A3S-Bench - Agent-Specific Operators - RTR@1: leaderboard
Agent security test from ASEval (Ma et al., 2026): multi-turn work conversations are perturbed with agent-specific attacks (payloads split across turns, hidden in workspace files or skills, or concealed in benign-looking requests) and replayed three times against an OpenClaw agent running the model, 726 cases in all. RTR@1 is the percent of cases in which a Claude Opus 4.5 oracle finds the targeted risk realized through the agent's actions in at least one run; lower is better.
Metric: Risk Trigger Rate (%; cases triggered in at least 1 of 3 runs). Source: arxiv.org. Saturation forecast: Around February 2027. 11 models tracked.
Top models
| # | Model | Score | Overall rank |
|---|---|---|---|
| 1 | GPT-5.4 | 15.15 | #121 |
| 2 | GLM-5.1 | 16.67 | #175 |
| 3 | Claude Sonnet 4.5 | 19.68 | #244 |
| 4 | GPT-5.2 | 30.47 | #172 |
| 5 | Kimi K2.5 | 55.08 | #252 |
| 6 | Qwen 3.5 397B A17B | 55.24 | #242 |
| 7 | MiniMax-M2.5 | 59.49 | #590 |
| 8 | DeepSeek V4 Flash | 60.47 | #254 |
| 9 | DeepSeek V3.2 | 64.32 | #403 |
| 10 | Qwen 3.5 122B A10B | 67.37 | #329 |
| 11 | Qwen 3.5 35B A3B | 77.69 | #480 |
No result here: #1 Claude Fable 5.2, #2 Gemini 4 Carbon, #5 Claude Opus 5.5.
Interactive version: theaggregate.ai/benchmark?slug=a3s-bench-agent-specific-operators-rtr-1 · How It Works · Data refreshed daily, snapshot 2026-11-12.