AI red teamer
The one who derails the system before anyone else does
An AI red teamer attacks a system before it goes live to find what it gets wrong, and goes about it with knowledge of a field, like a locksmith paid to open their own door.
- Floor 3The Agent
- P1Writes the brief, reads the code
- Emerging titleIt appeared recently. What it covers is not yet stable from one employer to the next.
What they answer for
The deliverableA catalogue of reproducible failures, with what triggers each one. If they leave, those failures are only discovered in public.
The profile
Five activities, scored 0 to 3- ResearchProducing knowledge that does not yet exist.
- BuildShipping a system that runs, deploys and breaks.
- OperateKeeping it in production: cost, incidents, drift, on-call.
- VerifyMeasuring, testing, attacking. Producing a verdict that holds.
- LeadDeciding, persuading, driving adoption, answering to others.
What the work is
Two trades, one name
The title covers two trades, and confusing them costs both. One hunts technical failures: bypasses, leaks, unintended execution, and it writes code. The other hunts failures of judgement: legal advice that is wrong but confident, a plausible answer on a dangerous subject, and it needs to know the subject.
What makes the post effective
What makes the second effective is not ingenuity but field competence. Someone who knows employment law will find, in an hour, wrong answers that no engineer could recognise as wrong. That is why serious adverts ask for expertise and not for a background in computing.
The trap
The trap is how unrepeatable a finding can be. A failure that does not replay cannot be fixed: it can only be recounted. The useful work is therefore not derailing the system once. It is isolating what derails it every time, and that part looks far more like method than like daring.
A week in the role
- Attempts, in series, at the points where the system has most to lose.
- Reduction: from an aberrant answer to the smallest wording that still produces it.
- Writing: a badly described failure does not get fixed.
- Exchanges with the people building, who have to be able to replay every case.
Ways in
- From field expertise, including outside the technical world: law, health, science, investigative journalism.
- From information security, for the side that writes code, which is a neighbouring and distinct trade.
- What the role does not require, whatever the advert says: knowing how to train a model.
Reading an advert
2 signs- The advert mixes technical bypass and field judgement.
- It is describing two trades. Ask which one takes up most of the time; the answer determines everything else.
- Nothing is said about what happens to the findings.
- A catalogue nobody fixes turns the post into documentation of an accepted risk. That is a tenable position, but you should know you are in it.