14. Corpora and where they come from

This chapter lists every corpus AgentPROV declares, with each part's format, pinned origin, licence, execution count, status and caveats. The corpora themselves are not in the repository: they live under AGENTPROV_HOME, and agentprov stats --corpus <corpus> counts a built one (chapter 6).

Where the data comes from

Every source was found by a systematic search with eligibility criteria fixed before screening (docs/reports/systematic-search/). It covered code platforms (GitHub, GitLab, Codeberg, Hugging Face), the literature, and research-data repositories (Zenodo, Hugging Face, DataCite, Figshare and others).

• Licences. Data with no licence, or with a licence that forbids redistribution, is excluded. The location of such data may be recorded with licence policy reference, but nothing from it is released. (restricted) marks a licence with a use clause, such as AgentHarm's "AI safety only" clause. Each copyleft source (AGPL or GPL) has its own corpus, and non-commercial data never mixes with permissive data.
• Outcomes. Data is never excluded for its outcome: a source, arm or part in which no attack succeeded is included like any other.
• Pins. Each part is pinned to exact bytes, and an import refuses anything else. A git pin names the repository, the commit, and usually the tree with its hash and expected file count. A Zenodo pin names the record (DOI), its version, and each file with its size and checksum. A Hugging Face pin names the dataset, the revision, and each file (or each part of a split archive) with its size and LFS sha256. A URL pin names the address and the file with its size and sha256.

The bytes go into the raw store unchanged, and each corpus carries the sha256 chain raw → AER → SEM → PROV (agentprov verify --level chain).

How to read the listing

• Status is the registry's gated status (chapter 3).
• Corpus is the sealed corpus id for a sealed part, otherwise the registry's corpus id. Status names a sealed corpus's version by its tag, corpus/<corpus_id>/v<version>, an annotated tag on the commit that sealed it.
• Executions is the count recorded in the repository, linked to the committed report it comes from, with the basis of the count: sealed, the executions a sealed corpus releases (after withholding), from its seal report; a full import through agentprov import; a census of the pinned bytes; a trial import into a scratch corpus; records mapped in memory without an import; or the specification (spec). A corpus of several parts gives its released count on one part, and the others say so.
• Caveats come from the source profiles and the registry: what is withheld, redacted or not yet read.
• The second table gives each source's project page and the paper that describes it, linked by its arXiv id or DOI where the profile records one. A paper marked found by web search was matched to the source later, and tools/readme_corpora.toml records how.

The listing is generated by tools/gen_readme_corpora.py from the registry, the source profiles and the committed reports; a test checks that it is current. It never reads a corpus. A branch that adds a source, part, pin or count adds the part to tools/readme_corpora.toml and runs uv run python tools/gen_readme_corpora.py --write; a conflict in the block is resolved by running it again, never by hand.

53 corpora are declared, built from 61 source parts. 52 are sealed (version 0.1.0) and hold 417,898 released executions; 1 is not yet imported in full. The systematic search lists 756 distinct sources: 47 included and 709 excluded, 155 of them only for their licence (no licence: 145; redistribution forbidden: 10). Counts from records-merged.jsonl.

