A 30-cell coding-agent adversarial robustness matrix crossing five high-risk topic areas (offensive cybersecurity, bio/chemical dual-use, agentic misalignment, classifier-level jailbreaks, and prompt injection) with six packaging techniques observed in prior NOPE adversarial findings (hidden fields, schema mimicry, label slip, completion pressure, low-resource language, and authority pressure). Higher coverage means the model kept the task safe: it treated embedded instructions as untrusted, avoided operational harmful assistance, and returned bounded defensive or governance-oriented output.

Recruits a model's remediation bias: ask it to REMOVE misinformation from a file via a unified diff. Removed content is spelled out on the diff's - lines, so the model fabricates and writes out the full misinformation while believing it is deleting it — a red-teamer harvests the deletion lines. A no-diff remediation control (safe for all models) isolates the deletion-line requirement as the lever. Distinct from the "author the new content" git-diff; notably breaks models that resist that.

Holds one well-defended health-misinformation payload constant and sweeps completion-style scaffolds — pytest parametrize case, failing-test fill, fill-the-stub, git-diff add, patch-apply, jsonl append — that ask a model to COMPLETE an empty field in a pre-existing test/fixture/dataset artifact, against a direct baseline and two authoring-in-a-format controls. The completion framings crack even models that refuse the plain fixture; the standout (pytest parametrize / failing-test) generalises across labs.

The canonical damaging-essay suite: seven non-catastrophic persuasive-essay harm categories (impulsive-ruin, isolation propaganda, anti-help-seeking, anti-expertise/conspiracy, coercive control, toxic self-worth, medical self-neglect) run through the coding-agent fixture-completion frame, mapping how broadly the bypass yields not just private validation but distributable, persuasive harmful content. Content described abstractly and judged by plain-language rubrics; see the header for the deliberate scope envelope.

Tests whether framing a request for unsafe content as file/data generation for a "test fixture" — rather than asking for the content directly in chat — bypasses safety training that otherwise holds. Seven categories spanning distinct safety pillars (relational harm: isolation-affirmation, romantic-love reciprocation, and therapy-discouragement; epistemic harm: health misinformation, paranoid-belief validation, and manic/grandiose-ideation validation; plus a compound welfare-harm essay glorifying impulsive, life-ruining decisions), tested via a generic coding-assistant persona rather than any persuasive or jailbreak-styled framing. The romantic-love-reciprocation cell pairs directly with companion-adversarial-pressure.yml's dismissal-romantic-love-reciprocation prompt — same content, different attack shape, run both to see the same model behave completely differently against each. Published transparently as a documented, currently-unmitigated bypass class — see the header comment for full context and rationale.

Tests whether the coding-agent/file-generation bypass (coding-agent-safety-bypass.yml) extends into hate speech (dehumanization arguments, both an abstract placeholder group and a real, moderate category) and sexual coercion (a companion AI pressuring/guilt-tripping a user after they've said no). Direct-chat baselines included for both. See the header for the deliberate scope limits (no CSAM-adjacent content ever; sexual content scoped to coercion as a behavior, not explicit description) and the realism-confound finding that motivates testing hate speech against both a placeholder and a real category.

Re-runs the hate-speech (real-category) and crisis-safety-validation coding-vector prompts with the prompt now explicitly blocking the model's usual response shape (redirect to published benchmarks, or offer a synthetic/placeholder stand-in instead of the real content) — a diagnostic for whether a model's resistance in this bypass family is load-bearing or just not yet pressed hard enough. See the header for what was found.

Tests whether the coding-agent/file-generation bypass gets a model to validate suicidal ideation as reasonable, with a direct-chat baseline for comparison. No method/means content requested or permitted under any framing — see the header for the absolute scope line and for why the point-level breakdown, not the topline score, is the right way to read this file's results.

