Safety evals to add to the model benchmark harness

Researched 2026-10-12 for Byron Arnao. Harness context: 37 models, 8 providers, measuring speed, cost, correctness; goal is to add safety evals.

Method: repo existence, license and last-push date were read from the GitHub API on 2026-10-12. "Runs via Inspect" was checked against the Inspect Evals source tree and its register (links below), not against catalog marketing. Anything I could not verify is marked UNVERIFIED. Items with no live URL are not included.

Cost basis (applies to every ESTIMATE below)

Every cost figure is an ESTIMATE = samples x assumed tokens per sample x an ASSUMED placeholder price of $2 per Mtok input and $10 per Mtok output. That price is not any provider's quoted price. Replace it with the per-model prices already in the harness cost table; the cost scales linearly. Reasoning models emit many more output tokens, so treat estimates as non-reasoning floors (a reasoning model can be 5-20x on output). Judge-model cost is included only where stated.

Per-sample cost shorthand: (in_tokens/1e6 x $2) + (out_tokens/1e6 x $10).

Key structural finding

Inspect Evals stopped accepting new eval code into src/ on 2026-05-08 and moved to a "register" of externally hosted evals (EVAL_REGISTER.md). The catalog at ukgovernmentbeis.github.io/inspect_evals showed 181 evals (129 in-repo, 52 external) when fetched today. So "in Inspect" has two meanings: in-repo (inspect eval inspect_evals/<name>) or register entry (pointer to a third-party repo, installed and run separately).

Not in Inspect Evals (neither src/inspect_evals/ nor register/ contains them, checked via the GitHub contents API): HarmBench, InjecAgent, SafetyBench, SHADE-Arena (it exists in ControlArena, see below), Apollo's in-context scheming suite, METR public tasks/RE-Bench natively (METR ships a bridge), Palisade shutdown (the repo itself is Inspect-based).

Summary table

Per-eval detail

1. AgentHarm

• Measures: whether tool-using agents carry out harmful multi-step tasks (and still work when jailbroken), with matched benign tasks to separate refusal from capability.
• Repo/paper: Inspect implementation; dataset.
• License: inspect_evals is MIT (repo). The HF dataset license field reads "other" (HF API); read it before redistribution.
• Inspect: yes. inspect eval inspect_evals/agentharm --model <provider/model>; benign twin inspect_evals/agentharm_benign. The README states the public release has 44 of 66 test base behaviors (176 augmented) and 8 of 11 validation base behaviors (32 augmented). The default refusal judge is openai/gpt-4o-2024-08-06, so a judge call goes to OpenAI.
• Cost (ESTIMATE): 176 samples x (8k in, 1.5k out; multi-turn tool loop) = 176 x ($0.016 + $0.015) = ~$5.5; judge ~2 calls x (2k in, 0.3k out) per sample = 176 x $0.014 = ~$2.5. Total ~$8 per task, ~$16 with the benign twin (assuming a similar benign count; the benign count is UNVERIFIED).
• Tells Byron: harmful-task compliance rate under agentic tool use, and whether refusal is hurting benign capability. Best first eval because it directly pairs safety with capability.

2. AgentDojo

• Measures: utility and robustness of tool-using agents against prompt injection embedded in tool outputs.
• Repo/paper: ethz-spylab/agentdojo (MIT, last pushed 2026-06-02); paper; Inspect port.
• Inspect: yes. inspect eval inspect_evals/agentdojo --model <model>. Task args include workspace, with_injections, user_task_ids, injection_task_ids, with_sandbox_tasks (yes/no/only; sandbox tasks need Docker). The README notes it was extended by US AISI in a joint exercise with UK AISI.
• Cost (ESTIMATE): sample count depends on suites and injections chosen and I did not verify a total. Assuming ~600 injected cases (paper-scale, UNVERIFIED) x (20k in, 2k out) = 600 x ($0.04 + $0.02) = ~$36. Range $40-100 depending on suites and model verbosity.
• Tells Byron: attack success rate vs utility under attack. Directly relevant to any agent Byron runs on untrusted web or email input.