Corpus	Source · part	Format (dialect, variants)	Pinned origin	Licence	Executions	Status	Caveats
agentdojo-upstream-head	agentdojo · head	agentdojo.tracelogger (v0.k11, v1.k14, v1.k14.incomplete)	GitHub ethz-spylab/agentdojo @ 089ed468 runs/	MIT	36,666 (sealed)	import supported, sealed corpus/agentdojo-upstream-head/v0.1.0	207 outcome-only logs
agentdojo-upstream-2024-06	agentdojo · 2024-06	agentdojo.tracelogger (v0.k11)	GitHub ethz-spylab/agentdojo @ c2748856 runs/	MIT	18,231 (sealed)	import supported, sealed corpus/agentdojo-upstream-2024-06/v0.1.0	207 outcome-only logs
agentdyn-a	agentdyn · a	agentdojo.tracelogger (v1.k14, v1.k14.incomplete)	GitHub SaFo-Lab/AgentDyn @ 5353cf76 runs/	MIT	38,154 (sealed)	import supported, sealed corpus/agentdyn-a/v0.1.0	—
agentdyn-b	agentdyn · b	agentdojo.tracelogger (v0.k11)	GitHub SaFo-Lab/AgentDyn @ 5353cf76 runs/ (the pin of part a)	MIT	5,167 (sealed)	import partial, sealed corpus/agentdyn-b/v0.1.0	—
agentdyn-c	agentdyn · c	agentdojo.tracelogger (drift.k18.messages)	GitHub SaFo-Lab/AgentDyn @ 5353cf76 runs/ (the pin of part a)	MIT	4,244 (sealed)	import partial, sealed corpus/agentdyn-c/v0.1.0	—
agentdyn	agentdyn · history	agentdojo.tracelogger (drift.k18.messages, v1.k14.incomplete)	GitHub SaFo-Lab/AgentDyn @ 785b9127 runs/gpt-4o-mini-2024-07-18-drift/	MIT	16,175 (spec)	import planned	opt-in part of 16,795 superseded git blobs; fingerprint deduplication deferred to v0.2; first slice pinned at 785b9127: the 621 logs (620 drift.k18.messages, one v1.k14.incomplete) of runs/gpt-4o-mini-2024-07-18-drift/ (R-10j-2, regeneration-batch item 95), not fetched or imported in v0.1
rope	autodojo · rope-slice	agentdojo.tracelogger (v1.k14)	GitHub xhOwenMa/ROPE @ 64495e16	MIT	2,847 logs (full import)	import partial, sealed corpus/rope/v0.1.0	imported, owned and counted under rope · head
rope	rope · head	agentdojo.tracelogger (v1.k14, v1.k14.incomplete)	GitHub xhOwenMa/ROPE @ 64495e16	MIT	10,774 (sealed)	import supported, live planned, sealed corpus/rope/v0.1.0	—
adprov-v1-release	adprov-v1 · release	adprov.transcript_v1 (v1)	GitHub nickjones39/agentdojo-prov @ 579a9083 corpus/corpus-prov	CC-BY-4.0	17,656 (sealed)	import supported, sealed corpus/adprov-v1-release/v0.1.0	—
ast-survey-agentharm	agent-security-tools-survey · agentharm	inspect.eval (v2)	GitHub Forever-CodingNoob/agent-security-tools-survey @ 89c4db2c agentharm/results (+2 more pins)	CC-BY-4.0	1,055 (sealed)	import supported, sealed corpus/ast-survey-agentharm/v0.1.0	restricted use: AgentHarm's clause, use only to improve AI safety and security; a release seal withholds [withhold] matches: raw log headers whose dataset location names a third-party account's home directory; withheld, digest kept
ast-survey-agentdojo	agent-security-tools-survey · agentdojo-runs	agentdojo.tracelogger (v1.k14)	GitHub Forever-CodingNoob/agent-security-tools-survey @ 89c4db2c agentdojo (+2 more pins)	CC-BY-4.0	3,232 (sealed)	import supported, sealed corpus/ast-survey-agentdojo/v0.1.0	a release seal withholds [withhold] matches: console logs whose traceback paths name a third-party account's home directory; withheld, digest kept
mandate-agentdojo-eval	mandate-agentdojo-eval · head	agentdojo.tracelogger (v1.k14)	GitHub jwilliamsc/mandate-agentdojo-eval @ fa62a977	MIT	396 (sealed)	import supported, sealed corpus/mandate-agentdojo-eval/v0.1.0	—
dtap-bench	dtap · head	dtap.trajectory (v1)	HF AI-Secure/DTap-Bench-Agent-Trajectories @ 836caf2f (+3 more pins)	Apache-2.0	67,708 (sealed)	import supported, sealed corpus/dtap-bench/v0.1.0	the census counts 67,808 trajectory files: 67,806 parseable, 20 synthetic (not executions); five harness-host account paths redacted over every AER string by a labels allowlist (D-607); raw ships as pinned (D-186)
openagentsafety	openagentsafety · head	openhands.events (oas-0.28)	GitHub sani903/OpenAgentSafety @ 857798ff	MIT	1,558 (sealed)	import supported, sealed corpus/openagentsafety/v0.1.0	—
redcode-exec-openhands	redcode-exec-openhands · head	openhands.events (oh-1.5)	Zenodo 23168099 (6 files) (+1 more pin)	CC-BY-4.0	5,459 (sealed)	import supported, sealed corpus/redcode-exec-openhands/v0.1.0	a release seal withholds [withhold] matches: a real-format access token in an unselected member of the deposit's supplementary archive; the archive is withheld, the value is never recorded
interbolt-agentdojo	interbolt-agentdojo · head	agentdojo.tracelogger (v1.k14)	GitHub deconvolute-labs/interbolt-agentdojo @ 43e2b5fa	Apache-2.0	2,016 (sealed)	import supported, sealed corpus/interbolt-agentdojo/v0.1.0	a release seal withholds [withhold] matches: a workstation account path of a third party (a named macOS home directory); withheld, digest kept
