NUWA 
Anthropic
Claude Opus 4.6
Published evidence on capabilities, behavioral tendencies and observed actions.
- First public availability
- 2026-02-05
- Parameters
- Not disclosed
- Metadata updated
- 2026-10-27
Evidence overview
Published risk evidence is organized by assessment and protocol. Missing evidence is not a low-risk finding.
NUWA curates and interprets these sources. Experiments are attributed to their original executors; this page does not claim NUWA has independently replicated them.
MODEL MONITORING
Representative benchmark coverage
Results by protocol and configuration; gaps show records awaiting collection or linkage.
AgentCyberRange →
No eligible measurement linked to this model version.
Cybench →
No eligible measurement linked to this model version.
CyberGym →
4 measurements
- 44.55%Lyptus Research · Harness not disclosed
- 91%Not disclosed · mneme
- 89.6%Not disclosed · Crystalline
METR Time Horizons →
2 measurements
- 718.81 minMETR · mtb/start_metr_task,metr_agents/react; ai_rd_fix_embedding/init_solver,use_tools,metr_agents/react; re_bench_common/init_solver,use_tools,metr_agents/react; metr_tasks_swaa/init_solver,generate; metr_agents/react
- 69.87 minMETR · mtb/start_metr_task,metr_agents/react; ai_rd_fix_embedding/init_solver,use_tools,metr_agents/react; re_bench_common/init_solver,use_tools,metr_agents/react; metr_tasks_swaa/init_solver,generate; metr_agents/react
SEC-bench Pro →
8 measurements
All conditions →MASK →
No eligible measurement linked to this model version.
Attempt to Persuade Eval (APE) →
No eligible measurement linked to this model version.
DeceptionBench →
4 measurements
All conditions →PersuSafety →
No eligible measurement linked to this model version.
All linked measurements
Each result retains its protocol and unit.
34 observations
| System / model | Result | Condition status | Task / conditions | Evaluator / report | Dates |
|---|---|---|---|---|---|
| Claude Opus 4.6 | 44.55%CyberGym · CyberGym pass@1 | Incomplete | CyberGym Level 1 hard-task matched subsetCyberGym pass@12M tokens per task— | Lyptus ResearchGLM-5.2 Risk Evaluation Report | Release 2026-02-05Report 2026-08-02 |
| Claude Opus 4.6 · mnemeClaude Opus 4.6 | 91%CyberGym · Success rate | Incomplete | level1score_10mneme | Not disclosedCyberGym official leaderboard and machine-data extraction | Release 2026-02-05Report — |
| Claude Opus 4.6 · CrystallineClaude Opus 4.6 | 89.6%CyberGym · Success rate | Incomplete | level1score_10Crystalline | Not disclosedCyberGym official leaderboard and machine-data extraction | Release 2026-02-05Report — |
| Claude Opus 4.6 · Anthropic AgentClaude Opus 4.6 | 66.6%CyberGym · Success rate | Incomplete | level1score_10Anthropic Agent | Not disclosedCyberGym official leaderboard and machine-data extraction | Release 2026-02-05Report — |
| Claude Opus 4.6 | 43.1%Stealth evaluations · Mean challenge success rate | Incomplete | GDM situational awareness 11 tasksMean challenge success rate— | MetaEvaluating Kimi K3 for Misalignment Risks | Release 2026-02-05Report 2026-09-11 |
| Claude Opus 4.6 | 13%Stealth evaluations · Stealth task score | Incomplete | GDM stealthOversight pattern— | MetaEvaluating Kimi K3 for Misalignment Risks | Release 2026-02-05Report 2026-09-11 |
| Claude Opus 4.6 | 0%Stealth evaluations · Stealth task score | Incomplete | GDM stealthClassifier evasion— | MetaEvaluating Kimi K3 for Misalignment Risks | Release 2026-02-05Report 2026-09-11 |
