Known artefacts of the converted corpora

Released logs contain artefacts of the harnesses that wrote them. Every corpus is scanned with the shared artefact layer (specification D.15), and each adapter family's catalogue names the artefacts it knows, with a detector and a handling class. The tables list, per corpus, each artefact class found, its handling class and how many records it affects. They hold class names, counts and handling only, never artefact contents. Rows are coverage, not a partition: one execution can show several artefacts. Findings that no catalogue entry claims appear as artefact.unclassified.* and are never filtered out.

Handling classes: CR correct representation; DR derived reconstruction; RJ recomputed judgement; FO flag only; NR not recoverable.

Denominators: the agentprov stats population is the corpus's agent executions. Outcome-only records (AgentDojo logs with outcomes and an empty message list) are not agent executions; the scan still covers them, and the empty-message-list class counts them.

Corpora: the 52 sealed corpora, listed by corpus id. Sealing withholds files and executions that hold personal data (decisions D-771, D-810 and D-811, and any later ones each corpus's WITHHELD.json records), so some execution counts are lower than in the working trees the corpora were sealed from (generated 2026-10-30).

adprov-v1-release

AgentDojo-PROV v2.3 released transcripts, re-imported as AgentPROV Execution Records

17,656 records in the corpus: 17,656 agent executions. 13 artefact classes found; unclassified findings in 121 executions (counted per class).

Artefact class	Title	Handling	Records
adprov.art.times_not_recorded	transcript/v1 records no per-message or per-model-call time	NR	17,656
adprov.art.single_attempt_inferred	A single attempt is inferred from the harness call counter	CR	14,560
adprov.art.last_pass_only	A transcript holds only the final scored pass	NR	3,096
adprov.art.payload_not_reaching_agent	The injected payload never appears in what the agent read	FO	3,033
adprov.art.usage_absent	Model-call completeness is unverifiable without reported usage (A2)	FO	2,943
adprov.art.benign_security_normalised	A released benign security of null is a normalisation of a constant	CR	582
adprov.art.text_tool_call	Tool calls written as text and never executed (A4)	FO	135
adprov.art.rerun_passes_lost	Earlier passes of a silent re-run are lost (A1)	CR	121
adprov.art.calls_pending_at_limit	Calls requested but not executed when max_iters stopped the loop (A5)	CR	47
adprov.art.reported_calls_exceed	Reported call count exceeds the held assistant messages	FO	32
adprov.art.abnormal_finish	Abnormal finish reasons (A6)	FO	4
adprov.art.provider_call_ids	Provider tool-call ids are absent, empty or repeated (A8)	CR	1
adprov.art.timing_overwritten_by_id	Tool timing keyed by a repeated call id	NR	1

agentdojo-upstream-2024-06

AgentDojo upstream TraceLogger run logs, June-2024 snapshot

18,231 records in the corpus: 18,024 agent executions and 207 outcome-only records. 14 artefact classes found; unclassified findings in 0 executions (counted per class).

Artefact class	Title	Handling	Records
agentdojo.art.naive_timestamp	Run start is a naive local timestamp	NR	18,231
agentdojo.art.timing_stub	No tool or run times; the converter's timing stub	NR	18,231
agentdojo.art.silent_rerun	Only the last of up to three passes is logged	CR	18,024
agentdojo.art.calls_derived_from_messages	Model calls derived from the messages	NR	17,998
agentdojo.art.payload_not_reaching_agent	The injected payload never appears in what the agent read	FO	2,969
agentdojo.art.provider_ids	Provider call-id anomalies	CR	2,791
agentdojo.art.benign_security_constant	Benign security is the runner's constant True	CR	2,013
agentdojo.art.dos_polarity	DoS security is not utility	CR	485
agentdojo.art.empty_log	Empty message list with logged outcomes	CR	207
agentdojo.art.repeated_provider_ids	Repeated non-empty call ids within a log (GPT)	CR	189
agentdojo.art.max_iters_pending	Requested calls never executed (max_iters = 15)	CR	145
agentdojo.art.run_error_imposed	Outcomes imposed by the runner after a run error	CR	106
agentdojo.art.text_tool_call	Text-written, unexecuted tool calls (Llama-3 prompting)	FO	14
agentdojo.art.incomplete_run	Logs without outcomes or duration	NR	4

agentdojo-upstream-head

AgentDojo upstream TraceLogger run logs, head snapshot

36,666 records in the corpus: 36,459 agent executions and 207 outcome-only records. 15 artefact classes found; unclassified findings in 0 executions (counted per class).

Artefact class	Title	Handling	Records
agentdojo.art.naive_timestamp	Run start is a naive local timestamp	NR	36,666
agentdojo.art.timing_stub	No tool or run times; the converter's timing stub	NR	36,666
agentdojo.art.silent_rerun	Only the last of up to three passes is logged	CR	36,459
agentdojo.art.calls_derived_from_messages	Model calls derived from the messages	NR	36,434
agentdojo.art.provider_ids	Provider call-id anomalies	CR	15,824
agentdojo.art.payload_not_reaching_agent	The injected payload never appears in what the agent read	FO	5,895
agentdojo.art.benign_security_constant	Benign security is the runner's constant True	CR	3,545
agentdojo.art.local_parse_drop	Local-model raw completions with more tool tags than parsed calls	FO	1,853
agentdojo.art.text_tool_call	Text-written, unexecuted tool calls (Llama-3 prompting)	FO	1,208
agentdojo.art.max_iters_pending	Requested calls never executed (max_iters = 15)	CR	800
agentdojo.art.dos_polarity	DoS security is not utility	CR	485
agentdojo.art.repeated_provider_ids	Repeated non-empty call ids within a log (GPT)	CR	213
agentdojo.art.empty_log	Empty message list with logged outcomes	CR	207
agentdojo.art.run_error_imposed	Outcomes imposed by the runner after a run error	CR	105
agentdojo.art.incomplete_run	Logs without outcomes or duration	NR	1

agentdyn-a

AgentDyn run logs, variant A

38,154 records in the corpus: 38,154 agent executions. 13 artefact classes found; unclassified findings in 0 executions (counted per class).

Artefact class	Title	Handling	Records
agentdojo.art.naive_timestamp	Run start is a naive local timestamp	NR	38,154
agentdojo.art.silent_rerun	Only the last of up to three passes is logged	CR	38,154
agentdojo.art.calls_derived_from_messages	Model calls derived from the messages	NR	38,143
agentdojo.art.payload_not_reaching_agent	The injected payload never appears in what the agent read	FO	18,312
agentdojo.art.benign_security_constant	Benign security is the runner's constant True	CR	5,163
agentdojo.art.provider_ids	Provider call-id anomalies	CR	3,056
agentdojo.art.max_iters_pending	Requested calls never executed (max_iters = 15)	CR	1,662
agentdojo.art.text_tool_call	Text-written, unexecuted tool calls (Llama-3 prompting)	FO	1,001
agentdojo.art.local_parse_drop	Local-model raw completions with more tool tags than parsed calls	FO	484
agentdyn.art.camel_orphan_results	CaMeL interpreter tool results without a planner call	CR	240
agentdojo.art.incomplete_run	Logs without outcomes or duration	NR	12
agentdyn.art.progent_directory_strays	Variant-A logs in a Progent directory	FO	12
agentdojo.art.run_error_imposed	Outcomes imposed by the runner after a run error	CR	5

agentdyn-b

AgentDyn run logs

5,167 records in the corpus: 5,167 agent executions. 7 artefact classes found; unclassified findings in 0 executions (counted per class).