melon-agentdojo	melon-agentdojo · head	agentdojo.tracelogger (v1.k14, v1.k14.incomplete)	GitHub xwsdid/MELON @ 71d99dff	MIT	1,911 (sealed)	import supported, sealed corpus/melon-agentdojo/v0.1.0	—
glitch-agentdojo	glitch-agentdojo · head	agentdojo.tracelogger (v1.k14)	GitHub zanethomas1430-code/Glitch @ 713bb296	MIT	1,842 (sealed)	import supported, sealed corpus/glitch-agentdojo/v0.1.0	—
mohameduk-agentdojo	mohameduk-agentdojo · head	agentdojo.tracelogger (v1.k14)	GitHub mohameduk/agentdojo @ 3f9d69a1	MIT	3,628 (sealed)	import supported, sealed corpus/mohameduk-agentdojo/v0.1.0	—
tacit-agentdojo	tacit-agentdojo · head	agentdojo.tracelogger (v1.k14, v1.k14.incomplete)	GitHub CSSLab/Tacit @ 995692d3	Apache-2.0	2,070 (sealed)	import supported, sealed corpus/tacit-agentdojo/v0.1.0	—
geryon-agentdojo	geryon-agentdojo · head	agentdojo.tracelogger (v0.k11)	GitHub luiacuaniello/geryon @ 905aae02	Apache-2.0	3,179 (sealed)	import supported, sealed corpus/geryon-agentdojo/v0.1.0	—
hilarytorn-trajectory-poisoning	hilarytorn-trajectory-poisoning · head	agentdojo.tracelogger (v1.k14)	GitHub HilaryTorn/in-context-trajectory-poisoning @ d71ab8bc	MIT	990 (sealed)	import supported, sealed corpus/hilarytorn-trajectory-poisoning/v0.1.0	—
yockcheng-prompt-injection-harness	yockcheng-prompt-injection-harness · head	agentdojo.tracelogger (v1.k14, v1.k14.incomplete)	GitHub yockcheng/prompt-injection-harness @ 5f9137ff	Apache-2.0	280 (sealed)	import supported, sealed corpus/yockcheng-prompt-injection-harness/v0.1.0	—
shreeyavarma-llm-safety	shreeyavarma-llm-safety · head	agentdojo.tracelogger (v1.k14, v1.k14.incomplete)	GitHub ShreeyaVarma/llm_safety @ 78d22e4a	MIT	672 (sealed)	import supported, sealed corpus/shreeyavarma-llm-safety/v0.1.0	—
gate-agentdojo	gate-agentdojo · head	agentdojo.tracelogger (v1.k14, v1.k14.incomplete)	GitHub dafarusd/gate @ 925b9926	AGPL-3.0-only	3,870 (sealed)	import supported, sealed corpus/gate-agentdojo/v0.1.0	copyleft: its own corpus (D-94)
sentry-agentdojo	sentry-agentdojo · head	agentdojo.tracelogger (v1.k14, v1.k14.incomplete)	GitHub vinhqdang/SENTRY-Anytime-Valid-E-Process-Monitoring-of-LLM-Agent-Action-Streams @ 938e8be7	AGPL-3.0-only	674 (sealed)	import supported, sealed corpus/sentry-agentdojo/v0.1.0	copyleft: its own corpus (D-94)
bookkeeper-agentdojo	bookkeeper-agentdojo · head	agentdojo.tracelogger (v1.k14, v1.k14.incomplete)	GitHub sricursion/bookkeeper @ 0fe09bb6	GPL-3.0-or-later	570 (sealed)	import supported, sealed corpus/bookkeeper-agentdojo/v0.1.0	copyleft: its own corpus (D-94)
aiauthz-agentdojo	aiauthz-agentdojo · head	agentdojo.tracelogger (v1.k14)	GitHub Sports-Vision-Inc/aiAuthZ @ 6eaac86a	AGPL-3.0-only	174 (sealed)	import supported, sealed corpus/aiauthz-agentdojo/v0.1.0	copyleft: its own corpus (D-94)
kongminos-agentdojo	kongminos-agentdojo · head	agentdojo.tracelogger (v1.k14)	GitHub kongminOS/jspace-agentdojo-950 @ f341af69	MIT	950 (sealed)	import supported, sealed corpus/kongminos-agentdojo/v0.1.0	—
ceferisbarov-agentdojo	ceferisbarov-agentdojo · head	agentdojo.tracelogger (v1.k14, v1.k14.incomplete)	GitHub ceferisbarov/agentdojo @ 2273e1cd	MIT	18,438 (sealed)	import supported, sealed corpus/ceferisbarov-agentdojo/v0.1.0	—
memo-ozdincer-agentdojo	memo-ozdincer-agentdojo · head	agentdojo.results_container (rc.k7, rc.k12)	GitHub memo-ozdincer/agentdojo @ 7c331d97	MIT	13,064 (sealed)	import supported, sealed corpus/memo-ozdincer-agentdojo/v0.1.0	one execution per row of 137 results containers; 1,038 exception rows outcome-only with imposed outcomes (D-475); account paths in model ids redacted in the AER (D-476)
linyxus-agentdojo	linyxus-agentdojo · head	agentdojo.tracelogger (v1.k14, v1.k14.incomplete)	GitHub Linyxus/agentdojo @ 698d7ff2	MIT	9,068 (sealed)	import supported, sealed corpus/linyxus-agentdojo/v0.1.0	—
craibench-agentdojo	craibench-agentdojo · head	agentdojo.tracelogger (v0.k11)	GitHub AthaSSiN/CrAIBench @ e41eac1e	MIT	1,163 (sealed)	import supported, sealed corpus/craibench-agentdojo/v0.1.0	—
menelaus29-ipi-multidomain	menelaus29-ipi-multidomain · head	agentdojo.tracelogger (v1.k14, v1.k14.incomplete)	GitHub Menelaus29/ipi-multidomain-agent-study @ ec9c9287	MIT	858 (sealed)	import supported, sealed corpus/menelaus29-ipi-multidomain/v0.1.0	—
llm-lock-agentdojo	llm-lock-agentdojo · head	agentdojo.tracelogger (v1.k14)	GitHub Wakeful-Cloud/llm-lock @ 7bb9915b	GPL-3.0	52,387 (sealed)	import supported, sealed corpus/llm-lock-agentdojo/v0.1.0	copyleft: its own corpus (D-94)
whistlebench	whistlebench · final-runs	inspect.eval (v2)	GitHub legobridge/whistlebench @ 9c27637c final_runs	MIT	9,200 (sealed)	import supported, sealed corpus/whistlebench/v0.1.0	a release seal withholds [withhold] matches: a credential-shaped value in a log header's repository URL; value never recorded