| Claude Opus 4.6 | 14%Stealth evaluations · Stealth task score | Incomplete | GDM stealthCover your tracks— | MetaEvaluating Kimi K3 for Misalignment Risks | Release 2026-02-05Report 2026-09-11 |
| Claude Opus 4.6 | 46%Stealth evaluations · Stealth task score | Incomplete | GDM stealthStrategic rule-breaking— | MetaEvaluating Kimi K3 for Misalignment Risks | Release 2026-02-05Report 2026-09-11 |
| Claude Opus 4.6 | 0%Agentic misalignment · deliberate harmful action rate | Incomplete | Anthropic Agentic Misalignmentdeliberate harmful action rate— | MetaEvaluating DeepSeek v4 Pro for Frontier Risks | Release 2026-02-05Report 2026-05-29 |
| Claude Opus 4.6 | 0.3%DeceptionBench · deception score: single-turn | Incomplete | DeceptionBenchdeception score: single-turn— | MetaEvaluating DeepSeek v4 Pro for Frontier Risks | Release 2026-02-05Report 2026-05-29 |
| Claude Opus 4.6 | 0.8%DeceptionBench · deception score: multi-turn w pressure | Incomplete | DeceptionBenchdeception score: multi-turn w pressure— | MetaEvaluating DeepSeek v4 Pro for Frontier Risks | Release 2026-02-05Report 2026-05-29 |
| Claude Opus 4.6 | 0.3%DeceptionBench · DeceptionBench deception score | Incomplete | DeceptionBenchsingle-turn— | MetaEarly Results on Evaluating GLM 5.2 for Behavioral and Persuasion Risks | Release 2026-02-05Report 2026-07-03 |
| Claude Opus 4.6 | 0.8%DeceptionBench · DeceptionBench deception score | Incomplete | DeceptionBenchmulti-turn with pressure— | MetaEarly Results on Evaluating GLM 5.2 for Behavioral and Persuasion Risks | Release 2026-02-05Report 2026-07-03 |
| Claude Opus 4.6 (max)Claude Opus 4.6 | 46%CTF-Archive-Diamond · Task accuracy | Incomplete | CTF-Archive-Diamond1M weighted tokensInspect ReAct | NIST / CAISICAISI Evaluation of DeepSeek V4 Pro | Release 2026-02-05Report 2026-05-01 |
| Anthropic Opus 4.6Claude Opus 4.6 | 46%CTF-Archive-Diamond · benchmark_score | Incomplete | CTF-Archive-Diamondmax1M weighted tokensInspect built-in ReAct agent | NIST / CAISICAISI Evaluation of DeepSeek V4 Pro | Release 2026-02-05Report 2026-05-01 |
| Claude Opus 4.6 | 45.6%CTF-Archive-Diamond · benchmark_score | Incomplete | CTF-Archive Diamondmax1M weighted tokensInspect built-in ReAct agent | NIST / CAISICAISI Evaluation of DeepSeek V4 Pro | Release 2026-02-05Report 2026-05-01 |
| Claude Opus 4.6 (max)Claude Opus 4.6 | 60%PortBench · Reported task accuracy | Incomplete | PortBench1M weighted tokensInspect ReAct | NIST / CAISICAISI Evaluation of DeepSeek V4 Pro | Release 2026-02-05Report 2026-05-01 |
| Claude Opus 4.6 · METR scaffoldClaude Opus 4.6 | 718.81 minMETR Time Horizons · 50% task-completion horizonSource 95% CI [316.685725, 3633.786163] min | Incomplete | METR-Horizon-v1.1mtb/start_metr_task,metr_agents/react; ai_rd_fix_embedding/init_solver,use_tools,metr_agents/react; re_bench_common/init_solver,use_tools,metr_agents/react; metr_tasks_swaa/init_solver,generate; metr_agents/react | METRMETR Time Horizon 1.1 — source data | Release 2026-02-05Report — |
| Claude Opus 4.6 · METR scaffoldClaude Opus 4.6 | 69.87 minMETR Time Horizons · 80% task-completion horizonSource 95% CI [27.026521, 170.437873] min | Incomplete | METR-Horizon-v1.1mtb/start_metr_task,metr_agents/react; ai_rd_fix_embedding/init_solver,use_tools,metr_agents/react; re_bench_common/init_solver,use_tools,metr_agents/react; metr_tasks_swaa/init_solver,generate; metr_agents/react | METRMETR Time Horizon 1.1 — source data | Release 2026-02-05Report — |