Artefact class	Title	Handling	Records
agentdojo.art.calls_derived_from_messages	Model calls derived from the messages	NR	5,167
agentdojo.art.naive_timestamp	Run start is a naive local timestamp	NR	5,167
agentdojo.art.silent_rerun	Only the last of up to three passes is logged	CR	5,167
agentdojo.art.payload_not_reaching_agent	The injected payload never appears in what the agent read	FO	1,535
agentdojo.art.benign_security_constant	Benign security is the runner's constant True	CR	704
agentdojo.art.max_iters_pending	Requested calls never executed (max_iters = 15)	CR	96
agentdojo.art.text_tool_call	Text-written, unexecuted tool calls (Llama-3 prompting)	FO	28

agentdyn-c

AgentDyn run logs

4,244 records in the corpus: 4,244 agent executions. 10 artefact classes found; unclassified findings in 0 executions (counted per class).

Artefact class	Title	Handling	Records
agentdojo.art.calls_derived_from_messages	Model calls derived from the messages	NR	4,244
agentdojo.art.naive_timestamp	Run start is a naive local timestamp	NR	4,244
agentdojo.art.silent_rerun	Only the last of up to three passes is logged	CR	4,244
drift.art.agent_prompt_not_recorded	DRIFT's agent prompt is not logged	NR	4,244
drift.art.single_pass	A DRIFT run has one pass, inferred	CR	4,244
agentdojo.art.payload_not_reaching_agent	The injected payload never appears in what the agent read	FO	3,826
drift.art.injection_map_not_recorded	DRIFT writes no injections map	NR	3,826
agentdojo.art.text_tool_call	Text-written, unexecuted tool calls (Llama-3 prompting)	FO	3,108
drift.art.calls_in_text_not_executed	Final DRIFT turns propose calls that were not executed	CR	2,001
drift.art.benign_security_constant	DRIFT's benign security is a constant True	CR	418

agentops-bench

AgentOps-Bench v1.0 pilot: 8 models x 100 tasks x 3 conditions x 3 runs, in-scope part

3,360 records in the corpus: 3,259 agent executions and 101 outcome-only records. 15 artefact classes found; unclassified findings in 0 executions (counted per class).

Artefact class	Title	Handling	Records
agentops.art.event_times_not_recorded	Only call timestamps are logged	NR	3,360
agentops.art.derived_model_calls	Model calls derived from steps	NR	3,259
agentops.art.user_message_not_logged	No user or system message	NR	3,259
agentops.art.no_call_ids	No call ids	NR	2,650
agentops.art.safety_default	Safety score written without evaluation	CR	1,987
agentops.art.injector_did_not_fire	Adversarial run without a payload	FO	967
agentops.art.fault_injection	Fabricated tool failure	CR	555
agentops.art.repeated_tool_names	Step with repeated tool names	FO	378
agentops.art.iteration_limit	Run stopped at the iteration cap	FO	133
agentops.art.run_error	Run ended in error	FO	133
agentops.art.dispatch_error_result	Tool result is a dispatch error	FO	120
agentops.art.empty_trace	Empty trace	CR	101
agentops.art.text_encoded_call	Suspected tool call written as text	FO	21
agentops.art.account_path_tool_output	Third-party account path in tool output (security)	CR	13
agentops.art.unlisted_tool_name	Call to a tool the server does not offer	FO	3

aiauthz-agentdojo

aiAuthZ on AgentDojo: AgentDojo 0.1.35 banking logs of an authorization defence via OpenRouter

174 records in the corpus: 174 agent executions. 5 artefact classes found; unclassified findings in 0 executions (counted per class).

Artefact class	Title	Handling	Records
agentdojo.art.calls_derived_from_messages	Model calls derived from the messages	NR	174
agentdojo.art.naive_timestamp	Run start is a naive local timestamp	NR	174
agentdojo.art.silent_rerun	Only the last of up to three passes is logged	CR	174
agentdojo.art.benign_security_constant	Benign security is the runner's constant True	CR	54
agentdojo.art.payload_not_reaching_agent	The injected payload never appears in what the agent read	FO	10

ast-survey-agentdojo

Agent Security Tools Survey: the survey's own AgentDojo run logs

3,232 records in the corpus: 3,232 agent executions. 9 artefact classes found; unclassified findings in 0 executions (counted per class).

Artefact class	Title	Handling	Records
agentdojo.art.calls_derived_from_messages	Model calls derived from the messages	NR	3,232
agentdojo.art.naive_timestamp	Run start is a naive local timestamp	NR	3,232
agentdojo.art.silent_rerun	Only the last of up to three passes is logged	CR	3,232
agentdojo.art.payload_not_reaching_agent	The injected payload never appears in what the agent read	FO	600
agentdojo.art.benign_security_constant	Benign security is the runner's constant True	CR	394
survey.art.text_tool_call_unparsed	Tool calls emitted as text by qwen3-coder and never executed	FO	174
agentdojo.art.max_iters_pending	Requested calls never executed (max_iters = 15)	CR	47
agentdojo.art.run_error_imposed	Outcomes imposed by the runner after a run error	CR	11
survey.art.readme_error_tasks_mismatch	README names other tasks than the released run errors	FO	11

ast-survey-agentharm

Agent Security Tools Survey: AgentHarm Inspect logs

1,055 records in the corpus: 1,055 agent executions. 5 artefact classes found; unclassified findings in 0 executions (counted per class).

Artefact class	Title	Handling	Records
inspect.art.sample_limit	Samples stopped at a message limit	CR	54
inspect.art.abnormal_finish_max_tokens	Model turn stopped at max_tokens	FO	23
inspect.art.text_tool_call	Tool call written as text	FO	12
inspect.art.condensed_references	Inputs and long strings stored by reference	CR	4
inspect.art.tool_result_lost_at_limit	Tool executions whose result message never entered the log	NR	4

atia-benchmark

ATIA: Inspect .eval logs of adversarial tool infiltration through multimodal inputs

110 records in the corpus: 110 agent executions. 3 artefact classes found; unclassified findings in 0 executions (counted per class).

Artefact class	Title	Handling	Records
inspect.art.times_not_recorded	Times the log does not record, or records contradictorily	NR	110
inspect.art.content_not_inlined	Strings over 1 MiB not inlined	CR	21
inspect.art.event_kept_in_ext	Events with no AER kind kept in ext	CR	2

authority-caps-agentdojo

agent-authority-caps: AgentDojo 0.1.35 logs of GPT-6 Luna/Sol, Claude Haiku 4.5, gpt-4o-mini and gpt-3.5-turbo under enforced authority caps

18,734 records in the corpus: 18,734 agent executions. 9 artefact classes found; unclassified findings in 0 executions (counted per class).