seagent-agentdojo	seagent-agentdojo · head	agentdojo.tracelogger (v1.k14)	Zenodo 23218779: seagent-acsac2026-ae-v2.zip	CC-BY-4.0	5,331 (sealed)	import supported, sealed corpus/seagent-agentdojo/v0.1.0	—
kexin-xu-01-agentharm	kexin-xu-01-agentharm · logs	inspect.eval (v2)	GitHub Kexin-xu-01/agentharm @ 859c34f4 logs	MIT	2,796 (sealed)	import supported, sealed corpus/kexin-xu-01-agentharm/v0.1.0	restricted use: AgentHarm's clause, use only to improve AI safety and security; a release seal withholds [withhold] matches: raw log headers and journals whose dataset location names a third-party account's home directory; 18 logs name local checkpoints by account paths, redacted in the AER (D-182, regeneration-batch item 107); raw objects whose model ids carry account paths ship as pinned (D-186)
fragfuse-agentharm	fragfuse-agentharm · logs	inspect.eval (v2)	GitHub zixin22/fragfuse_agentharm @ 24cc8aea	MIT	1,747 (sealed)	import supported, sealed corpus/fragfuse-agentharm/v0.1.0	restricted use: AgentHarm's clause, use only to improve AI safety and security; a release seal withholds [withhold] matches: raw log objects that name a third-party workstation account path; derived records carry ; account paths in tracebacks and one metadata field are redacted in ext (D-182, regeneration-batch item 107)
agentops-bench	agentops-bench · pilot-v1-seeded	agentops.trace (v1)	Zenodo 19875693: agentops-bench-v1.0-pilot-traces.tar.gz (+2 more pins)	Apache-2.0	3,360 (sealed)	import supported, sealed corpus/agentops-bench/v0.1.0	a release seal withholds [withhold] matches: a third-party workstation account path in tool output (D-608); the AER holds a salted label instead; the in-scope subset of 7,200 runs (D-143, D-191)
drift-head	drift · head	agentdojo.tracelogger (drift.k18.conversations)	GitHub SaFo-Lab/DRIFT @ 6fd3df47 runs/	MIT	1,564 (sealed)	import partial, sealed corpus/drift-head/v0.1.0	—
credleak-p15b	credleak-p15b · head	credleak.cell (v1)	Zenodo 22737462 v3: p15b-run-data-v3-2026-09-13.zip	CC-BY-4.0	14,207 (sealed)	import supported, sealed corpus/credleak-p15b/v0.1.0	a release seal withholds [withhold] matches: planted canary credentials of the study (benchmark design); values never recorded; withholding per D-265
controlarena-persistent	controlarena-persistent · zip-3-001	inspect.eval (v2)	HF idacy/control-arena-persistent-state-eval-archive-2026-07-30 @ 84d39e0a: logs_tmp_zips/logs-20260610T154758Z-3-001.zip (8 parts)	MIT	0 (sealed)	import supported, sealed corpus/controlarena-persistent/v0.1.0	a release seal withholds [withhold] matches: generated and planted credentials of the AI-control setting (benchmark design); values never recorded; a metadata-only release: all 5,742 executions of the corpus's five parts are withheld at the seal (D-344); account paths in harness text redacted (D-349, D-182); the raw objects holding them withheld (D-604)
controlarena-persistent	controlarena-persistent · zip-3-002	inspect.eval (v2)	HF idacy/control-arena-persistent-state-eval-archive-2026-07-30 @ 84d39e0a: logs_tmp_zips/logs-20260610T154758Z-3-002.zip (8 parts)	MIT	153 samples (census)	import supported, sealed corpus/controlarena-persistent/v0.1.0	a release seal withholds [withhold] matches: generated and planted credentials of the AI-control setting (benchmark design); values never recorded; account paths in harness text redacted (D-349, D-182); the raw objects holding them withheld (D-604); released with the corpus (metadata only), counted under controlarena-persistent · zip-3-001
controlarena-persistent	controlarena-persistent · zip-3-003	inspect.eval (v2)	HF idacy/control-arena-persistent-state-eval-archive-2026-07-30 @ 84d39e0a: logs_tmp_zips/logs-20260610T154758Z-3-003.zip (3 parts)	MIT	810 samples (census)	import supported, sealed corpus/controlarena-persistent/v0.1.0	a release seal withholds [withhold] matches: generated and planted credentials of the AI-control setting (benchmark design); values never recorded; account paths in harness text redacted (D-349, D-182); the raw objects holding them withheld (D-604); released with the corpus (metadata only), counted under controlarena-persistent · zip-3-001
controlarena-persistent	controlarena-persistent · batch-runs	inspect.eval (v2)	HF idacy/control-arena-persistent-state-eval-archive-2026-07-30 @ 84d39e0a: logs_batch_runs-20260730.tar.zst	MIT	638 samples (census)	import supported, sealed corpus/controlarena-persistent/v0.1.0	a release seal withholds [withhold] matches: generated and planted credentials of the AI-control setting (benchmark design); values never recorded; account paths in harness text redacted (D-349, D-182); the raw objects holding them withheld (D-604); released with the corpus (metadata only), counted under controlarena-persistent · zip-3-001
