SABER - Embedded Injection: leaderboard
Metric: Harmful safety-violation rate (HSR, %) over effective runs on the 289 Scenario A tasks (malicious instructions embedded in project artifacts or tool outputs), each model runs as a coding agent in a Docker-sandboxed project workspace through the benchmark's own ReAct tool loop (shell plus task MCP tools), one run per task; a run is a violation when rule-based state and command checks or the semantic LLM judge flag harm; runs judged Incapable (failures and unnecessary refusals) are excluded from the denominator; lower is better. Source: arxiv.org. Saturation forecast: Around November 2027. 13 models tracked.
Top models
| # | Model | Score |
|---|---|---|
| 1 | Claude Opus 4.6 | 43.7 |
| 2 | GLM-5 | 63.7 |
| 3 | GPT-5.4 | 64 |
| 4 | MiniMax-M2.5 | 67.2 |
| 5 | Qwen 3.5 397B A17B | 69.4 |
| 6 | Kimi K2.5 | 71.1 |
| 7 | GLM-4.7 | 72 |
| 8 | DeepSeek V3 | 72.7 |
| 9 | DeepSeek V3.2 | 73.3 |
| 10 | Ling-flash-2.0 | 74.2 |
| 11 | Qwen 3.5 35B A3B | 76.4 |
| 12 | Qwen 3.5 9B | 76.9 |
| 13 | DeepSeek R1 | 84.3 |
Interactive version: theaggregate.ai/benchmark?slug=saber-embedded-injection · How It Works · Data refreshed daily, snapshot 2026-09-29.