StepJack (Single-Step): leaderboard
StepJack (2026) tests whether computer-use agents carry out an adversarial goal planted in web pages or documents they visit while doing a benign task for the user; an environment-state checker decides whether the goal was achieved. Here the injection is a single instruction. Score is the attack success rate in percent; lower is better.
Metric: Attack success rate (%, lower is better; share of examples whose environment-state checker finds the adversarial goal achieved; the goal injected as one instruction, k = 1; each computer-use agent in its default OSWorld agent implementation with 15 x k actions, on StepJack tasks in Reddit and OwnCloud environments with 12 adversarial goals; no urgency cue; one run). Source: arxiv.org. Saturation forecast: Around July 2027. 6 models tracked.
Top models
| # | Model | Score | Overall rank |
|---|---|---|---|
| 1 | Claude Haiku 4.5 | 12.5 | #568 |
| 2 | Claude Sonnet 4.6 | 20.8 | #161 |
| 3 | Qwen 3.5 Plus | 29.2 | #232 |
| 4 | GPT-5.4 Mini (xHigh) | 41.7 | #389 (GPT-5.4 Mini) |
| 5 | Kimi K2.5 | 52.1 | #256 |
No result here: #1 Claude Fable 5.2, #2 Gemini 4 Carbon, #5 Claude Opus 5.5.
Interactive version: theaggregate.ai/benchmark?slug=stepjack-single-step · How It Works · Data refreshed daily, snapshot 2026-11-13.