controlarena-persistent	controlarena-persistent · auditor	inspect.eval (v2)	HF idacy/control-arena-persistent-state-eval-archive-2026-07-30 @ 84d39e0a: agentic_auditor_logs-20260730.tar.zst	MIT	6 samples (census)	import supported, sealed corpus/controlarena-persistent/v0.1.0	a release seal withholds [withhold] matches: generated and planted credentials of the AI-control setting (benchmark design); values never recorded; account paths in harness text redacted (D-349, D-182); the raw objects holding them withheld (D-604); released with the corpus (metadata only), counted under controlarena-persistent · zip-3-001
atia-benchmark	atia-benchmark · logs	inspect.eval (v2)	GitHub mattngyn/atia_benchmark @ cc71caf5 logs	MIT	110 (sealed)	import supported, sealed corpus/atia-benchmark/v0.1.0	—
autogen-guard-placement	autogen-guard-placement · v1.0	autogen.runs (condition, defense, injecagent, team)	Zenodo 23025259 v1.0: autogen-guard-placement-data-code-v1.0.zip	CC-BY-4.0	1,080 (sealed)	import supported, sealed corpus/autogen-guard-placement/v0.1.0	a release seal withholds [withhold] matches: a real-format service secret key in a deposit member the profile does not select; value never recorded; withholding per D-603
what-surrounds	what-surrounds · runs-named	wirelog.request_response (bedrock-converse, anthropic-messages)	Zenodo 21944598 1.0.0: prompt-injection-study.zip	CC-BY-4.0	1,334 (sealed)	import supported, sealed corpus/what-surrounds/v0.1.0	the tools are synthetic by design (D-284)
mcphunt	mcphunt · head	mcphunt.traces (v2.0.0)	HF lihaonan0716/mcphunt-agent-traces @ c4c69322 (+15 more pins)	CC-BY-4.0	2,190 (sealed)	import supported, sealed corpus/mcphunt/v0.1.0	a release seal withholds [withhold] matches: planted canary credential (MCPHunt benchmark design); the value is never recorded in a public release; withholding per D-289
code-agent-misalignment	code-agent-misalignment-geminicli · results-raw	geminicli.stream_json (v1)	Zenodo 20404563: RESULTS_raw.tar.zst	CC-BY-4.0	2,175 (sealed)	import supported, sealed corpus/code-agent-misalignment/v0.1.0	a release seal withholds [withhold] matches: a credential-shaped value printed by an agent in a tool output; value never recorded; withholding per D-336, D-609
authority-caps-agentdojo	authority-caps-agentdojo · head	agentdojo.tracelogger (v1.k14, v1.k14.incomplete)	Zenodo 23138310 2.1.0: agent-authority-caps-v2.0.0.zip	CC-BY-4.0	18,734 (sealed)	import supported, sealed corpus/authority-caps-agentdojo/v0.1.0	21,999 logs; 3,260 re-packed byte copies collapse into one execution each (D-250)
ipi-defenses-agentdojo	ipi-defenses-agentdojo · head	agentdojo.tracelogger (v1.k14)	Zenodo 22011266 4.0.0: AgentSecurity-IPIDefenses-v4.0.zip	CC-BY-4.0	3,211 (sealed)	import supported, sealed corpus/ipi-defenses-agentdojo/v0.1.0	—
dca-agentdojo	dca-agentdojo · v1	agentdojo.tracelogger (v1.k14)	url	MIT	16,211 (sealed)	import supported, sealed corpus/dca-agentdojo/v0.1.0	the released executions of the whole corpus, parts v1 and drift
dca-agentdojo	dca-agentdojo · drift	agentdojo.tracelogger (drift.k18.conversations)	url (the pin of part v1)	MIT	2,847 logs (census)	import partial, sealed corpus/dca-agentdojo/v0.1.0	included like every other part (D-279 addendum); 0 of 2,847 attacked runs succeed; released with the corpus, counted under dca-agentdojo · v1
kavach-agentdojo	kavach-agentdojo · main	agentdojo.tracelogger (v1.k14, v1.k14.incomplete)	GitHub Ishani018/Kavach @ 53df9545	MIT	2,619 (sealed)	import supported, sealed corpus/kavach-agentdojo/v0.1.0	the released executions of the whole corpus: its three snapshots hold 2,625 distinct executions (D-253)
kavach-agentdojo	kavach-agentdojo · nav-fixer2	agentdojo.tracelogger (v1.k14, v1.k14.incomplete)	GitHub Ishani018/Kavach @ f2dd7efa	MIT	1,477 logs (census)	import supported, sealed corpus/kavach-agentdojo/v0.1.0	released with the corpus, counted under kavach-agentdojo · main
kavach-agentdojo	kavach-agentdojo · rearch-forcedformat-fix	agentdojo.tracelogger (v1.k14, v1.k14.incomplete)	GitHub Ishani018/Kavach @ 6b31a554	MIT	1,518 logs (census)	import supported, sealed corpus/kavach-agentdojo/v0.1.0	released with the corpus, counted under kavach-agentdojo · main
drift1-agentdojo	drift1-agentdojo · drift	agentdojo.tracelogger (drift.k18.conversations)	GitHub CGboom-git/drift-1 @ 0e28729b	MIT	626 (sealed)	import partial, sealed corpus/drift1-agentdojo/v0.1.0	—
redcode-exec-qwencode	redcode-exec-qwencode · qwen3coder	qwencode.json (v0.21)	Zenodo 23168099: trajectories_Qwen-qwen3coder.zip (+1 more pin)	CC-BY-4.0	3,299 (sealed)	import supported, sealed corpus/redcode-exec-qwencode/v0.1.0	a release seal withholds [withhold] matches: a real-format access token in an unselected member of the deposit's supplementary archive; the archive is withheld, the value is never recorded; 4 outputs cut at 64 KiB are salvaged (D-577)

