MCP Tool Poisoning - Attack success rate: leaderboard
MCP tool-poisoning Table 4:18 models across 12 frameworks and 45 scenarios; ASR=V/(V+R),excluding error/skipped cells. Each model has 540 potential cells but valid denominators differ; attack evidence includes dispatched malicious calls,network contact and verified exfiltration. This is conditional susceptibility under the published framework mixture, not overall task success. Unspecified checkpoint/mode in abbreviated labels remains explicitly source-scoped. Metric: Attack success (%).
Metric: Attack success (%). Source: arxiv.org. Saturation forecast: Estimated already saturated. 18 models tracked.
Top models
| # | Model | Score | Overall rank |
|---|---|---|---|
| 1 | Claude Fable 5 | 0.4 | #20 |
| 2 | Claude Opus 4.8 | 1.5 | #39 |
| 3 | Claude Sonnet 5 | 1.9 | #65 |
| 4 | Gemma 3 27B | 4.1 | #606 |
| 5 | GPT-5.5 | 12.4 | #33 |
| 6 | Claude Haiku 4.5 | 12.5 | #287 |
| 7 | Claude Sonnet 4.5 | 14.5 | #148 |
| 8 | Mistral Large 2 (Jul) | 21.6 | #490 |
| 9 | GLM-5 | 24.3 | #149 |
| 10 | Llama 4 Scout | 28.1 | #648 |
| 11 | Ministral 3 14B | 34.3 | #664 |
| 12 | GPT-OSS-120B | 38.1 | #346 |
| 13 | Mistral Large 3 | 43.7 | #410 |
| 14 | DeepSeek V3.2 | 44 | #210 |
| 15 | Llama 4 Maverick | 44.1 | #486 |
No result here: #3 Claude Opus 5.5, #6 GPT-6 Astra, #7 GPT-6.1 Sol.
Interactive version: theaggregate.ai/benchmark?slug=mcp-tool-poisoning-attack-success-rate · How It Works · Data refreshed daily, snapshot 2026-11-05.