| Claude Opus 4.6 (Results obtained in collaboration with Anthropic.) · Claude CodeClaude Opus 4.6 | 16 countExploitGym · Intended-target successes | Incomplete | v1on_target2h timeoutClaude Code | Not disclosedExploitGym official leaderboard and benchmark page | Release 2026-02-05Report — |
| Opus 4.6Claude Opus 4.6 | 30.8%SEC-bench Pro · Headline success rate | Incomplete | 260617 / overallheadlineHeadline UI: fixed budget; Completed UI: within timeout. Published summary timeout_caps=null; cap labels do not establish equal token or cost budgets.Claude Code | Not disclosedSEC-bench Pro official leaderboard: selected 260617 and historical 260505 | Release 2026-02-05Report — |
| Opus 4.6Claude Opus 4.6 | 72.8%SEC-bench Pro · Completed-mode success rate | Incomplete | 260617 / overallcompletedHeadline UI: fixed budget; Completed UI: within timeout. Published summary timeout_caps=null; cap labels do not establish equal token or cost budgets.Claude Code | Not disclosedSEC-bench Pro official leaderboard: selected 260617 and historical 260505 | Release 2026-02-05Report — |
| Opus 4.6Claude Opus 4.6 | 22.3%SEC-bench Pro · Headline success rate | Incomplete | 260617 / v8headlineHeadline UI: fixed budget; Completed UI: within timeout. Published summary timeout_caps=["1.5h"]; cap labels do not establish equal token or cost budgets.Claude Code | Not disclosedSEC-bench Pro official leaderboard: selected 260617 and historical 260505 | Release 2026-02-05Report — |
| Opus 4.6Claude Opus 4.6 | 61.1%SEC-bench Pro · Completed-mode success rate | Incomplete | 260617 / v8completedHeadline UI: fixed budget; Completed UI: within timeout. Published summary timeout_caps=["1.5h"]; cap labels do not establish equal token or cost budgets.Claude Code | Not disclosedSEC-bench Pro official leaderboard: selected 260617 and historical 260505 | Release 2026-02-05Report — |
| Opus 4.6Claude Opus 4.6 | 27.9%SEC-bench Pro · Headline success rate | Incomplete | 260617 / firefoxheadlineHeadline UI: fixed budget; Completed UI: within timeout. Published summary timeout_caps=["1.5h"]; cap labels do not establish equal token or cost budgets.Claude Code | Not disclosedSEC-bench Pro official leaderboard: selected 260617 and historical 260505 | Release 2026-02-05Report — |
| Opus 4.6Claude Opus 4.6 | 58.1%SEC-bench Pro · Completed-mode success rate | Incomplete | 260617 / firefoxcompletedHeadline UI: fixed budget; Completed UI: within timeout. Published summary timeout_caps=["1.5h"]; cap labels do not establish equal token or cost budgets.Claude Code | Not disclosedSEC-bench Pro official leaderboard: selected 260617 and historical 260505 | Release 2026-02-05Report — |
| Opus 4.6Claude Opus 4.6 | 39.4%SEC-bench Pro · Headline success rate | Incomplete | 260617 / linuxheadlineHeadline UI: fixed budget; Completed UI: within timeout. Published summary timeout_caps=["1.5h"]; cap labels do not establish equal token or cost budgets.Claude Code | Not disclosedSEC-bench Pro official leaderboard: selected 260617 and historical 260505 | Release 2026-02-05Report — |
| Opus 4.6Claude Opus 4.6 | 91.2%SEC-bench Pro · Completed-mode success rate | Incomplete | 260617 / linuxcompletedHeadline UI: fixed budget; Completed UI: within timeout. Published summary timeout_caps=["1.5h"]; cap labels do not establish equal token or cost budgets.Claude Code | Not disclosedSEC-bench Pro official leaderboard: selected 260617 and historical 260505 | Release 2026-02-05Report — |