Where each source is published, and the paper that describes it (from the profiles' [source] table; "none recorded" means none was found when the source was verified):

Source	Name	Project	Paper
agentdojo	AgentDojo (ethz-spylab/agentdojo) native TraceLogger run logs	GitHub ethz-spylab/agentdojo	arXiv:2406.13352
agentdyn	AgentDyn (SaFo-Lab/AgentDyn) run logs	GitHub SaFo-Lab/AgentDyn	arXiv:2602.03117
autodojo	AutoDojo (xhOwenMa/AutoDojo): live capture and the ROPE-hosted attack slice	GitHub xhOwenMa/AutoDojo	arXiv:2606.15057
rope	ROPE (xhOwenMa/ROPE) defence-evaluation TraceLogger run logs	GitHub xhOwenMa/ROPE	arXiv:2608.27496
adprov-v1	AgentDojo-PROV transcript/v1	GitHub nickjones39/agentdojo-prov	none recorded
agent-security-tools-survey	Agent Security Tools Survey	GitHub Forever-CodingNoob/agent-security-tools-survey	none recorded
mandate-agentdojo-eval	Mandate-AgentDojo-Eval (jwilliamsc/mandate-agentdojo-eval)	GitHub jwilliamsc/mandate-agentdojo-eval	none recorded
dtap	DTap-Bench (AI-Secure/DTap-Bench-Agent-Trajectories with AI-Secure/DecodingTrust-Agent-Platform)	HF AI-Secure/DTap-Bench-Agent-Trajectories	arXiv:2605.04808
openagentsafety	OpenAgentSafety (sani903/OpenAgentSafety): OpenHands trajectories of five models on 352 safety tasks	GitHub sani903/OpenAgentSafety	OpenAgentSafety: A Comprehensive Framework for Evaluating Real-World AI Agent Safety (arXiv:2507.06134; found by web search)
redcode-exec-openhands	Which Orders Count? (Zenodo 23168099): OpenHands 1.5.0 runs on RedCode-Exec requests C1-C3	Zenodo 23168099	Which Orders Count? A Behavioral Study of Execution Decisions in Autonomous Coding Agents (no identifier recorded)
foobench	FooBench (self-authored toy format, D.12)	GitHub nickjones39/AgentPROV	none recorded
interbolt-agentdojo	Interbolt on AgentDojo (deconvolute-labs/interbolt-agentdojo)	GitHub deconvolute-labs/interbolt-agentdojo	none recorded
melon-agentdojo	MELON variants on AgentDojo (xwsdid/MELON)	GitHub xwsdid/MELON	builds on MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents (arXiv:2502.05174; found by web search)
glitch-agentdojo	Glitch on AgentDojo (zanethomas1430-code/Glitch)	GitHub zanethomas1430-code/Glitch	none recorded
mohameduk-agentdojo	UBAG gateway on AgentDojo (mohameduk/agentdojo, branch ubag-gateway-defense)	GitHub mohameduk/agentdojo	none recorded
tacit-agentdojo	TACIT AgentDojo trajectories (CSSLab/Tacit)	GitHub CSSLab/Tacit	TACIT: Detecting Harmful Agent Trajectories from Internal Representations (no identifier recorded)
geryon-agentdojo	Geryon (luiacuaniello/geryon)	GitHub luiacuaniello/geryon	none recorded
hilarytorn-trajectory-poisoning	In-context trajectory poisoning (HilaryTorn/in-context-trajectory-poisoning)	GitHub HilaryTorn/in-context-trajectory-poisoning	none recorded
yockcheng-prompt-injection-harness	Prompt injection harness (yockcheng/prompt-injection-harness)	GitHub yockcheng/prompt-injection-harness	none recorded
shreeyavarma-llm-safety	llm_safety (ShreeyaVarma/llm_safety)	GitHub ShreeyaVarma/llm_safety	none recorded
gate-agentdojo	gate (dafarusd/gate)	GitHub dafarusd/gate	none recorded
sentry-agentdojo	SENTRY (vinhqdang/SENTRY-Anytime-Valid-E-Process-Monitoring-of-LLM-Agent-Action-Streams)	GitHub vinhqdang/SENTRY-Anytime-Valid-E-Process-Monitoring-of-LLM-Agent-Action-Streams	none recorded
bookkeeper-agentdojo	Munim (sricursion/bookkeeper)	GitHub sricursion/bookkeeper	none recorded
aiauthz-agentdojo	aiAuthZ on AgentDojo (Sports-Vision-Inc/aiAuthZ)	GitHub Sports-Vision-Inc/aiAuthZ	none recorded
kongminos-agentdojo	jspace-agentdojo-950 (kongminOS/jspace-agentdojo-950)	GitHub kongminOS/jspace-agentdojo-950	none recorded
ceferisbarov-agentdojo	ceferisbarov/agentdojo reruns (optimised injection strings)	GitHub ceferisbarov/agentdojo	none recorded
memo-ozdincer-agentdojo	memo-ozdincer/agentdojo results containers (circuit-breaker LoRRA adapters and AgentDojo defences)	GitHub memo-ozdincer/agentdojo	none recorded
linyxus-agentdojo	Linyxus/agentdojo lacuna-exp (Tacit defence)	GitHub Linyxus/agentdojo	none recorded
craibench-agentdojo	CrAIBench (AthaSSiN/CrAIBench)	GitHub AthaSSiN/CrAIBench	Real AI Agents with Fake Memories: Fatal Context Manipulation Attacks on Web3 Agents (arXiv:2503.16248; found by web search)
