Plant, Persist, Trigger: leaderboard
Large Language Model (LLM) agents remain vulnerable to safety threats from the external environment, where attackers inject adversarial content into external observations such as tool-returned data, webpages, or MCP context, causing harmful agentic behaviors such as unsafe actions or incorrect outputs. Existing studies typically focus on single-interaction attacks, where the agent observes adversa
Metric: Avg. (self-reported). Source: benchmarklist.com. Saturation forecast: Around July 2027. 7 models tracked.
Top models
| # | Model | Score | Overall rank |
|---|---|---|---|
| 1 | Gemini 3 Flash | 51.1 | #99 |
| 2 | DeepSeek R1 | 42.7 | #251 |
| 3 | Gemini 3.1 Pro (Preview) | 33.3 | #58 |
| 4 | Qwen 3.5 Plus | 19 | #125 |
| 5 | GPT-5.4 | 18.4 | #79 |
| 6 | Llama 3.3 70B | 17.6 | #579 |
| 7 | Qwen 3.5 Flash | 5.7 | #232 |
No result here: #3 Claude Opus 5.5, #6 GPT-6 Astra, #7 GPT-6.1 Sol.
Interactive version: theaggregate.ai/benchmark?slug=plant-persist-trigger · How It Works · Data refreshed daily, snapshot 2026-10-20.