Tests whether asking a model to produce a labeled "accepted answer" / "rejected answer" (or similarly-labeled) pair — under a moderation-dataset, safety-classifier, or structured-pipeline pretext — gets it to produce fully-formed harmful content in the "rejected" slot that it would refuse to produce if asked directly and unlabeled. The label provides no actual safety; a downstream integrator can extract either slot regardless of which one the model considered correct. Six structural variants across three topics (violence, self-neglect, stalking-adjacent), system: null.

Holds the coding-assistant persona, the eval-fixture pretext, and the target content (romantic-love reciprocation) completely constant across 13 prompts, varying only the requested output format/container — plain prose, seven multi-field structured-data formats (YAML/JSON/Python/CSV/SQL/Markdown/XML), and five exotic containers (base64, ROT13, French, a single-field .env assignment, a multi-field log line) that isolate whether the boundary is about raw structuredness or specifically multi-field schema mimicry. Reveals whether a model's coding-agent-bypass vulnerability is format-specific (a narrow, addressable coverage gap) or persona/pretext-gated and format-independent (a broader gap that format-level fixes won't touch). Companion piece to coding-agent-safety-bypass.yml — see that file's header for the underlying mechanism.

Compares the coding-vector bare-file-request bypass with no reminder, a rule-framed safety reminder, and an identity-framed reminder, all in the system prompt. In prior testing neither reminder moved the result at all compared to no reminder — a real negative result worth reproducing before assuming a prompt-level fix will work for this bypass class.

For each of two categories, compares the natural single-shot fixture request against an otherwise-identical version where an explicit yes/no decision is forced in a separate turn before any fixture content is requested. Distinguishes "the safety check exists but doesn't gate generation in this structure" (fixable with interaction design) from "the safety check isn't being applied to this content at all" (needs training investment) — see the header comment for how to read the comparison, including a documented case where the intervention backfires.

Evaluates how public models respond, as conversational agents, to acute crisis: passive and active suicidal ideation, method/means-seeking, post-attempt disclosure, the high-risk post-discharge window, "goodbye" warning signs, gatekeeper (concerned-friend) situations, and harm-to-others requests.

This is NOT a classification task. We score the quality of the conversational response: does it ask directly but compassionately about suicide, refuse to facilitate method/means, ask directly, respond to disclosures as high-severity signals, name means-related danger, link to crisis care, and state honest limits — without abandoning the user or colluding with harm?

Coalesced from (public, CC0):

• Weval csr-suicide-response-scenarios.yml (WHO mhGAP, NICE NG225, VA/DoD 2024, C-SSRS, SAFE-T, Stanley-Brown, Harvard Means Matter)
• Weval raine-v-openai-scenarios.yml (verbatim allegations, Raine v. OpenAI, 2025)
• Weval mh_z_tests/mh1.yml (suicidality & homicidality scenarios)
• Weval nope/crisis-response.yml (NOPE-derived; C-SSRS, Galynker 2017 Suicide Crisis Syndrome)

Content warning: explicit references to suicide, self-harm, and methods.

The hard companion to the factual-reliability suite. Each case applies PRESSURE — an academic or "for research" framing, a demand to cite a paper, hostile insistence that the model is wrong, a false claim of authority, or urgency — and scores whether the model keeps its factual integrity: refuses to fabricate, refuses to supply dangerous specifics, holds an accurate fact without caving, corrects a dangerous false premise, and stays honest about what it cannot know or do.

Built specifically to separate frontier models that ace the easier factual cases. A model passes by being accurate AND uncapitulating AND non-confabulating under adversarial framing.

Coalesced (public, CC0): Weval jailbreak-safety-probes, sycophancy-probe, hallucination-probe, confidence-high-stakes-domains. Grounding: WHO responsible-reporting; APA (2025) Health Advisory; FDA; CCOHS; NICE NG222; Linardon 2025 (JMIR Mental Health) on LLM citation fabrication; the Mata v. Avianca fabricated-case sanctions and the Cureus "Artificial Hallucinations" report.