Cogensec publishes the datasets its own detection and red-team work runs on: labeled jailbreak attempts, multilingual polite-attack benchmarks, and security reasoning traces. Every corpus is gated, documented down to its record schema, and released for defensive research.
Labeled real jailbreak attempts: adversarial prompts that try to make a model violate its safety policy, assembled for defensive work: training and evaluating detectors, studying attack taxonomies, and measuring robustness. Prompts only, no model completions.
A multilingual adversarial benchmark for polite jailbreaks, malicious intent masked behind courteous language, which sentiment-weighted filters routinely read as benign. Each sample is labeled a direct attack, a polite attack, or a benign request, with polite attacks linked back to the direct form they were derived from.
Labeled security reasoning traces spanning vulnerability analysis, threat-intelligence triage, incident-response decisions, and policy and compliance mapping. Built for training and evaluating autonomous security agents, and for measuring whether a model’s stated reasoning matches the answer it gives.
The same four steps behind every release. Step three is the one that decides whether a benchmark measures anything at all.
01
Aggregate
Pull real seed prompts from public research datasets, normalise them to one schema, and de-duplicate on prompt hash. Every record keeps its source dataset, source record id and license.
02
Augment
Wrap unique seeds in encoding, cipher, persona and template transforms across model families. Every synthetic record is flagged and carries a parent_id back to the seed it came from.
03
Split
Group-aware stratified split, so a seed and its variants never land on opposite sides of the train/test boundary. Without this, a detector scores its own training data at test time.
04
Gate
Publish behind a request form with a responsible-use policy, stated intended use, and access logging. No corpus is released open-weight or anonymously.
Terms
Responsible use
These corpora describe harmful intent, that is the attack surface a detector has to recognise. The terms below are conditions of access, not a disclaimer.
01
Defensive research only
Released for training and evaluating detectors, studying attack taxonomies, measuring robustness, and red-teaming systems you are authorised to test. Not for attacking third-party systems or generating harmful content.
02
Prompts, not completions
The Jailbreak Corpus stores attack prompts and metadata only. It contains no model outputs, and therefore no successful harmful generations.
03
CSAE excluded
Child sexual abuse and exploitation content is excluded from the corpus entirely, at every stage of the pipeline.
04
Access is logged
Every request records who asked, their affiliation, and their stated intended use. Access is granted against a responsible-use policy, not a checkbox.
Known limitations
What the corpus can’t tell you
Published from the Jailbreak Corpus datasheet, unedited. A benchmark you can’t audit is a benchmark you can’t trust.
Technique is “other” for 51% of records and harm is “unknown” for 92%. Many prompt-injection seeds match no keyword signal, and bare scaffolds carry no payload-specific harm. Treat the current technique and harm labels as weak.
Note 2 / 3
Sources are concentrated
WildJailbreak accounts for roughly 46% of real seeds and SPML injection for roughly 29%. Filter on source_dataset if you need a balanced sample.
Note 3 / 3
Outcomes are mostly unknown
Outcome is unknown for about 95% of records, only HackAPrompt reports per-prompt results, and no completions are stored. Provenance skews OpenAI and reflects the sources, not current model susceptibility.
Citation
Cite the corpus
Cite the originating source of each record you use as well, the per-record source_url carries it. WildJailbreak is ODC-BY and requires attribution to AI2.
@misc{cogensec_jailbreak_corpus_2026,
title = {Jailbreak Corpus: A Labeled Dataset of Jailbreak Attempts (v0.3)},
author = {Cogensec},
year = {2026},
url = {https://huggingface.co/datasets/Cogensec/jailbreak-corpus}
}
Get the data
Request dataset access
Every corpus is gated. Tell us who you are, where you work, and what you intend to build, we review requests against the responsible-use policy and follow up within two business days.