b3 Agent Security - Reasoning Enabled: leaderboard
A model is used as the backbone of ten agent setups and crowd-sourced prompt-injection and jailbreak attacks arrive through chat, tools, documents or memory; the number is the mean attack success, with reasoning enabled. Unlike AgentDojo, each attack is scored on a single frozen agent step rather than a full simulated agent run.
Metric: Vulnerability score (0-1; mean attack success over all threat snapshots, lower is better). Source: arxiv.org. 19 models tracked.
Top models
| # | Model | Score | Overall rank |
|---|---|---|---|
| 1 | Grok 4 | 0.2 | #307 |
| 2 | Claude Sonnet 4 (Thinking) | 0.25 | #400 (Claude Sonnet 4) |
| 3 | Grok 4 Fast (Reasoning) | 0.25 | #441 (Grok 4 Fast) |
| 4 | Claude Opus 4.1 (Thinking) | 0.27 | #272 (Claude Opus 4.1) |
| 5 | GPT-5 (Medium) | 0.28 | #167 (GPT-5) |
| 6 | Claude 3.7 Sonnet (Thinking) | 0.29 | #458 (Claude 3.7 Sonnet) |
| 7 | GPT-5 Mini (Medium) | 0.31 | #348 (GPT-5 Mini) |
| 8 | Claude Opus 4 (Thinking) | 0.31 | #322 (Claude Opus 4) |
| 9 | Gemini 2.5 Pro | 0.36 | #266 |
| 10 | GPT-5 Nano (Medium) | 0.38 | #889 (GPT-5 Nano) |
| 11 | O4 Mini | 0.4 | #353 |
| 12 | GPT-OSS-120B | 0.44 | #700 |
| 13 | GPT-OSS-20B | 0.45 | #1147 |
| 14 | DeepSeek R1 0528 | 0.47 | #428 |
| 15 | Magistral Medium | 0.48 | #1203 |
Interactive version: theaggregate.ai/benchmark?slug=b3-agent-security-reasoning-enabled · How It Works · Data refreshed daily, snapshot 2026-11-13.