TrustShiftProbe - Browser Automation: leaderboard

Metric: Attack success rate (%, lower is better; share of the browser automation attack sessions whose switched payload succeeds; each model as a ReAct agent connected to one MCP server that behaves benignly during a conditioning phase and then switches to an adversarial payload; 90 cases per domain; temperature 0, 15 tool calls; no defense). Source: arxiv.org. Saturation forecast: Around 2035. 6 models tracked.

Top models

#ModelScore
1Grok 4.362.3
2Qwen 3.5 Flash62.8
3GPT-565.4
4O4 Mini (2025-04-16)72
5GPT-4.176.5
6Claude Opus 4.885.1

Interactive version: theaggregate.ai/benchmark?slug=trustshiftprobe-browser-automation · How It Works · Data refreshed daily, snapshot 2026-09-29.