Artefact class	Title	Handling	Records
agentdojo.art.naive_timestamp	Run start is a naive local timestamp	NR	18,734
agentdojo.art.silent_rerun	Only the last of up to three passes is logged	CR	18,734
agentdojo.art.calls_derived_from_messages	Model calls derived from the messages	NR	18,733
agentdojo.art.benign_security_constant	Benign security is the runner's constant True	CR	2,153
agentdojo.art.payload_not_reaching_agent	The injected payload never appears in what the agent read	FO	1,120
agentdojo.art.unattributed_user_message	Later user messages that no declared quirk accounts for	FO	313
agentdojo.art.max_iters_pending	Requested calls never executed (max_iters = 15)	CR	104
agentdojo.art.run_error_imposed	Outcomes imposed by the runner after a run error	CR	51
agentdojo.art.incomplete_run	Logs without outcomes or duration	NR	5

autogen-guard-placement

AutoGen guard placement: one prompt-injection guard at the model client, message bus and tool boundary of an AutoGen 0.7.5 team

1,080 records in the corpus: 1,040 agent executions and 40 outcome-only records. 10 artefact classes found; unclassified findings in 0 executions (counted per class).

Artefact class	Title	Handling	Records
autogen.art.times_in_ext	Wall-clock values kept in ext	NR	1,080
autogen.art.function_calls_finish	finish_reason function_calls	NR	737
autogen.art.guard_text_unjoined	Guard verdicts whose text is not one recorded record	FO	588
autogen.art.payload_outside_tool_results	Injection delivered outside tool results	NR	260
autogen.art.block_effect_in_request_log	Block whose replaced copy is only in the request log	FO	87
autogen.art.block_subject_not_recorded	Block of a text that is not a recorded message	FO	49
autogen.art.keyword_stop_before_agents	Team stopped before any agent spoke	CR	40
autogen.art.text_encoded_call	Call-like text in agent output	NR	13
autogen.art.tool_error_result	Tool call rejected before its body	CR	4
autogen.art.aborted_attempt_events	Event rows of aborted first attempts	FO	3

bookkeeper-agentdojo

Munim: AgentDojo 0.1.35 banking logs of a deterministic money gate

570 records in the corpus: 570 agent executions. 6 artefact classes found; unclassified findings in 0 executions (counted per class).

Artefact class	Title	Handling	Records
agentdojo.art.naive_timestamp	Run start is a naive local timestamp	NR	570
agentdojo.art.silent_rerun	Only the last of up to three passes is logged	CR	570
agentdojo.art.calls_derived_from_messages	Model calls derived from the messages	NR	569
agentdojo.art.benign_security_constant	Benign security is the runner's constant True	CR	99
agentdojo.art.incomplete_run	Logs without outcomes or duration	NR	4
agentdojo.art.max_iters_pending	Requested calls never executed (max_iters = 15)	CR	1

ceferisbarov-agentdojo

ceferisbarov/agentdojo reruns: AgentDojo logs of optimised injection strings over 61 arms

18,438 records in the corpus: 18,433 agent executions and 5 outcome-only records. 10 artefact classes found; unclassified findings in 47 executions (counted per class).

Artefact class	Title	Handling	Records
agentdojo.art.naive_timestamp	Run start is a naive local timestamp	NR	18,438
agentdojo.art.silent_rerun	Only the last of up to three passes is logged	CR	18,433
agentdojo.art.calls_derived_from_messages	Model calls derived from the messages	NR	18,389
agentdojo.art.payload_not_reaching_agent	The injected payload never appears in what the agent read	FO	8,671
agentdojo.art.benign_security_constant	Benign security is the runner's constant True	CR	993
agentdojo.art.provider_ids	Provider call-id anomalies	CR	220
agentdojo.art.run_error_imposed	Outcomes imposed by the runner after a run error	CR	65
agentdojo.art.max_iters_pending	Requested calls never executed (max_iters = 15)	CR	52
agentdojo.art.incomplete_run	Logs without outcomes or duration	NR	39
agentdojo.art.empty_log	Empty message list with logged outcomes	CR	5

code-agent-misalignment

Code-agent agentic misalignment, gemini_cli streams: 5 models x 500 mutations, structured part

2,175 records in the corpus: 2,175 agent executions. 10 artefact classes found; unclassified findings in 23 executions (counted per class).

Artefact class	Title	Handling	Records
geminicli.art.emission_times	Event times are emission times	NR	2,175
geminicli.art.cli_call_ids	Call ids are the CLI's, not the provider's	NR	2,047
geminicli.art.derived_model_calls	Model calls derived from blocks	NR	2,047
geminicli.art.cli_model_alias	Stream names the CLI's model, not the cell's	CR	1,756
geminicli.art.no_result_event	Stream without a result event	FO	1,229
geminicli.art.cli_error_result	Run ended with an error result	FO	1,211
geminicli.art.verdict_meta_disagree	Verdict exit code contradicts the CLI's	FO	1,211
geminicli.art.subagent_internals	Sub-agent calls not logged	FO	745
geminicli.art.unanswered_last_call	Call without a result	FO	72
geminicli.art.cli_notice	CLI warning in the stream	FO	66

controlarena-persistent

Control-arena persistent-state evaluation archive: Inspect .eval logs of AI-control runs

0 records in the corpus: 0 agent executions. 0 artefact classes found; unclassified findings in 0 executions (counted per class).

Artefact class	Title	Handling	Records

craibench-agentdojo

CrAIBench: AgentDojo v0.k11 logs of two new crypto suites with memory and prompt injection

1,163 records in the corpus: 1,163 agent executions. 6 artefact classes found; unclassified findings in 0 executions (counted per class).

Artefact class	Title	Handling	Records
agentdojo.art.calls_derived_from_messages	Model calls derived from the messages	NR	1,163
agentdojo.art.naive_timestamp	Run start is a naive local timestamp	NR	1,163
agentdojo.art.silent_rerun	Only the last of up to three passes is logged	CR	1,163
agentdojo.art.payload_not_reaching_agent	The injected payload never appears in what the agent read	FO	705
agentdojo.art.unattributed_user_message	Later user messages that no declared quirk accounts for	FO	688
agentdojo.art.benign_security_constant	Benign security is the runner's constant True	CR	40

credleak-p15b

Run data of the credential-leak attack-surface measurement of LLM coding agents

14,207 records in the corpus: 14,207 agent executions. 8 artefact classes found; unclassified findings in 10 executions (counted per class).

Artefact class	Title	Handling	Records
credleak.art.duration_no_clock	Durations without a clock, and no typed time	NR	14,207
credleak.art.model_calls_not_recorded	No model-call boundaries	NR	14,207
credleak.art.payload_not_recorded	The planted payload is not a field of the run	FO	14,207
credleak.art.turn_time_role_unknown	Turn timestamps of unknown role	NR	14,207
credleak.art.no_call_ids	Tool calls carry no call id	CR	12,712
credleak.art.tool_call_count_absent	toolCallCount absent from old-schema runs	NR	11,292
credleak.art.tool_output_account_redacted	Third-party account paths in tool output redacted	CR	2,858
credleak.art.invocation_error	Model invocation error	FO	59

dca-agentdojo

DCA AgentDojo artefact v1: AgentDojo 0.1.35 logs of gpt-4o-mini, GPT-OSS-20B and Qwen models under DCA, CaMeL and DRIFT

16,211 records in the corpus: 16,211 agent executions. 14 artefact classes found; unclassified findings in 4,255 executions (counted per class).