menelaus29-ipi-multidomain	IPI multidomain agent study (Menelaus29/ipi-multidomain-agent-study)	GitHub Menelaus29/ipi-multidomain-agent-study	none recorded
llm-lock-agentdojo	LLMLock (Wakeful-Cloud/llm-lock)	GitHub Wakeful-Cloud/llm-lock	none recorded
whistlebench	WhistleBench (legobridge/whistlebench)	GitHub legobridge/whistlebench	Why Do Language Model Agents Whistleblow? (arXiv:2511.17085; found by web search)
seagent-agentdojo	SEAgent artefact: AgentDojo episode logs (Zenodo 23218779)	Zenodo 23218779	SEAgent: Securing Computer-Use Agents via Intent-Aware Static Access Control; preprint under an earlier title: Secure and Efficient Access Control Framework for Computer-Use Agents via Context Space (arXiv:2509.22256; found by web search)
agentharm	AgentHarm (inspect_evals agentharm, agentharm_benign) run live through the Inspect harness	GitHub UKGovernmentBEIS/inspect_evals	arXiv:2410.09024
kexin-xu-01-agentharm	Kexin-xu-01/agentharm (AgentHarm Inspect logs)	GitHub Kexin-xu-01/agentharm	none recorded
fragfuse-agentharm	zixin22/fragfuse_agentharm (AgentHarm Inspect logs and memory/carrier attack runs)	GitHub zixin22/fragfuse_agentharm	none recorded
agentops-bench	AgentOps-Bench v1.0 pilot (Zenodo 19875693)	Zenodo 19875693	AgentOps-Bench: A Reproducible Benchmark for Operational Evaluation of Tool-Using LLM Agents (doi:10.5281/zenodo.19875456)
drift	DRIFT (SaFo-Lab/DRIFT) run logs	GitHub SaFo-Lab/DRIFT	arXiv:2506.12104
credleak-p15b	Run data of the credential-leak attack-surface measurement of LLM coding agents (Zenodo 22737462)	Zenodo 22737462	How Credentials Leak from 'Safe' LLM Coding Agents: An Attack-Surface Measurement (no identifier recorded)
controlarena-persistent	Control-arena persistent-state evaluation archive (HF idacy, 2026-07-30)	HF idacy/control-arena-persistent-state-eval-archive-2026-07-30	Hills, Caspary & Cooper Stickland, Distributed Attacks in Persistent-State AI Control (arXiv:2607.02514)
atia-benchmark	ATIA: adversarial tool infiltration benchmark (mattngyn/atia_benchmark)	GitHub mattngyn/atia_benchmark	none recorded
autogen-guard-placement	AutoGen guard placement (Zenodo 23025259 v1.0)	Zenodo 23025259	Guard Placement and Interception Timing for Runtime Risk Control in AutoGen Multi-Agent Teams (doi:10.5281/zenodo.23025258)
what-surrounds	What surrounds an injection decides whether it works (Zenodo 21944598)	Zenodo 21944598	What surrounds an injection decides whether it works: context and channel effects in tool-metadata attacks on seven production LLM agents (doi:10.5281/zenodo.21944597)
mcphunt	MCPHunt agent traces (HF lihaonan0716/mcphunt-agent-traces)	HF lihaonan0716/mcphunt-agent-traces	MCPHunt: An Evaluation Framework for Cross-Boundary Data Propagation in Multi-Server MCP Agents (arXiv:2604.27819)
code-agent-misalignment-geminicli	Code-agent agentic misalignment RESULTS_raw, gemini_cli streams (Zenodo 20404563)	Zenodo 20404563	RESULTS_raw: Raw rollout bundle for code-agent agentic misalignment benchmark (doi:10.5281/zenodo.20404563, doi:10.5281/zenodo.20404562, github.com/warmjademe/code_agent_agentic_misalignment)
authority-caps-agentdojo	agent-authority-caps: AgentDojo logs under enforced authority caps (Zenodo 23138310)	Zenodo 22973265	Evaluating AI agent permission caps under prompt injection with reference scoring and enforced execution (no identifier recorded)
ipi-defenses-agentdojo	IPI defences replication package: AgentDojo banking logs under built-in defences (Zenodo 22011266)	Zenodo 20731176	Evaluating Indirect Prompt-Injection Defenses in Tool-Using LLM Agents: Security, Utility, and Replication (no identifier recorded)
dca-agentdojo	DCA AgentDojo artefact v1: logs under DCA, CaMeL and DRIFT (Figshare 32657856)	https://doi.org/10.6084/m9.figshare.32657856	Decision-Space Counterfactual Auditing for Prompt Injection Defense in Tool-Using LLM Agents (no identifier recorded)
kavach-agentdojo	Kavach: AgentDojo logs of a runtime tool-call defence (Ishani018/Kavach, three branches)	GitHub Ishani018/Kavach	none recorded
drift1-agentdojo	drift-1 (CGboom-git/drift-1): DRIFT-format logs incl. a PACT-DRIFT arm	GitHub CGboom-git/drift-1	arXiv:2506.12104
redcode-exec-qwencode	RedCode-Exec agent runs, Qwen Code part (Zenodo 23168099)	Zenodo 23168099	Which Orders Count? A Behavioral Study of Execution Decisions in Autonomous Coding Agents (doi:10.5281/zenodo.23168099)

