Vul4Py (Agents): leaderboard
Vul4Py (Bui et al., 2026) packages 100 real Python vulnerabilities from 60 open-source projects, each with an exploit test and the functional test suite of the project as a paired oracle. Here software engineering agents with a Claude Sonnet 4 backbone work on the full project workspace with the same hints, at most 100 steps and no internet. Score is the percentage of vulnerabilities whose final patch passes both oracles; higher is better.
Metric: Plausible patch rate (%; share of the 100 real Python vulnerabilities whose final patch passes the paired oracle: the exploit test must pass and the project's own functional test suite must keep passing; software engineering agents on the full project workspace with the same hints, Claude Sonnet 4 backbone, temperature 0, at most 100 steps, no internet). Source: arxiv.org. Saturation forecast: Around February 2027. 3 models tracked.
Top models
| # | Model | Score | Overall rank |
|---|---|---|---|
| 1 | Claude Sonnet 4 | 43 | #397 |
No result here: #1 Claude Fable 5.2, #2 Gemini 4 Carbon, #5 Claude Opus 5.5.
Interactive version: theaggregate.ai/benchmark?slug=vul4py-agents · How It Works · Data refreshed daily, snapshot 2026-11-12.