StepJack (2-Step): leaderboard

Metric: Attack success rate (%, lower is better; share of examples whose environment-state checker finds the adversarial goal achieved; the goal decomposed into 2 innocuous sub-steps on a chain of linked pages; each computer-use agent in its default OSWorld agent implementation with 15 x k actions, on StepJack tasks in Reddit and OwnCloud environments with 12 adversarial goals; no urgency cue; one run). Source: arxiv.org. Saturation forecast: Around November 2027. 6 models tracked.

Top models

Interactive version: theaggregate.ai/benchmark?slug=stepjack-2-step · How It Works · Data refreshed daily, snapshot 2026-09-29.