A3S-Bench - Baseline Operators - RTR@1: leaderboard
Agent security test from ASEval (Ma et al., 2026): multi-turn work conversations are perturbed with 22 standard prompt-injection techniques and replayed three times against an OpenClaw agent running the model, 786 cases in all. RTR@1 is the percent of cases in which a Claude Opus 4.5 oracle finds the targeted risk realized through the agent's actions in at least one run; lower is better.
Metric: Risk Trigger Rate (%; cases triggered in at least 1 of 3 runs). Source: arxiv.org. Saturation forecast: Estimated already saturated. 11 models tracked.
Top models
| # | Model | Score | Overall rank |
|---|---|---|---|
| 1 | GPT-5.4 | 4.2 | #121 |
| 2 | GLM-5.1 | 5.6 | #175 |
| 3 | Claude Sonnet 4.5 | 7.92 | #244 |
| 4 | GPT-5.2 | 8.83 | #172 |
| 5 | DeepSeek V4 Flash | 24.92 | #254 |
| 6 | Kimi K2.5 | 25.99 | #252 |
| 7 | Qwen 3.5 397B A17B | 27.48 | #242 |
| 8 | MiniMax-M2.5 | 32.39 | #590 |
| 9 | Qwen 3.5 122B A10B | 36.58 | #329 |
| 10 | DeepSeek V3.2 | 37.54 | #403 |
| 11 | Qwen 3.5 35B A3B | 45.27 | #480 |
No result here: #1 Claude Fable 5.2, #2 Gemini 4 Carbon, #5 Claude Opus 5.5.
Interactive version: theaggregate.ai/benchmark?slug=a3s-bench-baseline-operators-rtr-1 · How It Works · Data refreshed daily, snapshot 2026-11-12.