StepJack (2-Step): leaderboard
StepJack (2026) tests whether computer-use agents carry out an adversarial goal planted in web pages or documents they visit while doing a benign task for the user; an environment-state checker decides whether the goal was achieved. Here the adversarial goal is decomposed into two innocuous-looking sub-steps spread over a chain of linked pages. Score is the attack success rate in percent; lower is better.
Metric: Attack success rate (%, lower is better; share of examples whose environment-state checker finds the adversarial goal achieved; the goal decomposed into 2 innocuous sub-steps on a chain of linked pages; each computer-use agent in its default OSWorld agent implementation with 15 x k actions, on StepJack tasks in Reddit and OwnCloud environments with 12 adversarial goals; no urgency cue; one run). Source: arxiv.org. Saturation forecast: Around June 2027. 6 models tracked.
Top models
| # | Model | Score | Overall rank |
|---|---|---|---|
| 1 | Claude Haiku 4.5 | 14.6 | #568 |
| 2 | Claude Sonnet 4.6 | 17.7 | #161 |
| 3 | Qwen 3.5 Plus | 22.9 | #232 |
| 4 | GPT-5.4 Mini (xHigh) | 60.4 | #389 (GPT-5.4 Mini) |
| 5 | Kimi K2.5 | 64.6 | #256 |
No result here: #1 Claude Fable 5.2, #2 Gemini 4 Carbon, #5 Claude Opus 5.5.
Interactive version: theaggregate.ai/benchmark?slug=stepjack-2-step · How It Works · Data refreshed daily, snapshot 2026-11-13.