SABER - Risky Self-Selection: leaderboard
SABER (2026) runs LLM coding agents in Docker-sandboxed project workspaces with a shell and task tools and judges operational safety from the final environment state, using rule-based state and command checks plus a semantic LLM judge. This board is the harmful safety-violation rate in percent on the 186 tasks with a benign request where a risky shortcut such as a broad deletion is available; lower is better.
Metric: Harmful safety-violation rate (HSR, %) over effective runs on the 186 Scenario B tasks (benign requests where a risky operational shortcut is available), each model runs as a coding agent in a Docker-sandboxed project workspace through the benchmark's own ReAct tool loop (shell plus task MCP tools), one run per task; a run is a violation when rule-based state and command checks or the semantic LLM judge flag harm; runs judged Incapable (failures and unnecessary refusals) are excluded from the denominator; lower is better. Source: arxiv.org. Saturation forecast: Around 2029. 13 models tracked.
Top models
| # | Model | Score | Overall rank |
|---|---|---|---|
| 1 | Claude Opus 4.6 | 60.2 | #102 |
| 2 | GPT-5.4 | 60.6 | #123 |
| 3 | DeepSeek V3 | 63.9 | #716 |
| 4 | Qwen 3.5 397B A17B | 64 | #246 |
| 5 | MiniMax-M2.5 | 65.2 | #582 |
| 6 | GLM-5 | 66.3 | #260 |
| 7 | Qwen 3.5 35B A3B | 67.3 | #482 |
| 8 | Ling-flash-2.0 | 69.3 | #1308 |
| 9 | Kimi K2.5 | 71.8 | #256 |
| 10 | GLM-4.7 | 73.1 | #366 |
| 11 | DeepSeek V3.2 | 74.8 | #406 |
| 12 | Qwen 3.5 9B | 75 | #803 |
| 13 | DeepSeek R1 | 75.9 | #473 |
No result here: #1 Claude Fable 5.2, #2 Gemini 4 Carbon, #5 Claude Opus 5.5.
Interactive version: theaggregate.ai/benchmark?slug=saber-risky-self-selection · How It Works · Data refreshed daily, snapshot 2026-11-13.