MCP Security Bench - Performance Under Attack: leaderboard
The share of user tasks the agent still completes while the MCP attacks are active, averaged over the 12 attack types (no defense). It is the paper's utility control: weaker tool users score low here and also low on attack success.
Metric: Performance under attack (%, share of user tasks completed while attacked; utility control). Source: arxiv.org. Saturation forecast: Around February 2027. 10 models tracked.
Top models
| # | Model | Score | Overall rank |
|---|---|---|---|
| 1 | DeepSeek V3.1 (Non-reasoning) | 86.37 | #497 (DeepSeek V3.1) |
| 2 | GPT-5 | 84.33 | #167 |
| 3 | Claude Sonnet 4 | 73.92 | #400 |
| 4 | GPT-4o Mini | 71.96 | #1623 |
| 5 | Llama 3.3 70B Instruct | 60.98 | #1357 |
| 6 | Qwen 3 8B | 51.15 | #1830 |
| 7 | Llama 3.1 70B Instruct | 37.49 | #1546 |
| 8 | Llama 3.1 8B Instruct | 34.1 | #4246 |
| 9 | Qwen 3 30B A3B 2507 Instruct | 32.52 | #1089 |
| 10 | Gemini 2.5 Flash | 32.14 | #453 |
No result here: #1 Claude Fable 5.2, #2 Gemini 4 Carbon, #5 Claude Opus 5.5.
Interactive version: theaggregate.ai/benchmark?slug=mcp-security-bench-performance-under-attack · How It Works · Data refreshed daily, snapshot 2026-11-13.