OpenRT: leaderboard
Twenty-six automated black-box jailbreak methods (template, cipher, persona, multi-turn and multi-agent attacks) try to get each model to fully comply with HarmBench harmful requests; the number is the mean share of attacks a GPT-4o-mini judge scores as full compliance. Unlike HarmBench's own table it attacks 2025 frontier models with one shared attacker model (DeepSeek-V3.2) for every method.
Metric: Mean attack success rate over 26 text jailbreak methods (%, lower is better). Source: arxiv.org. 20 models tracked.
Top models
| # | Model | Score | Overall rank |
|---|---|---|---|
| 1 | Claude Haiku 4.5 | 11.44 | #568 |
| 2 | GPT-5.2 | 25.73 | #176 |
| 3 | Gemini 3 Pro (Preview) | 34.23 | #113 |
| 4 | GPT-5.1 | 37.38 | #229 |
| 5 | Qwen 3 Max | 37.6 | #403 |
| 6 | MiniMax-M2 | 39 | #674 |
| 7 | Qwen 3 Next 80B A3B Instruct | 41.88 | #766 |
| 8 | Grok 4.1 Fast | 42.85 | #430 |
| 9 | Hunyuan A13B-Instruct | 43.44 | #2015 |
| 10 | Llama 4 Maverick Instruct | 47.4 | #1133 |
| 11 | Qwen 3 235B A22B 2507 (Thinking) | 49.23 | #463 |
| 12 | GLM-4.6 | 52.38 | #486 |
| 13 | Seed-1.6 | 55.58 | #448 |
| 14 | Llama 4 Scout Instruct | 60.44 | #1543 |
| 15 | ERNIE 4.5 300B A47B | 62.54 | #1087 |
Interactive version: theaggregate.ai/benchmark?slug=openrt · How It Works · Data refreshed daily, snapshot 2026-11-13.