Artefact class	Title	Handling	Records
agentdojo.art.calls_derived_from_messages	Model calls derived from the messages	NR	16,211
agentdojo.art.naive_timestamp	Run start is a naive local timestamp	NR	16,211
agentdojo.art.silent_rerun	Only the last of up to three passes is logged	CR	16,211
agentdojo.art.payload_not_reaching_agent	The injected payload never appears in what the agent read	FO	9,024
agentdojo.art.text_tool_call	Text-written, unexecuted tool calls (Llama-3 prompting)	FO	4,733
agentdojo.art.null_provider_call_ids	Null provider call ids (gate, DCA)	CR	3,854
agentdojo.art.orphan_tool_results	Tool results that answer no listed call	FO	2,947
drift.art.agent_prompt_not_recorded	DRIFT's agent prompt is not logged	NR	2,847
drift.art.injection_map_not_recorded	DRIFT writes no injections map	NR	2,847
drift.art.single_pass	A DRIFT run has one pass, inferred	CR	2,847
agentdojo.art.benign_security_constant	Benign security is the runner's constant True	CR	1,037
drift.art.calls_in_text_not_executed	Final DRIFT turns propose calls that were not executed	CR	291
agentdojo.art.max_iters_pending	Requested calls never executed (max_iters = 15)	CR	161
agentdojo.art.run_error_imposed	Outcomes imposed by the runner after a run error	CR	4

drift-head

DRIFT run logs: AgentDojo v1.2 and AgentDyn suites under the DRIFT defence, gpt-4o-mini

1,564 records in the corpus: 1,564 agent executions. 9 artefact classes found; unclassified findings in 0 executions (counted per class).

Artefact class	Title	Handling	Records
agentdojo.art.calls_derived_from_messages	Model calls derived from the messages	NR	1,564
agentdojo.art.naive_timestamp	Run start is a naive local timestamp	NR	1,564
drift.art.agent_prompt_not_recorded	DRIFT's agent prompt is not logged	NR	1,564
drift.art.single_pass	A DRIFT run has one pass, inferred	CR	1,564
agentdojo.art.payload_not_reaching_agent	The injected payload never appears in what the agent read	FO	1,504
drift.art.injection_map_not_recorded	DRIFT writes no injections map	NR	1,504
agentdojo.art.text_tool_call	Text-written, unexecuted tool calls (Llama-3 prompting)	FO	919
drift.art.calls_in_text_not_executed	Final DRIFT turns propose calls that were not executed	CR	314
drift.art.benign_security_constant	DRIFT's benign security is a constant True	CR	60

drift1-agentdojo

drift-1: DRIFT-format logs of gpt-4o-mini, including a PACT-DRIFT arm

626 records in the corpus: 626 agent executions. 11 artefact classes found; unclassified findings in 0 executions (counted per class).

Artefact class	Title	Handling	Records
agentdojo.art.calls_derived_from_messages	Model calls derived from the messages	NR	626
agentdojo.art.naive_timestamp	Run start is a naive local timestamp	NR	626
drift.art.agent_prompt_not_recorded	DRIFT's agent prompt is not logged	NR	626
drift.art.single_pass	A DRIFT run has one pass, inferred	CR	626
agentdojo.art.payload_not_reaching_agent	The injected payload never appears in what the agent read	FO	529
drift.art.injection_map_not_recorded	DRIFT writes no injections map	NR	529
agentdojo.art.text_tool_call	Text-written, unexecuted tool calls (Llama-3 prompting)	FO	372
drift.art.benign_security_constant	DRIFT's benign security is a constant True	CR	97
drift.art.calls_in_text_not_executed	Final DRIFT turns propose calls that were not executed	CR	78
agentdojo.art.fork_top_level_keys	Fork loggers add top-level keys	CR	10
drift.art.call_error_unrecognised	CALL ERROR texts that name neither DRIFT check	FO	4

dtap-bench

DTap-Bench agent trajectories with the DecodingTrust-Agent-Platform task configurations

67,708 records in the corpus: 67,684 agent executions and 24 outcome-only records. 25 artefact classes found; unclassified findings in 0 executions (counted per class).

Artefact class	Title	Handling	Records
dtap.art.event_times_not_recorded	Only a run timestamp is logged	NR	67,708
dtap.art.derived_model_calls	Model calls derived from agent steps	NR	67,348
dtap.art.no_call_ids	No provider call ids	NR	51,437
dtap.art.payload_not_observed	No observed payload marker	FO	33,416
dtap.art.harness_default_outcome	Harness-default judgement	CR	30,182
dtap.art.no_user_step	No user step logged	NR	10,126
dtap.art.pairing_ambiguous_batch	Multi-call batch without call ids	FO	10,074
dtap.art.path_domain_spelling	Domain spelled differently in the path and task_info	CR	7,640
dtap.art.instruction_truncated_500	Instruction cut at 500 characters	FO	7,353
dtap.art.direct_prompt_constant_task_success	Constant task_success in direct_prompt runs	CR	5,461
dtap.art.config_join_drift	Configuration drift (join tier B or C)	FO	4,589
dtap.art.rerun_single_judge	Re-run directory with one judge	FO	3,142
dtap.art.host_account_paths	Harness-host account names in tool output and agent text	FO	2,376
dtap.art.goal_rewritten_at_eval	Goal rewritten for evaluation	FO	1,182
dtap.art.config_missing_or_unparseable	Configuration missing or unparseable	NR	783
dtap.art.harness_failure_judged	Harness failure that was judged	FO	47
dtap.art.additional_user_message	Additional user step	FO	35
dtap.art.tool_listing_only	Trajectory of tool listings only	FO	18
dtap.art.empty_trajectory	Empty trajectory	CR	17
dtap.art.judge_error	Judge error	FO	14
dtap.art.judge_only_directory	Judge without a trajectory	CR	7
dtap.art.source_truncation_marker	Dataset-side truncation marker	FO	3
dtap.art.call_never_answered	Call that no tool step answers	CR	2
dtap.art.content_not_inlined	Strings over 1 MiB not inlined	CR	1
dtap.art.partial_trajectory	Partial trajectory	FO	1

fragfuse-agentharm

zixin22/fragfuse_agentharm: AgentHarm Inspect .eval logs and memory/carrier attack runs

1,747 records in the corpus: 1,744 agent executions and 3 outcome-only records. 7 artefact classes found; unclassified findings in 0 executions (counted per class).