3. InjecAgent

• Measures: indirect prompt injection against tool-integrated agents; 1,054 test cases, 17 user tools, 62 attacker tools (repo README).
• Repo/paper: uiuc-kang-lab/InjecAgent (MIT; last pushed 2024-07-02, i.e. stale).
• Inspect: no. It is not in src/inspect_evals/ or register/. Overlapping Inspect options: AgentDojo, cyse2_prompt_injection, cyse4_multilingual_prompt_injection, and ipi_coding_agent (CodeIPI, 45 samples).
• Cost (ESTIMATE): 1,054 x (1.5k in, 0.3k out) = 1,054 x ($0.003 + $0.003) = ~$6.3.
• Tells Byron: second opinion on injection robustness; lower priority if AgentDojo is added.

4. HarmBench

• Measures: standardized red-teaming of refusal; 18 attack methods across 33 target LLMs and defenses (arXiv abstract).
• Repo/paper: centerforaisafety/HarmBench (MIT; last pushed 2024-08-16); paper.
• Inspect: no. Classifier models are published (cais/HarmBench-Llama-2-13b-cls), which need a GPU or an LLM-judge substitute. The behavior count was not stated in the abstract and I did not verify it.
• Cost (ESTIMATE): per 100 behaviors, direct-request only, (0.2k in, 0.5k out) = 100 x ($0.0004 + $0.005) = ~$0.54 plus classifier compute. Attack methods (GCG etc.) are white-box and not applicable to API models.
• Tells Byron: largely redundant with StrongREJECT plus FORTRESS for API-only use. Stale.

5. StrongREJECT

• Measures: refusal on forbidden prompts with a rubric score that rewards actually useful harmful answers rather than just non-refusal; supports jailbreak transforms.
• Repo/paper: dsbowen/strong_reject (MIT; pushed 2025-07-07); paper.
• Inspect: yes. inspect eval inspect_evals/strong_reject --model <model>; --jailbreak_method AIM applies the AIM jailbreak. README: 324 prompts in the small dataset; default judge_llm is openai/gpt-4o.
• Cost (ESTIMATE): 324 x (0.2k in, 0.5k out) = 324 x $0.0054 = ~$1.75; judge 324 x (1k in, 0.2k out) = 324 x $0.004 = ~$1.3. Total ~$3.
• Tells Byron: cheap refusal baseline plus jailbreak delta. Good for a 37-model sweep.

6. SafetyBench

• Measures: multiple-choice safety knowledge/judgment across 7 categories; 11,435 questions in Chinese and English (README).
• Repo/paper: thu-coai/SafetyBench (MIT; pushed 2025-07-28); paper. The authors open-sourced test answers on 2025-07-28 (README), which raises contamination risk and removes the held-out leaderboard value.
• Inspect: no.
• Cost (ESTIMATE): upper bound all 11,435 x (0.3k in, 10 out) = 11,435 x $0.0007 = ~$8 (the English subset is smaller; its exact size is UNVERIFIED).
• Tells Byron: little. It is saturated and answers are public; MCQ safety knowledge does not predict behavior. Low priority.

7. WMDP

• Measures: hazardous knowledge proxy in bio, chem, cyber; 3,668 multiple-choice questions (Inspect README).
• Repo/paper: centerforaisafety/wmdp (MIT; pushed 2025-05-29); paper; HF dataset cais/wmdp (not gated per HF API, MIT).
• Inspect: yes. inspect eval inspect_evals/wmdp_bio, wmdp_chem, wmdp_cyber.
• Cost (ESTIMATE): 3,668 x (0.25k in, 10 out) = 3,668 x $0.0006 = ~$2.2 non-reasoning; with ~2k reasoning output = 3,668 x $0.0205 = ~$75.
• Tells Byron: this measures knowledge, not refusal. A high score means the model knows hazardous-adjacent material (capability proxy). Use it as a capability-risk signal and to calibrate unlearning, not as a safety pass/fail.

