AgentLAB - Tool Chaining: leaderboard
Metric: Attack success rate (%) of tool chaining: a malicious user decomposes the malicious task into a chain of individually benign tool calls (AgentLAB long-horizon attacks on tool-calling agents: 644 malicious tasks in 28 tool environments drawn from SHADE-Arena, AgentDojo, WebShop and Agent-SafetyBench (9 risk categories); a multi-agent attacker (GPT-5.1 planner, abliterated Qwen-3-14B attacker, GPT-5.1 internal judge) adapts its prompts or injected payloads over up to 7, 20, 15, 5 and 12 turns for the five attack types; system and tool-calling prompts adapted from AgentDojo and Agent-SafetyBench; no defense); lower is better. Source: arxiv.org. 6 models tracked.
Top models
| # | Model | Score | Overall rank |
|---|---|---|---|
| 1 | Claude Sonnet 4.5 | 73.3 | #138 |
| 2 | GPT-4o | 94.1 | #333 |
| 3 | GPT-5.1 | 94.6 | #131 |
| 4 | Gemini 3 Flash | 95.9 | #93 |
Interactive version: theaggregate.ai/benchmark?slug=agentlab-tool-chaining · How It Works · Data refreshed daily, snapshot 2026-10-11.