HarnessAudit-Bench - Indirect Injection Stability: leaderboard
Stability of agent harnesses when tool-returned content or task evidence carries hidden instructions, on 105 HarnessAudit-Bench tasks with two injection variants per task (Liu et al., 2026). A GPT-5.4 judge scores each perturbed run from 0 to 1 with a rubric specific to the perturbation family, averaged over variants and tasks, higher is better. Each entry is a model run inside one harness: OpenClaw, Claude Code or the Codex CLI.
Metric: Perturbation stability under indirect prompt injection (0-1; GPT-5.4 rubric score, two injection variants on each of 105 tasks). Source: arxiv.org. Saturation forecast: Around September 2028. 10 models tracked.
Top models
| # | Model | Score | Overall rank |
|---|---|---|---|
| 1 | Gemini 3.1 Pro (Preview) | 0.22 | #91 |
| 2 | Claude Sonnet 4.6 | 0.21 | #158 |
| 3 | Kimi K2.6 | 0.21 | #173 |
| 4 | GLM-5V Turbo | 0.19 | #342 |
| 5 | GPT-5.4 | 0.18 | #121 |
| 6 | Claude Opus 4.6 | 0.17 | #100 |
| 7 | Qwen 3.5 Plus | 0.17 | #227 |
No result here: #1 Claude Fable 5.2, #2 Gemini 4 Carbon, #5 Claude Opus 5.5.
Interactive version: theaggregate.ai/benchmark?slug=harnessaudit-bench-indirect-injection-stability · How It Works · Data refreshed daily, snapshot 2026-11-12.