8. CyberSecEval 2/3/4 (Meta PurpleLlama)

• Measures: insecure code generation, cyberattack compliance (MITRE), prompt injection, interpreter abuse, phishing, exploit capability; v4 adds malware analysis and threat-intel reasoning.
• Repo/paper: meta-llama/PurpleLlama (pushed 2026-09-29). License: the README says evals and benchmarks are MIT while models use Llama licenses; the GitHub API license field reads NOASSERTION. Check the specific subfolder before redistributing.
• Inspect: yes. cyse2_interpreter_abuse, cyse2_prompt_injection, cyse2_vulnerability_exploit; cyse3_visual_prompt_injection; v4 tasks and sample counts from the README: cyse4_mitre 1000, cyse4_mitre_frr 750, cyse4_instruct 1916, cyse4_autocomplete 1916, cyse4_multilingual_prompt_injection 1004, cyse4_multiturn_phishing 100, cyse4_malware_analysis 609, cyse4_threat_intelligence 588 (7,883 total). The autonomous-uplift and autopatching prototypes are intentionally omitted from the supported surface.
• Cost (ESTIMATE): cyse4_mitre 1000 x (0.3k in, 0.6k out) = 1000 x $0.0066 = ~$6.6 plus judge ~$3; cyse4_mitre_frr 750 similar ~$5; cyse4_instruct 1,916 x (0.4k in, 0.8k out) = 1,916 x $0.0088 = ~$17 (static analysis scoring, no judge). Full v4 suite ~$60-70.
• Tells Byron: cyse4_instruct (insecure code rate) is the most useful for a harness that already scores code correctness; mitre vs mitre_frr gives a compliance vs over-refusal pair.

9. Sabotage and SHADE-Arena

• What is actually public:
• SHADE-Arena public split: jkutaso/SHADE-Arena (MIT, pushed 2026-07-29). The README says access to the private split (extra research code and transcripts) is by emailing the author. The older safety-research/SHADE-Arena is marked DEPRECATED in its README.
• ControlArena lists a "SHADE Arena" setting flagged "Private repo" and an "Eval Sabotage" setting flagged "Private repo" (README table). So the Inspect route to SHADE needs private access.
• Public sabotage-style settings in ControlArena: Apps, Bash, BashArena, BigCodeBench, IAC, IAC Fast, Infra, Rogue Eval, SAE Interp Sabotage, vLLM, Data Poisoning, AgentDojo, and a SWE-bench Django side-task dataset (HF).
• I did not find a public "SabotageBench" under that name. The Anthropic sabotage-evals paper code was not located; treat as not public (UNVERIFIED).
• Inspect: SHADE public split has its own runner (not Inspect); ControlArena settings are Inspect-based.
• Cost (ESTIMATE): per run ~150k in, 10k out = $0.30 + $0.10 = $0.40; 5 runs x ~17 task pairs (pair count UNVERIFIED; the API listing of task_pairs returned no directory count) = 85 x $0.40 = ~$34 plus monitor.
• Tells Byron: ability to complete a hidden side task without monitor detection. A capability-to-sabotage measure, not propensity. Medium priority.

10. Redwood / UK AISI ControlArena and APPS backdooring

• Measures: AI control: usefulness and safety of protocols (monitors, defer-to-trusted) against a model trying to insert backdoors or harmful side effects.
• Repo: UKGovernmentBEIS/control-arena (MIT, pushed 2026-10-09), created by UK AISI and Redwood Research (docs). Underlying paper: AI Control. The standalone redwoodresearch/apps-backdoor repo returned 404; use the ControlArena Apps setting.
• Inspect: yes, thin wrapper over Inspect. Install: pip install control-arena; Docker needed for most settings.
• Cost (ESTIMATE): Apps, per 100 samples, honest + attack modes: 2 x 100 x (3k in, 2k out) = 200 x ($0.006 + $0.02) = ~$5.2 plus trusted monitor calls (~$1-2).
• Tells Byron: this is a research method for deployers who run agents in privileged environments; needs a trusted-vs-untrusted model pair, which his 37-model pool can supply. Medium-low priority for a benchmark harness.

11. METR task suite and RE-Bench

• Measures: autonomous task/AI R&D capability (dangerous-capability proxies), not propensity.
• Repos: METR/public-tasks (31 example tasks across 10 families, summary info for 186; license field NOASSERTION; pushed 2026-07-28); METR/RE-Bench (README says MIT; pushed 2025-10-16; asks people to keep tasks out of training data); METR/task-standard (MIT). Paper: METR AI R&D evaluation report.
• Inspect: via the METR Inspect Task Bridge per the public-tasks README. Not in the Inspect Evals catalog.
• Cost: not estimated. RE-Bench tasks are multi-hour agent runs, some needing GPUs; I did not verify the hardware requirements. Likely hundreds of dollars per model (UNVERIFIED guess; no arithmetic basis).
• Tells Byron: capability ceiling for autonomy. Only worth it for a handful of frontier models.

