TrustShiftProbe: leaderboard
TrustShiftProbe (2026) connects an LLM agent to an MCP tool server that first behaves honestly to build reliance and then switches to an adversarial payload, from malformed or withheld responses to schema-valid corrupted data and requests to leak secrets. The benchmark has 360 test tasks across four domains. Score is attack success among sessions that consumed an adversarial response after the trust horizon, micro-averaged across exposed sessions without any defense, in percent; lower is better.
Metric: Attack success rate (%, lower is better; share of the 360 attack sessions in four domains whose switched payload succeeds (wrong or unavailable final answer, or exfiltration to a simulated sink); each model as a ReAct agent connected to one MCP server that behaves benignly during a conditioning phase and then switches to an adversarial payload; 90 cases per domain; temperature 0, 15 tool calls; no defense). Source: arxiv.org. Saturation forecast: Around July 2028. 6 models tracked.
Top models
| # | Model | Score | Overall rank |
|---|---|---|---|
| 1 | GPT-5 | 60.2 | #167 |
| 2 | O4 Mini (2025-04-16) | 69.2 | #365 |
| 3 | Qwen 3.5 Flash | 69.5 | #435 |
| 4 | Claude Opus 4.8 | 70.9 | #56 |
| 5 | Grok 4.3 | 73.8 | #333 |
| 6 | GPT-4.1 | 74.1 | #495 |
No result here: #1 Claude Fable 5.2, #2 Gemini 4 Carbon, #5 Claude Opus 5.5.
Interactive version: theaggregate.ai/benchmark?slug=trustshiftprobe · How It Works · Data refreshed daily, snapshot 2026-11-13.