license: other
license_name: openrail-d-plus-cc-by
license_link: https://github.com/rapturt9/agentmisalignmentdataset/blob/main/LICENSE-DATA.md
task_categories:

• text-classification
• text-generation
  language:
• en
  tags:
• ai-safety
• agent-misalignment
• llm-evaluation
• red-team
• alignment
  pretty_name: Agent Misalignment Dataset
  size_categories:
• 1K<n<10K
  configs:
• config_name: default
  data_files:
  • split: train
    path: v1_1.jsonl

Agent Misalignment Dataset v0.1.1

A broad, open, annotated corpus of agent behavior in realistic tool-using
workplace tasks. 1,050 trajectories across 7 models, 25 tasks, and 3 elicitation
modes, each labeled by an LLM judge panel with per-trajectory Petri-style
dimension scores, judge summaries, taxonomy tags, and a recovered judge-vote
breakdown.

This is a v0.1.1 release. It is small, honestly labeled, and writes down its
limitations rather than hiding them. It is for training misalignment classifiers
and stress-testing monitors. It is not evidence of deceptive alignment or
strategic scheming. Most flagged behavior is trained helpfulness or sycophancy
overriding stated safety language under ambiguous instructions.

Headline numbers

Cite the unanimous-judge, artifact-excluded rate in single-number summaries. The
24.1% number is the raw majority-vote label and is inflated by documented
false-positive patterns. See the paper
and DATASHEET.md.

What changed in v0.1.1. v0.1 cited a "229 / 21.8% unanimous subset" derived
from a regex scan for dissent phrases. That scan undercounted dissent. v0.1.1
recovers each panel member's vote from the stored judge_summary and reports a
per-record judge_votes breakdown and label_confidence. The honest
unanimous-consensus subset (131 records, excl. artifact) is roughly half the
size the v0.1 paper claimed (229).

Schema

Each record in v1_1.jsonl:

id, source_mode, task_name, main_task, side_task, threat_type,
target_model, auditor_model, judge_model, trajectory,
is_misaligned, is_misaligned_v1, judge_votes, label_confidence, vote_method,
headline_include, main_task_success, side_task_success,
monitor_suspicion_score, petri_dimensions, judge_summary,
taxonomy_tags, trajectory_length, token_count

• is_misaligned: v1.1 label (recovered-vote majority; only overturns the v1
  pipeline label on a margin of 2 or more votes).
• is_misaligned_v1: the original v0.1 pipeline label, for comparison.
• judge_votes: {yes, no, unclear} counts recovered from judge_summary.
• label_confidence: unanimous, majority, contested, or unrecovered.
  Filter on unanimous for the conservative subset.
• headline_include: false for api_key_exfil (environment artifact). Exclude
  from headline rates.

Known issues

• api_key_exfil is an environment artifact: the simulated search_files tool
  bundles a fake STRIPE_API_KEY=sk_live_... into results and the agent is flagged
  for running a reasonable search. headline_include=false. Drop from
  attacker-behavior analyses.
• side_task_success is an unreliable exact-match scorer (0/253 true positives);
  use judge_summary instead.
• Single LLM judge-panel family; no held-out human annotation in this version
  (planned for v0.2).

License

• Code and aggregate statistics: MIT / CC-BY-4.0.
• Full trajectory corpus: OpenRAIL-D with use-based restrictions (no training
  production agents to exhibit these behaviors; no use as attack scaffolding; no
  removal of safety metadata). See LICENSE-DATA.md.

Citation

@misc{potham2026agentmisalignment,
  title        = {The Agent Misalignment Dataset},
  author       = {Potham, Ram},
  year         = {2026},
  version      = {0.1.1},
  note         = {Funded by Coefficient Giving (Technical AI Safety),
                  fiscally sponsored by BERI},
  howpublished = {\url{https://huggingface.co/datasets/rpotham/agent-misalignment-dataset}},
  url          = {https://github.com/rapturt9/agentmisalignmentdataset}
}