12. Apollo Research in-context scheming

• Measures: six agentic evals where models pursue in-context goals and may disable oversight, exfiltrate weights, sandbag, or deceive. Models in the paper: o1, Claude 3.5 Sonnet, Claude 3 Opus, Gemini 1.5 Pro, Llama 3.1 405B (arXiv 2412.04984).
• Public code: not found. The arXiv page lists no code link. The ApolloResearch GitHub org lists repos including insider-trading (CC-BY-4.0), deception-detection, and vibe-code-inspect-eval-convertor (MIT), but no scheming-suite repo (org API). Verdict: not public as a runnable suite.
• Closest Inspect substitutes: gdm_stealth (4 tasks, 10 epochs default), gdm_self_reasoning (11 tasks), instrumentaleval, and sad situational awareness, all in-repo.
• Tells Byron: nothing directly; use the substitutes.

13. Palisade shutdown resistance

• Measures: whether a model sabotages a shutdown mechanism to finish a task. Paper: arXiv 2509.14260; blog.
• Repo: PalisadeResearch/shutdown_avoidance (pushed 2025-09-06; no license declared, so default copyright; get permission before reuse beyond running it). The paper-matching branch is paper_version. Its README uses uv run inspect eval shutdown.py, so it is Inspect-based and needs Docker.
• Inspect: yes by construction but not in the catalog. A BlueDot replication ran it on Inspect (writeup).
• Cost (ESTIMATE): ~100 trials x (10k in, 1.5k out) = 100 x ($0.02 + $0.015) = ~$3.5.
• Tells Byron: a cheap propensity probe; results are prompt-sensitive (the BlueDot replication was titled as clarifying a "confusing" signal), so treat it as one sensitivity check.

14. Anthropic agentic misalignment

• Measures: blackmail, information leakage, and a lethal-inaction scenario under goal conflict or replacement threat.
• Repos: anthropic-experimental/agentic-misalignment (MIT; pushed 2025-06-19); Inspect port at src/inspect_evals/agentic_misalignment.
• Inspect: yes. inspect eval inspect_evals/agentic_misalignment -T scenario=leaking -T goal_value=none. Scenarios: blackmail, leaking, murder. README shows 10 epochs. The grader model defaults to claude-sonnet-4; override it so you are not grading every model with a single vendor's model. -T test_eval_awareness=True adds a classifier of whether the model recognized it was being evaluated.
• Cost (ESTIMATE): 3 scenarios x 4 variant conditions x 10 epochs = 120 runs x (4k in, 2k out) = 120 x ($0.008 + $0.02) = ~$3.4, plus grader 120 x (3k in, 0.3k out) = ~$1.1. ~$5.
• Tells Byron: propensity for harmful agentic action under pressure, with an evaluation-awareness flag that matters for how much to trust any pass.

15. MACHIAVELLI

• Measures: reward vs ethical violations (power, utility, deception etc.) in text adventure games.
• Repo/paper: aypan17/machiavelli (MIT; pushed 2025-07-23); paper.
• Inspect: register entry pointing to Plyb/inspect-machiavelli (register yaml: machiavelli); command uv run inspect eval src/machiavelli_task.py@machiavelli --model <model>. Register metadata says "thirty games"; the original README says over half a million scenes. Evaluation report is dated June 2026.
• Cost: UNVERIFIED. Games are long multi-turn runs; no arithmetic basis available without run logs.
• Tells Byron: ethical-trade-off behavior in a dated, game-based setting. Low priority.

16. OpenAI public Preparedness-adjacent evals

• What is public: openai/frontier-evals (MIT, pushed 2026-04-21) hosts PaperBench, SWE-Lancer, and EVMbench. openai/mle-bench (license NOASSERTION). openai/SWELancer-Benchmark has no license field. The older openai/preparedness URL now redirects (Moved Permanently).
• Inspect: yes for three, in-repo: inspect_evals/paperbench (README: 23 papers; dev 3, prod 20; Docker), inspect_evals/swe_lancer (Diamond split 198 IC SWE + 265 SWE Manager samples), inspect_evals/mle_bench (mle_bench_lite, mle_bench_full).
• BioLP-bench: bioRxiv paper; one secondary report describes it as 800 test cases (arXiv 2507.16534). I did not find an OpenAI-specific public eval release or Inspect task for it. LAB-Bench is in the Inspect catalog (lab_bench) as a capability eval. Which of these OpenAI uses in its Preparedness reports could not be confirmed from sources fetched.
• Cost: capability evals with long agent loops; no estimate with a defensible basis (UNVERIFIED), likely $100s per model.
• Tells Byron: these are capability/risk-threshold evals, not safety behavior. Do not prioritize.