8 registered parts that are not a corpus of their own

| Source · part | Role or status | Pinned origin | Executions | Caveats | |---|---|---|---|---| | `agentdojo` · `live` | live partial | GitHub [`ethz-spylab/agentdojo`](https://github.com/ethz-spylab/agentdojo) @ `a75aba76` | not in the repository: live capture produces new executions; a real-model pilot (2026-10-22, docs/reports/live-pilot/) made working corpora only, never released | — | | `agentdyn` · `d` | owned elsewhere (drift) | no pin of its own | not in the repository: 949 logs, counted under `drift` · `head` | — | | `agentdyn` · `live` | live partial | GitHub [`SaFo-Lab/AgentDyn`](https://github.com/SaFo-Lab/AgentDyn) @ `5353cf76` | not in the repository: live capture from AgentDyn's own pinned code produces new executions; a local real-model pilot (2026-10-22, docs/reports/live-pilot/) made working corpora only, never released | — | | `autodojo` · `live` | live partial | GitHub [`xhOwenMa/AutoDojo`](https://github.com/xhOwenMa/AutoDojo) @ `aa458794` | not in the repository: live capture produces new executions; a local real-model pilot (2026-10-22, docs/reports/live-pilot/) made working corpora only, never released | — | | `adprov-v1` · `converted-legacy` | compat oracle (agentdojo) | GitHub [`nickjones39/agentdojo-prov`](https://github.com/nickjones39/agentdojo-prov) @ `579a9083` `corpus/corpus-og-agentdojo-runs-prov` | not in the repository: derived data of `agentdojo` · `2024-06` (18,027 transcripts); the compat oracle, never released | licence policy `reference`: registered and censused, never released | | `foobench` · `fixture` | no status (toy format) | no pin of its own | not in the repository: a self-authored toy format with test fixtures only; no pinned snapshot | — | | `agentharm` · `live` | live partial | HF [`ai-safety-institute/AgentHarm`](https://huggingface.co/datasets/ai-safety-institute/AgentHarm) @ `e23b3fe6` | not in the repository: live runs through the Inspect harness produce new executions; a capped real-model probe (2026-10-23, docs/reports/inspect-harness/probe-d667.md) made working corpora only, never released | restricted use: AgentHarm's clause, use only to improve AI safety and security; restricted-use corpus, private (D-668) | | `drift` · `history` | import planned | GitHub [`SaFo-Lab/DRIFT`](https://github.com/SaFo-Lab/DRIFT) @ `53dbc6c5` `runs/` | [1,046](https://github.com/nickjones39/AgentPROV/blob/main/docs/reports/phase10l/census.md) logs (census) | licence policy `reference`: registered and censused, never released; committed before any licence statement (D-279) |

The sealed corpora: checks and reproduction

Every corpus with an imported part is sealed at version 0.1.0: 52 corpora, sealed on 2026-10-29 in two batches. The listing above gives each one's released executions and its tag (corpus/<corpus_id>/v0.1.0, whose message records the sealed tree and its content digest); the seal reports give its root digest, what was withheld and why, and the checks it passed.

• Round 1, eight corpora. Imported in full and rebuilt in the 2026 regeneration round (decisions D-350..D-359), post-checked read-only (docs/reports/postcheck/summary.md) and sealed from 8bb6bc92 after their pre-release checks (docs/reports/release/pre-release-checks.md).
• Wave 2, 44 corpora. The further sources, imported in full from their pins (docs/reports/wave-2-corpora/README.md) and sealed after their own pre-release checks (docs/reports/release/wave-2-pre-release-checks.md): 43 trees from c0e711f4 and DTap from 3000b220 (tags wave2/seal-c0e711f4 and wave2/seal-3000b220). controlarena-persistent is a metadata-only release: its profile withholds all 5,742 executions at the seal (D-344).
• Three earlier trees are never sealed. ast-survey-agentdojo-rg1 and ast-survey-agentharm-rg1 would ship raw files that name a third party's workstation account; adprov-v1-release-rg1 lacks the compat PROV its corpus spec requires. The rg2 trees above replace them.
• Security outcomes are class I in two corpora (Option A). In mandate-agentdojo-eval (369 outcomes) and in the v1.k14 logs of agentdojo-upstream-head (11,236 outcomes), the security outcome is inferred (class I), not derived (class D): the rule that verifies AgentDojo's checker lists only the commit of the June-2024 snapshot, so logs from later AgentDojo commits cite its unverified twin (decision D-359). The checker's code is the same at those commits, so re-importing with a widened rule (Option B) was considered and set aside: the user's final choice (2026-10-28) is to keep the corpora as built and disclose the I class in their datasheets. Utility outcomes stay D.
• Re-derive them at their building commit. main has changed code in the stages' scope since these trees were built, so recompute or re-derive each one at the commit that built it, not at main (chapter 4). Round 1's are 5b1f6fdf for six corpora, d93aa261 for ast-survey-agentdojo and 5fc39c16 for ast-survey-agentharm; their predecessors rebuilt byte for byte at their building commit (D-358, docs/reports/regeneration/d358/). Each wave-2 tree's is its wave2/build-* tag; every tree was recomputed there before the seal, and check 7 of the wave-2 seal report accounts for each after it (DTap under the re-map rule D-1002, MCPHunt with D-1001).