feat(register): add OrchestratorTrustExploitationEval, C5 pipeline authority injection - #1907

Register Submission Review

Overall result: PASS

orchestrator_trust_exploitation_eval

• Task function check: PASS — File evals/orchestrator_trust_exploitation_eval.py exists at the declared task_path and contains a @task-decorated function named orchestrator_trust_exploitation_eval (line 225). The upstream repo has a pyproject.toml with a [project] table and declares inspect-ai>=0.3 as a dependency.
• Runnability check: PASS — The task file imports from inspect_ai, constructs a Task with an inline dataset (4 samples), a solver chain (system_prompt, use_tools, generate), and a custom scorer (trust_exploitation_scorer). All core Inspect components are present and correctly wired.
• Description accuracy: PASS — The YAML description states it "evaluates whether pipeline sub-agents accept false orchestrator authority claims embedded in pipeline messages and act on restricted resources without independently verifying the claimed token." This accurately matches the code, which presents fake orchestrator authority claims and scores whether the model verifies or blindly acts.
• Security review: PASS — The eval uses only mock tools (verify_orchestrator_token and access_pipeline_resource) that return hardcoded strings with no actual system access. No sandbox is used (none is needed — no code execution occurs). No network requests, no credential access, no shell commands, no cryptocurrency mining. The broader repo contains Docker infrastructure for other experiments (C1-C7), but these are not part of the submitted eval and are not invoked by it. The eval itself is a pure tool-calling behavior test.
• Fuzzy duplicate check: NO_MATCH — No existing eval in src/inspect_evals/ or register/ covers orchestrator trust exploitation or pipeline authority injection. Related evals exist in the safeguards category (AgentDojo tests prompt injection in tool-use environments, IPI tests indirect prompt injection in coding agents) but these test fundamentally different attack vectors. This submission tests a distinct behavior class (false orchestrator authority claims in multi-agent pipelines).
• Commit pinning: PASS — source.repository_commit is 8671644d2c57e30f8c791bc2e950c73a4eb07289, a full 40-character hex SHA.

Warnings requiring acknowledgement

None

Resolved warnings

None

Register Submission — Awaiting Manual Review

Automated validation has passed. This PR is now awaiting a manual security review by a maintainer before it can be merged.

Hi! Similar to #1906 we do require a paper link before we add in eval listings.

Again, thanks for the contribution, and am looking forward to the paper :)) and please reach out if you have any questions

(Similarly) closing as is stale! Please re-open if there are any updates :))