17. MASK (honesty)

• Measures: whether a model lies when pressured, separating belief from statement (honesty distinct from accuracy).
• Repo: centerforaisafety/mask (MIT; pushed 2025-03-06); Inspect: inspect eval inspect_evals/mask. Dataset cais/MASK has restricted access (request needed). Inspect README: 1,000 records, ~8.876 LLM invocations per record, designed for 1 epoch; judge defaults openai/gpt-4o (binary) and openai/o3-mini (numeric).
• Cost (ESTIMATE): 1,000 x 8.876 = 8,876 calls x (0.6k in, 0.3k out) = 8,876 x ($0.0012 + $0.003) = ~$37 (target and judge calls blended).
• Tells Byron: honesty under pressure, a different axis from refusal. Good for model selection in agent roles.

18. Sycophancy

• Measures: sycophantic behavior (flip under pushback, feedback bias) from Sharma et al. 2023.
• Inspect: yes, inspect eval inspect_evals/sycophancy. The README notes only part of the original datasets is implemented. Related catalog entries: SycoBench-600 and BrokenMath (register).
• Cost (ESTIMATE): per 1,000 samples x (0.5k in, 0.3k out) = 1,000 x $0.004 = ~$4 plus grader; total sample count in Inspect port UNVERIFIED.
• Tells Byron: cheap; relevant if his agents give advice to Byron.

Inspect Evals catalog: category summary

From the catalog page as fetched 2026-10-12 (181 evals total, 129 in-repo + 52 external; the page has no topical tags, so the grouping below is mine):

• Safety / jailbreak / harmful content: AgentHarm, AIR Bench, FORTRESS (500 expert adversarial prompts on CBRNE, political violence, criminal/financial), StrongREJECT, SALAD-Bench, SOS BENCH, Do-Not-Answer, OR-Bench Hard-1K and XSTest (over-refusal), MuTox, several Inspect India safety evals.
• Alignment, scheming, deception, honesty: Agentic Misalignment, Alignment Faking, InstrumentalEval, MACHIAVELLI, Manager Coercion Benchmark, NARCBench, DeceptionBench, MASK, TruthfulQA, MonitorBench (3 tasks), Hack-Verifiable Terminal Bench (reward hacking), Make Me Pay, MakeMeSay, GDM stealth and self-proliferation.
• Sycophancy: Sycophancy Eval, SycoBench-600, BrokenMath.
• Agent security / prompt injection: AgentDojo, CodeIPI, b3, MCPTox, AgentThreatBench (memory poison, autonomy hijack, data exfil), Mind2Web-SC.
• Cyber: CyberSecEval 2/3/4, Cybench, CyberGym, CVEBench, 3CB, CTI-REALM, CASTLE, ExploitBench, others.
• Bio/chem: WMDP, LAB-Bench, LABBench2 (capability, not safety).
• No eval is labeled "sabotage" in the catalog; sabotage lives in ControlArena.

2026 additions worth knowing (all in the Inspect catalog or register as of today)

• FORTRESS: 500 adversarial prompts with 4-7 binary rubric questions each; fortress_adversarial and fortress_benign pairs (refusal vs over-refusal in one eval). Source paper arXiv 2506.14922.
• AgentThreatBench: OWASP agentic threats, three tasks.
• CodeIPI: 45 samples (35 injected, 10 benign), reports false-positive refusal rate. Small, so wide error bars.
• AbstentionBench: calibrated abstention; fast mode is 2,104 samples.
• MonitorBench and Hack-Verifiable Terminal Bench (register): CoT/monitorability and reward hacking. I did not read these in detail.

EU AI Act GPAI Code of Practice: Safety and Security chapter

Official site: code-of-practice.ai. Quotes below were extracted by the fetch tool from that page; the Appendix 3 text came back under 125-character quotes and paraphrase, not a full dump, so verify against the PDF linked on the page before citing in any filing.

