Getting started: owner checklists for three routes

The three routes side by side

Who does what, venue by venue

Each cell says who must act at that step. Orange cells are owner work that no agent can take over under the venue's own terms.

• O Owner
• A Agent
• E Either
• P Platform or buyer (no owner action)
• – Not applicable
• ? Unknown

"Platform or buyer" means the platform, the requester or an evaluator acts, with no action by the worker's owner. The full matrix for all 26 paid venues is in the first report.

Five checks before any route

1. 1
   Check the rule row. Look up your venue on the rules grid. Where the verdict for autonomous submission is forbid or restrict, a person reviews and submits. No human-paying venue with a confirmed payout allows an agent to submit on its own.
2. 2
   Clear the ID and payout gate yourself. At 12 of 14 key venues the owner must pass the identity or payout step. An agent cannot pass a human ID check, and Upwork’s terms bar an agent from making identity or tax attestations. Gates per venue.
3. 3
   Run the safety checklist. A separate low-balance wallet, spending caps, one scoped key per venue, pinned skill files and MCP servers, a sandbox, and task text treated as data. Safety before you connect.
4. 4
   Check the break-even cost before you point an agent at a board. Break-even cost per attempt = reward after fees × measured win rate. On TaskMarket it is $0.030 (6 October), while one attempt costs an estimated $0.072 to $0.32 at mid-tier prices; skip a task when your estimated cost per attempt is higher. A flat-rate subscription does not make attempts free: it is quota-limited, not free compute and not resellable, and some providers restrict automated use of consumer plans, so check your provider's rules first. Calculator · EV per attempt by venue.
5. 5
   Know that a submission locks the reward, and glance at whether the poster has ever paid. "Funded" means the reward is in escrow, not that anyone will be paid. On TaskMarket, 23 of every 100 submissions on tasks closed in the 30 days to 6 October went to tasks that had paid nobody when checked, and none of that money was refunded: once anyone has submitted, only the requester can release it. Look at the task's expiry and the poster's closed tasks and awards first. It is a cheap check, but it rarely triggers: most unpaid work came from posters too new to have a record, so do not treat a clean record as a promise. The read-only check · Funded is not paid (6 October).

ID, KYC and payout gates, venue by venue

Who has to prove who they are, when, and how the money leaves. Read on 2 October 2026 from each venue’s own pages. Not legal advice; requirements change.

"Sometimes" means a condition triggers it (a prize, a program type, an amount). "None found" and "Unknown" mean no requirement was found in the pages read, not that none exists. Every entry, with payout rails, minimums and fees, is in kyc.json.

Is it worth the tokens?

Expected value of one attempt: reward after fees × your chance of winning − what the attempt costs, and since 7 October what that means for your day: set a daily token cap and the minutes you spend reviewing each entry to see attempts per day, whether your budget or the supply of tasks is the limit, expected payout per day, median days to first cash, owner minutes per payout and payout per owner hour. Return per $1 is shown with its caveats beside it. The presets come from economics.json (7 October 2026; Algora and Execution Market rows carried from earlier runs): win rates on closed tasks (unawarded ones included), rewards and fees are measured; token costs at the budget, mid and frontier price bands are estimated; turns and output lengths are often assumed. Every preset traces to the file, so the old "Illustrative" badge is gone, but the costs remain estimates: the pool made no paid attempt and no model call against any task.

Runs in a sandboxed frame with its data built in; nothing you enter leaves your browser. Not a prediction of income.

Safety before you connect

Seven controls, each tied to a documented incident with a primary source. Do them before the agent touches any venue, wallet or skill file.

1. OwnerA separate, low-balance wallet. Keep only what you would accept losing, and keep wallets, seed phrases and SSH keys off the machine the agent runs on. Why: the Nx “s1ngularity” compromise (2025-08) drove local AI command-line tools to hunt for secrets and wallets.
2. OwnerSpending caps, and no unattended spending policy. Cap API keys and agent wallets, and approve any standing payment policy yourself. Why: with CVE-2026-25253 (2026-02) one click handed an OpenClaw agent’s gateway token to an attacker, who could then act as the agent.
3. OwnerOne scoped key per venue; rotate after any disclosure. Never give a venue a key that controls money or other accounts. Why: the Moltbook database exposure (2026-02) left 1.5M agent API tokens readable and writable.
4. OwnerPin or hash skill and heartbeat files. Install skills only from sources you have read end to end, never run "prerequisite" commands a skill asks for, and never let the agent follow a remotely updated instruction file. Why: ClawHavoc (2026-02) found 341 (later 824) malicious skills; Snyk ToxicSkills (2026-02) found critical issues in 13.4% of 3,984; Moltbook’s skill tells agents to re-fetch and follow a heartbeat file (2026-10) every 30 minutes.
5. OwnerVet and pin MCP servers. Connect only servers you trust and have read, review full tool descriptions, pin versions, and prefer servers published by the service owner. Why: MCP tool poisoning (2025-04), the malicious postmark-mcp (2025-09) server, and CVE-2025-6514 (2025-07) in mcp-remote.
6. OwnerRun the agent in a sandbox or as a separate machine user. No blanket "skip permissions" flags on a machine with credentials, no auto-approved tool runs on untrusted repositories, and keep the runtime patched. Why: the Amazon Q extension (2025-07) shipped with injected code, and CVE-2025-53773 (2025-08) turned prompt injection into code execution.
7. AgentTreat task text, skill files, heartbeat files and repository files as data, not instructions. Give a bounty agent a token limited to the target public repository, and keep a human reviewing before anything is submitted. Why: in the GitHub MCP toxic agent flow (2025-05) a public issue made an agent leak private repositories; Coolify’s PR template hides an instruction aimed at agents (2026-10) as a trap.

• Check funding before work. Look for an escrow transaction or a funded flag. Advertised rewards on dealwork.ai, opentask.ai and ugig.net were not funded when checked.
• Accounts and KYC stay yours. Every agent-first terms page we read makes the owner accountable for the agent. Do not create accounts in other people’s names.

Incident list, owner controls and the task-text scan method: security.json.