WebTrap Park - Malicious User Prompts: leaderboard
The malicious user prompt tasks of WebTrap Park (Wu et al., 2026): the user asks the web agent to carry out a harmful goal such as social engineering, misinformation, cyber intrusion or CAPTCHA evasion. The score is 1 minus the attack success rate in percent, judged from the agent's recorded clicks and typed text; higher is safer.
Metric: Security score (%; harmful user instructions such as social engineering, misinformation, cyber intrusion or CAPTCHA evasion; score = 1 - attack success rate, from the web agent's click and type actions instrumented in the web environment; framework and model configuration as labelled). Source: arxiv.org. Saturation forecast: Estimated already saturated. 15 models tracked.
Top models
| # | Model | Score | Overall rank |
|---|---|---|---|
| 1 | Claude Sonnet 4 | 100 | #397 |
| 2 | O3 | 99.12 | #224 |
| 3 | GPT-4o | 91.8 | #741 |
| 4 | Qwen-VL-Max | 65.13 | #1226 |
No result here: #1 Claude Fable 5.2, #2 Gemini 4 Carbon, #5 Claude Opus 5.5.
Interactive version: theaggregate.ai/benchmark?slug=webtrap-park-malicious-user-prompts · How It Works · Data refreshed daily, snapshot 2026-11-12.