CyberSecEval2 Prompt Injection: leaderboard
CyberSecEval2 prompt-injection tests set a rule in the system prompt (keep a secret, stay on topic) and attack it from the user turn; the score is the share of attempts a judge model finds succeeded, so lower is better.
Metric: Injection Success Rate (%). Source: github.com. Saturation forecast: Estimated already saturated. 10 models tracked.
Top models
| # | Model | Score | Overall rank |
|---|---|---|---|
| 1 | GPT-4o (2024-08-06) | 17.13 | #336 |
| 2 | Claude 3.7 Sonnet (20250219) | 17.43 | #201 |
| 3 | Gemini 2.0 Flash (001) | 24.7 | #360 |
| 4 | GPT-4o Mini (2024-07-18) | 25.8 | #558 |
| 5 | Grok 2 (1212) | 29.18 | #496 |
| 6 | Llama 3.3 70B Instruct | 36.45 | #534 |
| 7 | Llama 3.2 90B Vision Instruct | 37.35 | #622 |
| 8 | DeepSeek V3 Chat | 48.01 | #447 |
No result here: #3 Claude Opus 5.5, #6 GPT-6 Astra, #7 GPT-6.1 Sol.
Interactive version: theaggregate.ai/benchmark?slug=cyberseceval2-prompt-injection · How It Works · Data refreshed daily, snapshot 2026-10-20.