LITMUS: leaderboard
The rapid proliferation of LLM-based autonomous agents in real operating system environments introduces a new category of safety risk beyond content safety: behavior jailbreak, where an adversary induces an agent to execute dangerous OS-level operations with irreversible consequences. Existing benchmarks either evaluate safety at the semantic layer alone, missing physical-layer harms, or fail to i
Metric: Attack Success Rate (self-reported). Source: benchmarklist.com. Saturation forecast: Around August 2027. 6 models tracked.
Top models
| # | Model | Score | Overall rank |
|---|---|---|---|
| 1 | Claude Sonnet 4.6 | 40.64 | #90 |
| 2 | Qwen 3.6 Plus | 55.84 | #120 |
| 3 | Gemini 3.1 Pro (Preview) | 57.02 | #58 |
| 4 | GPT-5.3 Codex | 58.12 | #69 |
| 5 | DeepSeek V4 Pro | 69.8 | #102 |
| 6 | DeepSeek V3.2 | 71.51 | #205 |
No result here: #3 Claude Opus 5.5, #6 GPT-6 Astra, #7 GPT-6.1 Sol.
Interactive version: theaggregate.ai/benchmark?slug=litmus · How It Works · Data refreshed daily, snapshot 2026-10-20.