LivePI: leaderboard
Indirect prompt-injection benchmark (LivePI, Zhao, Bhaskar and Dobriban, University of Pennsylvania, 2026) run on a live OpenClaw agent with real Gmail, Slack, Telegram, WhatsApp and GitHub accounts and a test crypto wallet: 169 cases plant a malicious goal (exfiltrating wallet files, disabling the firewall, running a fetched script, forwarding an inbox summary, a crypto transfer) in group chats, emails, local documents, repository links or Gists while the agent does a benign task. The score is the attack success rate in percent over all cases, judged by GPT-5.3 from the trace with artifact checks; lower is better.
Metric: Attack success rate (%; 169 indirect prompt-injection cases against an OpenClaw agent, case-weighted). Source: arxiv.org. Saturation forecast: Around February 2027. 5 models tracked.
Top models
| # | Model | Score | Overall rank |
|---|---|---|---|
| 1 | Claude Opus 4.6 | 10.7 | #100 |
| 2 | Kimi K2.5 | 16.6 | #252 |
| 3 | GPT-5.3 Codex | 27.2 | #114 |
| 4 | GLM-5 | 27.8 | #256 |
| 5 | Gemini 3.1 Pro (Preview) | 29.6 | #91 |
No result here: #1 Claude Fable 5.2, #2 Gemini 4 Carbon, #5 Claude Opus 5.5.
Interactive version: theaggregate.ai/benchmark?slug=livepi · How It Works · Data refreshed daily, snapshot 2026-11-12.