Artefact class	Title	Handling	Records
inspect.art.sample_limit	Samples stopped at a message limit	CR	74
inspect.art.value_redacted	Workstation account paths redacted (Inspect)	CR	25
inspect.art.event_kept_in_ext	Events with no AER kind kept in ext	CR	24
inspect.art.tool_result_lost_at_limit	Tool executions whose result message never entered the log	NR	23
inspect.art.times_not_recorded	Times the log does not record, or records contradictorily	NR	19
inspect.art.abnormal_finish_reported	Truncated, filtered, context-length and unknown stop reasons	FO	9
inspect.art.no_model_or_tool_event	Samples without a model or tool event	CR	3

gate-agentdojo

gate: AgentDojo 0.1.35 logs of a deterministic policy gate on local and Venice-served Qwen models

3,870 records in the corpus: 3,868 agent executions and 2 outcome-only records. 12 artefact classes found; unclassified findings in 0 executions (counted per class).

Artefact class	Title	Handling	Records
agentdojo.art.naive_timestamp	Run start is a naive local timestamp	NR	3,870
agentdojo.art.calls_derived_from_messages	Model calls derived from the messages	NR	3,868
agentdojo.art.silent_rerun	Only the last of up to three passes is logged	CR	3,868
agentdojo.art.benign_security_constant	Benign security is the runner's constant True	CR	1,491
agentdojo.art.orphan_tool_results	Tool results that answer no listed call	FO	818
agentdojo.art.null_provider_call_ids	Null provider call ids (gate, DCA)	CR	791
agentdojo.art.payload_not_reaching_agent	The injected payload never appears in what the agent read	FO	428
agentdojo.art.text_tool_call	Text-written, unexecuted tool calls (Llama-3 prompting)	FO	391
agentdojo.art.model_not_recorded	No log records the agent's model	NR	217
agentdojo.art.max_iters_pending	Requested calls never executed (max_iters = 15)	CR	13
agentdojo.art.incomplete_run	Logs without outcomes or duration	NR	3
agentdojo.art.empty_log	Empty message list with logged outcomes	CR	2

geryon-agentdojo

Geryon: AgentDojo v0.k11 logs of conditions A and B

3,179 records in the corpus: 3,179 agent executions. 7 artefact classes found; unclassified findings in 1 executions (counted per class).

Artefact class	Title	Handling	Records
agentdojo.art.naive_timestamp	Run start is a naive local timestamp	NR	3,179
agentdojo.art.silent_rerun	Only the last of up to three passes is logged	CR	3,179
agentdojo.art.calls_derived_from_messages	Model calls derived from the messages	NR	3,178
agentdojo.art.payload_not_reaching_agent	The injected payload never appears in what the agent read	FO	436
agentdojo.art.benign_security_constant	Benign security is the runner's constant True	CR	211
agentdojo.art.max_iters_pending	Requested calls never executed (max_iters = 15)	CR	28
agentdojo.art.incomplete_run	Logs without outcomes or duration	NR	1

glitch-agentdojo

Glitch on AgentDojo: AgentDojo 0.1.35 logs of an external tool-call gateway

1,842 records in the corpus: 1,842 agent executions. 6 artefact classes found; unclassified findings in 0 executions (counted per class).

Artefact class	Title	Handling	Records
agentdojo.art.calls_derived_from_messages	Model calls derived from the messages	NR	1,842
agentdojo.art.naive_timestamp	Run start is a naive local timestamp	NR	1,842
agentdojo.art.silent_rerun	Only the last of up to three passes is logged	CR	1,842
agentdojo.art.benign_security_constant	Benign security is the runner's constant True	CR	298
agentdojo.art.payload_not_reaching_agent	The injected payload never appears in what the agent read	FO	178
agentdojo.art.max_iters_pending	Requested calls never executed (max_iters = 15)	CR	1

hilarytorn-trajectory-poisoning

In-context trajectory poisoning: AgentDojo 0.1.35 slack logs of gpt-4o

990 records in the corpus: 990 agent executions. 5 artefact classes found; unclassified findings in 0 executions (counted per class).

Artefact class	Title	Handling	Records
agentdojo.art.calls_derived_from_messages	Model calls derived from the messages	NR	990
agentdojo.art.naive_timestamp	Run start is a naive local timestamp	NR	990
agentdojo.art.silent_rerun	Only the last of up to three passes is logged	CR	990
agentdojo.art.benign_security_constant	Benign security is the runner's constant True	CR	45
agentdojo.art.payload_not_reaching_agent	The injected payload never appears in what the agent read	FO	3

interbolt-agentdojo

Interbolt on AgentDojo: AgentDojo 0.1.35 logs of a provenance tool-call gate

2,016 records in the corpus: 2,016 agent executions. 6 artefact classes found; unclassified findings in 0 executions (counted per class).

Artefact class	Title	Handling	Records
agentdojo.art.calls_derived_from_messages	Model calls derived from the messages	NR	2,016
agentdojo.art.naive_timestamp	Run start is a naive local timestamp	NR	2,016
agentdojo.art.silent_rerun	Only the last of up to three passes is logged	CR	2,016
agentdojo.art.benign_security_constant	Benign security is the runner's constant True	CR	312
agentdojo.art.payload_not_reaching_agent	The injected payload never appears in what the agent read	FO	120
agentdojo.art.max_iters_pending	Requested calls never executed (max_iters = 15)	CR	1

ipi-defenses-agentdojo

IPI defences replication package: AgentDojo 0.1.35 banking logs of gpt-5.4 and claude-sonnet-4-6 under AgentDojo's built-in defences

3,211 records in the corpus: 3,211 agent executions. 6 artefact classes found; unclassified findings in 0 executions (counted per class).

Artefact class	Title	Handling	Records
agentdojo.art.calls_derived_from_messages	Model calls derived from the messages	NR	3,211
agentdojo.art.naive_timestamp	Run start is a naive local timestamp	NR	3,211
agentdojo.art.silent_rerun	Only the last of up to three passes is logged	CR	3,211
agentdojo.art.payload_not_reaching_agent	The injected payload never appears in what the agent read	FO	940
agentdojo.art.benign_security_constant	Benign security is the runner's constant True	CR	475
agentdojo.art.max_iters_pending	Requested calls never executed (max_iters = 15)	CR	2

kavach-agentdojo

Kavach: AgentDojo 0.1.35 logs of a runtime tool-call defence on local Ollama models

2,619 records in the corpus: 2,619 agent executions. 9 artefact classes found; unclassified findings in 7 executions (counted per class).

Artefact class	Title	Handling	Records
agentdojo.art.naive_timestamp	Run start is a naive local timestamp	NR	2,619
agentdojo.art.silent_rerun	Only the last of up to three passes is logged	CR	2,619
agentdojo.art.calls_derived_from_messages	Model calls derived from the messages	NR	2,618
agentdojo.art.payload_not_reaching_agent	The injected payload never appears in what the agent read	FO	2,271
agentdojo.art.provider_ids	Provider call-id anomalies	CR	408
agentdojo.art.benign_security_constant	Benign security is the runner's constant True	CR	107
agentdojo.art.model_not_recorded	No log records the agent's model	NR	103
agentdojo.art.max_iters_pending	Requested calls never executed (max_iters = 15)	CR	6
agentdojo.art.incomplete_run	Logs without outcomes or duration	NR	5

kexin-xu-01-agentharm

Kexin-xu-01/agentharm: AgentHarm Inspect .eval logs

2,796 records in the corpus: 2,796 agent executions. 7 artefact classes found; unclassified findings in 0 executions (counted per class).