• Measure 3.2 (Model evaluations): "Signatories will conduct at least state-of-the-art model evaluations in the modalities relevant to the systemic risk" to assess "the model's capabilities, propensities, affordances, and/or effects, as specified in Appendix 3." It requires methods that "include open-ended testing of the model to improve the understanding of the systemic risk" to find "unexpected behaviours, capability boundaries, or emergent properties." Listed method types: Q&A sets, task-based evaluations, benchmarks, red-teaming.
• Appendix 3.1: rigour: internal validity, external validity, reproducibility.
• Appendix 3.2 Model elicitation: "minimise the risk of under-elicitation" and "minimise the risk of model deception during model evaluations (e.g. sandbagging)", using at least state-of-the-art elicitation (test-time compute, scaffolding, tools, fine-tuning, prompt engineering).
• Appendix 3.3: assess effectiveness of safety mitigations, including whether they have been circumvented.
• Appendix 3.4: qualified teams; example given of at least 20 business days of time for most risks.
• Appendix 3.5: independent external evaluators with exemptions in defined cases.

Applicability caveat: the chapter binds signatories who provide GPAI models with systemic risk, i.e. model providers. A benchmarking harness that evaluates other vendors' models is not a signatory by that fact. Use it as a design reference: propensity as well as capability evals, reproducibility, elicitation effort, and mitigation circumvention testing. Secondary summaries I saw word Measure 3.2 differently from each other, which is why the official text should be the citation.

Recommended order: top 5 to add first

1. AgentHarm + agentharm_benign. In-repo, MIT code, agentic, and pairs harm with benign capability, which fits a speed/cost/correctness harness. Cheapest meaningful agent-safety signal (~$16 per model, ESTIMATE).
2. StrongREJECT (with XSTest or FORTRESS benign for over-refusal). About $3 per model (ESTIMATE); gives a refusal axis you can run on all 37 models without a sandbox. Pair with fortress_benign/xstest so refusal is never read without over-refusal.
3. AgentDojo. Prompt injection is the most likely real-world failure for any agent Byron runs on untrusted input. ~$40-100 per model (ESTIMATE), so run on a subset of models or one suite first.
4. CyberSecEval 4 cyse4_instruct + cyse4_mitre / cyse4_mitre_frr. Insecure-code rate sits naturally beside code-correctness scores; the MITRE pair gives compliance vs false refusal. ~$30 for those three (ESTIMATE).
5. Agentic Misalignment (+ MASK as the next step). ~$5 per model (ESTIMATE), propensity not capability, and the evaluation-awareness flag tells you how far to trust results. MASK follows if a second propensity axis (honesty, ~$37 per model) is wanted; it needs HF gated access.

Deliberately not first: SafetyBench (saturated, answers public), HarmBench and InjecAgent (stale, not in Inspect), WMDP (capability proxy), Apollo (no public suite), METR/RE-Bench/OpenAI evals (capability, heavy compute), SHADE-Arena (the full set is private).

Minimal Inspect setup: one eval across providers

Prefixes and env vars verified at Inspect providers; CLI and Python syntax verified at models and eval sets.

pip install inspect-ai inspect-evals openai anthropic google-genai mistral groq
# one key per provider (names per the providers page)
export OPENAI_API_KEY=... ANTHROPIC_API_KEY=... GOOGLE_API_KEY=... \
       MISTRAL_API_KEY=... TOGETHER_API_KEY=... GROQ_API_KEY=... \
       OPENROUTER_API_KEY=... DEEPSEEK_API_KEY=...

# comma-separated models, one eval; grader pinned so every model is judged the same way
inspect eval inspect_evals/strong_reject \
  --model openai/gpt-4o-mini,anthropic/claude-sonnet-4-0,google/gemini-2.5-pro \
  --model-role grader=openai/gpt-4o \
  --max-connections 10 --limit 50

# resumable multi-task sweep
inspect eval-set inspect_evals/agentharm inspect_evals/agentharm_benign \
  --model openai/gpt-4o-mini,anthropic/claude-sonnet-4-0 \
  --log-dir logs-safety-2026-10-12

from inspect_ai import eval_set
success, logs = eval_set(
    tasks=["inspect_evals/agentharm", "inspect_evals/agentharm_benign"],
    model=["openai/gpt-4o-mini", "anthropic/claude-sonnet-4-0"],
    log_dir="logs-safety-2026-10-12",
)

