never ask you to run attacks on systems you are not authorized to test. Watch for these signs:
- You are asked to pay anything: a sign-up fee, a "starter kit", training materials or a deposit to unlock earnings. Real programs pay you, not the other way round.
- The offer arrived as an unexpected text or WhatsApp message with no specifics about the work.
- The "job" is a set of clicks in an app that shows a growing balance you can only withdraw after paying in, often in crypto.
- The listing promises a set income or a fixed number of hours. Real programs say work is subject to project availability and quality requirements.
- The listing is not on the program's own careers page or sign-up site. Check the company domain, then apply there directly rather than through a link in a message.
Where AI red teaming leads
Gray Swan shows one path from contest to paid work. Fortune reports the company "helps frontier AI companies including Anthropic, OpenAI, and Google DeepMind stress-test their models before release", and that "Gray Swan also runs private arenas for frontier AI labs, sometimes using unguardrailed models, with vetted participants who sign nondisclosure agreements" (Fortune). Strong public results are how people get invited.
None of these routes promises regular hours. Treat red teaming as specialist side work until a program offers you a contract with stated hours and pay. For steadier expert work in your field, see AI tutor jobs, our review of Mercor and the list of paid AI training programs for experts.
Tell us what you do. We'll send you the paid AI work that fits your field, wherever you live. It's free.
Origin Data Partners is independent of the programs on this page. A program may pay Origin when Origin introduces someone who joins it, which never changes what you are paid (how Origin is paid).
Common questions
What is an AI red teaming job?
It is paid work trying to make an AI model break its safety rules, for example by getting it to give harmful instructions or follow hidden commands, so the developer can fix the weakness. It differs from a cybersecurity red team, which attacks a company's own systems.
How much do AI red teaming jobs pay?
On 12 November 2026 Outlier listed offensive security experts at up to $70 an hour, Anthropic paid up to $35,000 per novel universal jailbreak through HackerOne, and Gray Swan's October 2026 contest had $300,000 in prizes. Business Insider reported one Outlier red-teaming freelancer was paid $55 an hour.
Can I do AI red teaming without a technical background?
Sometimes. OpenAI says AI experience is not required, and Fortune reports the top early Gray Swan Arena red teamer was a lawyer. Testing AI agents now needs more technical skill.
Is the OpenAI Red Teaming Network hiring?
OpenAI's page says applications for this phase of the network closed on December 1, 2023. Members are paid when they take part in a red teaming project, which could be as few as 5-10 hours in a year.
Are red teaming jobs the same as cybersecurity jobs?
Not quite. A security red team, as NIST defines it, emulates an attacker against an organization's security. AI red teaming tests an AI model's behavior. The fields overlap in agent testing, where Outlier seeks offensive security experts to build attack environments.
Is AI red teaming work upsetting?
It can be. Business Insider reported that Outlier contributors wrote prompts on topics such as abuse and violence; Scale AI said contributors get advance notice of sensitive content and can opt out of a project at any time.
Where can I find AI red teaming jobs?
In a few places, and few of them are jobs. OpenAI says applications for this phase of its Red Teaming Network "closed on December 1, 2023." Anthropic reviews bug bounty applications on a rolling basis and sends invites through HackerOne. Fortune reports that Gray Swan's Arena has "beginner-friendly challenges that run even when major competitions aren't live". Outlier lists offensive security experts at up to $70 an hour, a ceiling. All were read on 14 November 2026.
Is AI red teaming a full-time job?
Rarely. Most AI red teaming is occasional contract work, bounties or contests. OpenAI says members of its network might contribute time "which could be as few as 5-10 hours in one year", and adds that prior AI experience "is not required, but may be helpful." Plan for it as side work.
Sources and further reading
- NIST glossary: red team
- OpenAI: Red Teaming Network
- Business Insider: how freelancers test AI with harmful prompts (Apr 2025)
- Outlier: offensive cybersecurity expert opportunity
- Anthropic Help Center: Model Safety Bug Bounty Program
- Fortune: Gray Swan relaunches its red teaming Arena (Oct 2026)
- FTC Data Spotlight: gamified job scams (Dec 2024, PDF)
- CrowdGen by Appen: contributor platform
- DataAnnotation: FAQ (pay, requirements, application)