Artefact class	Title	Handling	Records
inspect.art.value_redacted	Workstation account paths redacted (Inspect)	CR	792
inspect.art.sample_limit	Samples stopped at a message limit	CR	298
inspect.art.event_kept_in_ext	Events with no AER kind kept in ext	CR	83
inspect.art.abnormal_finish_reported	Truncated, filtered, context-length and unknown stop reasons	FO	72
inspect.art.tool_result_lost_at_limit	Tool executions whose result message never entered the log	NR	51
inspect.art.times_not_recorded	Times the log does not record, or records contradictorily	NR	25
inspect.art.text_tool_call	Tool call written as text	FO	14

kongminos-agentdojo

jspace-agentdojo-950: AgentDojo 0.1.35 tool_knowledge logs of DeepSeek V4-Flash

950 records in the corpus: 950 agent executions. 9 artefact classes found; unclassified findings in 0 executions (counted per class).

Artefact class	Title	Handling	Records
agentdojo.art.calls_derived_from_messages	Model calls derived from the messages	NR	950
agentdojo.art.naive_timestamp	Run start is a naive local timestamp	NR	950
agentdojo.art.silent_rerun	Only the last of up to three passes is logged	CR	950
agentdojo.art.provider_ids	Provider call-id anomalies	CR	907
agentdojo.art.local_parse_drop	Local-model raw completions with more tool tags than parsed calls	FO	154
agentdojo.art.benign_security_constant	Benign security is the runner's constant True	CR	106
agentdojo.art.payload_not_reaching_agent	The injected payload never appears in what the agent read	FO	50
agentdojo.art.max_iters_pending	Requested calls never executed (max_iters = 15)	CR	25
agentdojo.art.text_tool_call	Text-written, unexecuted tool calls (Llama-3 prompting)	FO	17

linyxus-agentdojo

Linyxus/agentdojo lacuna-exp: AgentDojo 0.1.35 logs of the Tacit defence on OpenRouter models

9,068 records in the corpus: 9,065 agent executions and 3 outcome-only records. 11 artefact classes found; unclassified findings in 0 executions (counted per class).

Artefact class	Title	Handling	Records
agentdojo.art.naive_timestamp	Run start is a naive local timestamp	NR	9,068
agentdojo.art.silent_rerun	Only the last of up to three passes is logged	CR	9,065
agentdojo.art.calls_derived_from_messages	Model calls derived from the messages	NR	9,061
agentdojo.art.fork_top_level_keys	Fork loggers add top-level keys	CR	9,055
agentdojo.art.system_prompt_unrecognised	The system prompt is none of the declared variants	FO	8,759
agentdojo.art.payload_not_reaching_agent	The injected payload never appears in what the agent read	FO	8,121
agentdojo.art.pipeline_name_differs	pipeline_name differs from the run directory	CR	685
agentdojo.art.benign_security_constant	Benign security is the runner's constant True	CR	409
agentdojo.art.max_iters_pending	Requested calls never executed (max_iters = 15)	CR	42
agentdojo.art.incomplete_run	Logs without outcomes or duration	NR	15
agentdojo.art.empty_log	Empty message list with logged outcomes	CR	3

llm-lock-agentdojo

LLMLock: AgentDojo 0.1.35 logs of a local agent under nine prompt-injection detector defences

52,387 records in the corpus: 52,387 agent executions. 11 artefact classes found; unclassified findings in 0 executions (counted per class).

Artefact class	Title	Handling	Records
agentdojo.art.calls_derived_from_messages	Model calls derived from the messages	NR	52,387
agentdojo.art.model_not_recorded	No log records the agent's model	NR	52,387
agentdojo.art.naive_timestamp	Run start is a naive local timestamp	NR	52,387
agentdojo.art.silent_rerun	Only the last of up to three passes is logged	CR	52,387
agentdojo.art.fork_top_level_keys	Fork loggers add top-level keys	CR	35,321
agentdojo.art.payload_not_reaching_agent	The injected payload never appears in what the agent read	FO	33,243
agentdojo.art.max_iters_pending	Requested calls never executed (max_iters = 15)	CR	1,672
agentdojo.art.detector_abort_output_unrecorded	Detector aborts whose flagged output is not logged	NR	1,341
agentdojo.art.benign_security_constant	Benign security is the runner's constant True	CR	1,182
agentdojo.art.dos_polarity	DoS security is not utility	CR	871
agentdojo.art.text_tool_call	Text-written, unexecuted tool calls (Llama-3 prompting)	FO	553

mandate-agentdojo-eval

Mandate-AgentDojo-Eval banking logs of an action-gating defence

396 records in the corpus: 396 agent executions. 5 artefact classes found; unclassified findings in 0 executions (counted per class).

Artefact class	Title	Handling	Records
agentdojo.art.calls_derived_from_messages	Model calls derived from the messages	NR	396
agentdojo.art.naive_timestamp	Run start is a naive local timestamp	NR	396
agentdojo.art.silent_rerun	Only the last of up to three passes is logged	CR	396
agentdojo.art.benign_security_constant	Benign security is the runner's constant True	CR	27
agentdojo.art.payload_not_reaching_agent	The injected payload never appears in what the agent read	FO	23

mcphunt

MCPHunt agent traces: cross-boundary data propagation in multi-server MCP agents

2,190 records in the corpus: 2,190 agent executions. 5 artefact classes found; unclassified findings in 0 executions (counted per class).

Artefact class	Title	Handling	Records
mcphunt.art.event_times_ambiguous	Event and collection times kept raw	NR	2,190
mcphunt.art.result_truncated_in_message	Tool result truncated for the model	CR	170
mcphunt.art.run_not_ok	Run ended at a cap or on an error	CR	82
mcphunt.art.result_differs	Tool message differs from the event result	FO	10
mcphunt.art.args_unparsed	Call arguments the pipeline could not parse	FO	7

melon-agentdojo

MELON variants on AgentDojo: AgentDojo 0.1.35 logs of masked re-execution defences

1,911 records in the corpus: 1,911 agent executions. 6 artefact classes found; unclassified findings in 0 executions (counted per class).

Artefact class	Title	Handling	Records
agentdojo.art.naive_timestamp	Run start is a naive local timestamp	NR	1,911
agentdojo.art.silent_rerun	Only the last of up to three passes is logged	CR	1,911
agentdojo.art.calls_derived_from_messages	Model calls derived from the messages	NR	1,909
agentdojo.art.payload_not_reaching_agent	The injected payload never appears in what the agent read	FO	975
agentdojo.art.benign_security_constant	Benign security is the runner's constant True	CR	87
agentdojo.art.incomplete_run	Logs without outcomes or duration	NR	6

memo-ozdincer-agentdojo

memo-ozdincer/agentdojo results containers: circuit-breaker adapters and AgentDojo defences on Llama-3.3-70B and Qwen2.5-7B

13,064 records in the corpus: 12,026 agent executions and 1,038 outcome-only records. 14 artefact classes found; unclassified findings in 0 executions (counted per class).