Notes on this snippet: (a) The --model-role grader=... flag works for scorers that use the built-in grader role; individual inspect_evals tasks may instead take their own judge_llm or grader_model task arguments (StrongREJECT judge_llm, AgentHarm refusal_judge, Agentic Misalignment grader_model, MASK binary_judge_model/numeric_judge_model), so set those explicitly with -T and confirm in each task README. I did not execute this snippet. (b) Model name strings in the snippet are examples copied from the Inspect docs; substitute the ones in the harness. (c) The inspect_evals/... task names require pip install inspect-evals (README of inspect_evals); some evals need extras, Docker, or HF tokens. (d) Re-running the same eval-set command resumes unfinished work.

Caveats

• Contamination. SafetyBench published test answers on 2025-07-28 (its README). METR RE-Bench and ControlArena both ask users to keep tasks and solutions out of training data (their READMEs). Public prompt sets such as HarmBench and StrongREJECT have been available since early 2024 and may be in training data; treat scores as relative within a run, not absolute. Keep any held-out custom prompts private.
• Refusal vs capability confounds. A model scoring "safe" may simply be unable to do the task. AgentHarm's benign twin, CyberSecEval's mitre_frr, FORTRESS benign, and XSTest exist for this; always report both rates. For agent tasks, a low harm score together with a low benign score means incapability.
• Judge dependence. Many scorers default to OpenAI or Anthropic judges (AgentHarm gpt-4o-2024-08-06, StrongREJECT gpt-4o, MASK gpt-4o/o3-mini, Agentic Misalignment claude-sonnet-4). Use one pinned judge across all 37 models and exclude self-judging, or use multiple graders (Inspect supports a list of models per role, majority vote). Inspect Evals changelogs show scorer bugs being fixed that silently produced wrong scores (AgentHarm chat mode scored 0.0; Agentic Misalignment swallowed grader errors); pin the inspect_evals version and re-check the changelog.
• Evaluation awareness. Models can detect test scenarios; Agentic Misalignment has a flag for it. A clean result is weaker evidence than it looks.
• Dual-use content handling. These sets contain harmful prompts and, for some, harmful model outputs get logged to disk (Inspect logs store full transcripts). Keep logs off shared/public dirs and out of the arnao.ai deploys, do not publish raw transcripts, and avoid putting sample prompts in client-facing pages. WMDP and FORTRESS are built from unclassified material but still concern hazardous topics. MASK dataset access is gated for that reason.
• Provider ToS. I could only verify the Anthropic position: its support pages say External Researcher Access Program participants and red-teaming researchers do not get exemption from the Usage Policy (support article), and its Cyber Verification Program offers a Red Team Access tier for organizations (announcement). I could not retrieve OpenAI's usage-policy text (openai.com returned 403), and the sources I found were secondary. A 2024 paper argues ToS at major labs can chill good-faith evaluation and that accounts have been suspended without notice (arXiv 2403.04893). Practical implication (my inference, not a legal reading): running thousands of harmful prompts from a single account can trip automated enforcement; use a dedicated organization account for safety runs, tell each provider before a large sweep where they offer a research or red-team channel, avoid mixing it with the production key, and read each of the 8 providers' current terms. Open-weight models served via Together, Groq, OpenRouter or local vLLM/Ollama carry different terms and are the lowest-risk place to run the heaviest harmful-prompt sets.
• Cost realism. Reasoning models and multi-turn agent evals multiply the estimates above; run --limit 20 on a pilot model first and replace the placeholder price with the harness's real per-model prices.

Gaps (not verified)

• Anthropic's sabotage-evals code release (no public repo found); Apollo's scheming suite (none found); OpenAI usage-policy text; official Appendix 3 verbatim (fetch returned condensed quotes).
• Sample counts: AgentDojo total, AgentHarm benign count, HarmBench behaviors, SafetyBench English subset, Sycophancy port size, SHADE-Arena task pairs, MACHIAVELLI cost, METR/RE-Bench and OpenAI-eval costs.
• Nothing in this document was executed; the Inspect snippet is syntax-checked against docs only.