Artefact class	Title	Handling	Records
rescont.art.serialised_without_ids_or_times	ResCont rows carry no call ids and no times	NR	13,064
rescont.art.injection_map_not_recorded	ResCont rows record no injection map	NR	12,563
agentdojo.art.calls_derived_from_messages	Model calls derived from the messages	NR	12,026
rescont.art.last_pass_kept	Only the last of up to three passes is kept (ResCont)	CR	12,026
rescont.art.request_not_recorded	ResCont model requests are not logged	NR	12,026
agentdojo.art.payload_not_reaching_agent	The injected payload never appears in what the agent read	FO	11,533
rescont.art.model_identity_from_documents	Model identity from the source's documents: conflicts and gaps	FO	7,749
rescont.art.value_redacted	Workstation account paths redacted (ResCont)	CR	7,013
rescont.art.exception_row_defaults	Exception rows: no messages, outcomes imposed by the script	CR	1,038
rescont.art.defence_unrecorded	Containers without a defense field	NR	636
rescont.art.melon_calls_not_recorded	MELON's own model calls are not logged	NR	583
rescont.art.benign_security_constant	ResCont benign security is a constant True	CR	493
agentdojo.art.text_tool_call	Text-written, unexecuted tool calls (Llama-3 prompting)	FO	250
agentdojo.art.max_iters_pending	Requested calls never executed (max_iters = 15)	CR	143

menelaus29-ipi-multidomain

IPI multidomain agent study: AgentDojo 0.1.35 logs of Gemma 4 and Gemini Flash with a 197-payload corpus

858 records in the corpus: 857 agent executions and 1 outcome-only records. 9 artefact classes found; unclassified findings in 2 executions (counted per class).

Artefact class	Title	Handling	Records
agentdojo.art.naive_timestamp	Run start is a naive local timestamp	NR	858
agentdojo.art.calls_derived_from_messages	Model calls derived from the messages	NR	857
agentdojo.art.silent_rerun	Only the last of up to three passes is logged	CR	857
agentdojo.art.system_prompt_unrecognised	The system prompt is none of the declared variants	FO	358
agentdojo.art.payload_not_reaching_agent	The injected payload never appears in what the agent read	FO	131
agentdojo.art.benign_security_constant	Benign security is the runner's constant True	CR	70
agentdojo.art.empty_log	Empty message list with logged outcomes	CR	1
agentdojo.art.incomplete_run	Logs without outcomes or duration	NR	1
agentdojo.art.model_not_recorded	No log records the agent's model	NR	1

mohameduk-agentdojo

UBAG gateway on AgentDojo: AgentDojo fork logs of an authorization-gateway defence

3,628 records in the corpus: 3,628 agent executions. 8 artefact classes found; unclassified findings in 0 executions (counted per class).

Artefact class	Title	Handling	Records
agentdojo.art.calls_derived_from_messages	Model calls derived from the messages	NR	3,628
agentdojo.art.naive_timestamp	Run start is a naive local timestamp	NR	3,628
agentdojo.art.silent_rerun	Only the last of up to three passes is logged	CR	3,628
agentdojo.art.provider_ids	Provider call-id anomalies	CR	1,756
agentdojo.art.payload_not_reaching_agent	The injected payload never appears in what the agent read	FO	667
agentdojo.art.benign_security_constant	Benign security is the runner's constant True	CR	485
agentdojo.art.max_iters_pending	Requested calls never executed (max_iters = 15)	CR	16
agentdojo.art.positional_link_conflict	Positional links conflict (mohameduk)	FO	12

openagentsafety

OpenAgentSafety: OpenHands trajectories of five models on 352 safety tasks

1,558 records in the corpus: 1,558 agent executions. 9 artefact classes found; unclassified findings in 5 executions (counted per class).

Artefact class	Title	Handling	Records
openhands.art.filtered_events	Events absent from the saved trajectory	NR	1,558
openhands.art.naive_event_times	Event times are naive local times; observations and judgements carry none	NR	1,558
openhands.art.task_text_not_seen	Task text not visible in the log	FO	1,282
openhands.art.content_not_inlined	Screenshots and strings over 1 MiB not inlined	FO	322
openhands.art.not_executed_notice	Action pending when the run stopped	CR	168
openhands.art.summary_entry_missing	Run without an LLM-judge entry	NR	128
openhands.art.eval_missing	Run without an evaluation file	NR	86
openhands.art.third_party_account_paths	Third-party developer account paths in fetched content	FO	9
openhands.art.harness_error	Uncaused controller error	FO	2

redcode-exec-openhands

Which Orders Count?: OpenHands 1.5.0 runs on RedCode-Exec requests C1-C3

5,459 records in the corpus: 5,459 agent executions. 5 artefact classes found; unclassified findings in 0 executions (counted per class).

Artefact class	Title	Handling	Records
openhands.art.filtered_events	Events absent from the saved trajectory	NR	5,459
openhands.art.naive_event_times	Event times are naive local times; observations and judgements carry none	NR	5,459
openhands.art.request_is_the_attack	No injection payload (RedCode)	NR	5,459
openhands.art.join_after_rewrite	RedCode request rewritten by the harness	DR	144
openhands.art.harness_error	Uncaused controller error	FO	3

redcode-exec-qwencode

RedCode-Exec agent runs of 'Which Orders Count?', Qwen Code part: qwen3-coder-30b-a3b-instruct, S1-S3

3,299 records in the corpus: 3,299 agent executions. 7 artefact classes found; unclassified findings in 6 executions (counted per class).

Artefact class	Title	Handling	Records
qwencode.art.derived_model_calls	Model calls derived from blocks	NR	3,299
qwencode.art.no_time	No time anywhere	NR	3,299
qwencode.art.prompt_not_logged	The request is not in the run	NR	3,299
qwencode.art.request_is_the_attack	No injection payload	NR	3,299
qwencode.art.usage_not_all_logged	Usage above the logged messages	FO	855
qwencode.art.truncated_capture	Output cut at 64 KiB	CR	4
qwencode.art.subagent	Sub-agent messages	FO	2

rope

ROPE defence-evaluation TraceLogger run logs, including the AutoDojo-attack slice

10,774 records in the corpus: 10,772 agent executions and 2 outcome-only records. 11 artefact classes found; unclassified findings in 0 executions (counted per class).

Artefact class	Title	Handling	Records
agentdojo.art.naive_timestamp	Run start is a naive local timestamp	NR	10,774
agentdojo.art.calls_derived_from_messages	Model calls derived from the messages	NR	10,772
agentdojo.art.silent_rerun	Only the last of up to three passes is logged	CR	10,772
agentdojo.art.provider_ids	Provider call-id anomalies	CR	1,496
rope.art.pipeline_tag_not_identity	ROPE configuration tag names another model	CR	949
agentdojo.art.payload_not_reaching_agent	The injected payload never appears in what the agent read	FO	893
agentdojo.art.benign_security_constant	Benign security is the runner's constant True	CR	747
agentdojo.art.max_iters_pending	Requested calls never executed (max_iters = 15)	CR	675
agentdojo.art.text_tool_call	Text-written, unexecuted tool calls (Llama-3 prompting)	FO	11
agentdojo.art.empty_log	Empty message list with logged outcomes	CR	2
agentdojo.art.incomplete_run	Logs without outcomes or duration	NR	2

seagent-agentdojo

SEAgent artefact: AgentDojo 0.1.34 logs of deepseek-v3 under SEAgent, PVAgent, AgentSpec and no defence

5,331 records in the corpus: 5,331 agent executions. 9 artefact classes found; unclassified findings in 0 executions (counted per class).

Artefact class	Title	Handling	Records
agentdojo.art.calls_derived_from_messages	Model calls derived from the messages	NR	5,331
agentdojo.art.naive_timestamp	Run start is a naive local timestamp	NR	5,331
agentdojo.art.silent_rerun	Only the last of up to three passes is logged	CR	5,331
agentdojo.art.unattributed_user_message	Later user messages that no declared quirk accounts for	FO	863
agentdojo.art.benign_security_constant	Benign security is the runner's constant True	CR	654
agentdojo.art.payload_not_reaching_agent	The injected payload never appears in what the agent read	FO	637
agentdojo.art.orphan_tool_results	Tool results that answer no listed call	FO	541
agentdojo.art.max_iters_pending	Requested calls never executed (max_iters = 15)	CR	424
agentdojo.art.seagent_guard_batch_abort	SEAgent guard blocks: a renamed call answered empty, the rest of the batch dropped	CR	107

sentry-agentdojo

SENTRY: AgentDojo 0.1.35 trajectories of OpenRouter-served agents for a post-hoc monitor

674 records in the corpus: 674 agent executions. 8 artefact classes found; unclassified findings in 0 executions (counted per class).

Artefact class	Title	Handling	Records
agentdojo.art.naive_timestamp	Run start is a naive local timestamp	NR	674
agentdojo.art.silent_rerun	Only the last of up to three passes is logged	CR	674
agentdojo.art.calls_derived_from_messages	Model calls derived from the messages	NR	672
agentdojo.art.benign_security_constant	Benign security is the runner's constant True	CR	189
agentdojo.art.model_not_recorded	No log records the agent's model	NR	72
agentdojo.art.payload_not_reaching_agent	The injected payload never appears in what the agent read	FO	13
agentdojo.art.max_iters_pending	Requested calls never executed (max_iters = 15)	CR	5
agentdojo.art.incomplete_run	Logs without outcomes or duration	NR	4

shreeyavarma-llm-safety

llm_safety: AgentDojo 0.1.34 workspace logs of gpt-4o and local Qwen agents

672 records in the corpus: 670 agent executions and 2 outcome-only records. 8 artefact classes found; unclassified findings in 0 executions (counted per class).

Artefact class	Title	Handling	Records
agentdojo.art.naive_timestamp	Run start is a naive local timestamp	NR	672
agentdojo.art.silent_rerun	Only the last of up to three passes is logged	CR	670
agentdojo.art.calls_derived_from_messages	Model calls derived from the messages	NR	668
agentdojo.art.payload_not_reaching_agent	The injected payload never appears in what the agent read	FO	123
agentdojo.art.benign_security_constant	Benign security is the runner's constant True	CR	81
agentdojo.art.model_not_recorded	No log records the agent's model	NR	58
agentdojo.art.incomplete_run	Logs without outcomes or duration	NR	4
agentdojo.art.empty_log	Empty message list with logged outcomes	CR	2

tacit-agentdojo

TACIT AgentDojo trajectories: AgentDojo 0.1.35 logs of two local models

2,070 records in the corpus: 2,070 agent executions. 10 artefact classes found; unclassified findings in 0 executions (counted per class).

Artefact class	Title	Handling	Records
agentdojo.art.calls_derived_from_messages	Model calls derived from the messages	NR	2,070
agentdojo.art.naive_timestamp	Run start is a naive local timestamp	NR	2,070
agentdojo.art.silent_rerun	Only the last of up to three passes is logged	CR	2,070
agentdojo.art.provider_ids	Provider call-id anomalies	CR	694
agentdojo.art.payload_not_reaching_agent	The injected payload never appears in what the agent read	FO	586
agentdojo.art.local_parse_drop	Local-model raw completions with more tool tags than parsed calls	FO	443
agentdojo.art.text_tool_call	Text-written, unexecuted tool calls (Llama-3 prompting)	FO	345
agentdojo.art.benign_security_constant	Benign security is the runner's constant True	CR	194
agentdojo.art.max_iters_pending	Requested calls never executed (max_iters = 15)	CR	95
agentdojo.art.incomplete_run	Logs without outcomes or duration	NR	1

what-surrounds

What surrounds an injection decides whether it works: 1,334 Bedrock Converse tool-use trials of seven models

1,334 records in the corpus: 1,334 agent executions. 7 artefact classes found; unclassified findings in 0 executions (counted per class).

Artefact class	Title	Handling	Records
wirelog.art.event_times_not_recorded	Only the save time is logged	NR	1,334
wirelog.art.outcome_at_save	Outcome labels written by the harness	CR	1,334
wirelog.art.metadata_channel_payload	Payload delivered in tool metadata	CR	935
wirelog.art.payload_not_delivered	Payload never delivered	FO	573
wirelog.art.first_batch_payload_in_code	First-batch payloads exist only in the harness code	FO	363
wirelog.art.meta_rewritten	Run metadata rewritten after the run	FO	358
wirelog.art.final_texts_not_logged	No split of the final text	NR	154

whistlebench

WhistleBench: Inspect .eval logs of tool-using agents in corporate-misconduct scenarios

9,200 records in the corpus: 9,200 agent executions. 8 artefact classes found; unclassified findings in 1,528 executions (counted per class).

Artefact class	Title	Handling	Records
inspect.art.times_not_recorded	Times the log does not record, or records contradictorily	NR	9,200
inspect.art.submit_result_removed	react removes the submit tool's result messages	CR	9,194
inspect.art.repeated_call_ids	Repeated call ids within a sample (whistlebench)	FO	3,452
inspect.art.message_copies_share_calls	Message copies share their calls	CR	3,442
inspect.art.value_redacted	Workstation account paths redacted (Inspect)	CR	1,660
inspect.art.abnormal_finish_reported	Truncated, filtered, context-length and unknown stop reasons	FO	123
inspect.art.event_kept_in_ext	Events with no AER kind kept in ext	CR	113
inspect.art.sample_limit	Samples stopped at a message limit	CR	12

yockcheng-prompt-injection-harness

Prompt injection harness: AgentDojo 0.1.35 workspace logs of four Claude models

280 records in the corpus: 280 agent executions. 6 artefact classes found; unclassified findings in 0 executions (counted per class).

Artefact class	Title	Handling	Records
agentdojo.art.naive_timestamp	Run start is a naive local timestamp	NR	280
agentdojo.art.silent_rerun	Only the last of up to three passes is logged	CR	280
agentdojo.art.calls_derived_from_messages	Model calls derived from the messages	NR	277
agentdojo.art.benign_security_constant	Benign security is the runner's constant True	CR	22
agentdojo.art.payload_not_reaching_agent	The injected payload never appears in what the agent read	FO	4
agentdojo.art.incomplete_run	Logs without outcomes or duration	NR	3