| Claude Opus 4.6 | 2.9%ImpossibleBench · Cheating rate (pass@1 on impossible variants) | Incomplete | Impossible-LiveCodeBench split with toolsCheating rate (pass@1 on impossible variants)— | MetaEvaluating Kimi K3 for Misalignment Risks | Release 2026-02-05Report 2026-09-11 |
| Claude Opus 4.6 | -2.8 percentage pointsAlignment faking · Compliance gap | Incomplete | Alignment Faking paid/free-tier contextsCompliance gap— | MetaEvaluating Kimi K3 for Misalignment Risks | Release 2026-02-05Report 2026-09-11 |
| Claude Opus 4.6 | 0%Alignment faking · Deceptive alignment rate | Incomplete | Alignment FakingDeceptive alignment rate— | MetaEvaluating Kimi K3 for Misalignment Risks | Release 2026-02-05Report 2026-09-11 |
| Claude Opus 4.6 | -2.8 percentage pointsAlignment faking · Compliance gap | Incomplete | Alignment FakingCompliance gap— | MetaEvaluating DeepSeek v4 Pro for Frontier Risks | Release 2026-02-05Report 2026-05-29 |
| Claude Opus 4.6 | 0%Alignment faking · Deceptive alignment rate | Incomplete | Alignment FakingDeceptive alignment rate— | MetaEvaluating DeepSeek v4 Pro for Frontier Risks | Release 2026-02-05Report 2026-05-29 |
Developer disclosures
Claude Opus 4.6 System Card →
Developer documentation covering Claude Opus 4.6.
2026-02-06 · Updated 2026-03-06External assessments
Neo Research
Evaluating Kimi K3 for Misalignment Risks →
The report identifies conditional overeagerness, grader-directed behavior and recognition of familiar evaluations. It does not establish a universal deployment failure rate.
2026-09-11Neo Research
Evaluating DeepSeek v4 Pro for Frontier Risks →
The report separates task capability from pressure-induced behavior and notes format dependence in persuasion assessment.
2026-05-29Neo Research
Early Results on Evaluating GLM 5.2 for Behavioral and Persuasion Risks →
The note reports scenario-dependent behavior and an uncertain decline in verbalized evaluation awareness; silence is not evidence of absent awareness.
2026-07-03SaferAI
GLM-5.2 Risk Evaluation Report →
The report finds substantial task capability and pressure-dependent behavior; comparison figures include both SaferAI runs and reused external results.
2026-08-02NIST / CAISI
CAISI Evaluation of DeepSeek V4 Pro →
The assessment reports benchmark-specific performance and an IRT aggregate; the latter is not a frontier-risk score.
2026-05-01METR
METR Time Horizon 1.1 →
Estimated task difficulty at 50% and 80% success, measured in human-expert minutes.
Publication date not establishedCyberGym official snapshot →
Published evaluation results collected from CyberGym, retaining the reported systems and configurations.
Publication date not establishedExploitGym official snapshot →
Published evaluation results collected from ExploitGym, retaining the reported systems and configurations.
Publication date not establishedSEC-bench Pro official snapshot →
Published evaluation results collected from SEC-bench Pro, retaining the reported systems and configurations.
Publication date not establishedLyptus Research
Offensive Cybersecurity Time Horizons →
Original task-horizon report and aggregate runs clarify CyberGym task subsets, configurations and retry overlays.
2026-04-02Lyptus Research
GPT-5.5 Saturates Our Offensive Cybersecurity Time Horizons →
Original task-horizon report and aggregate runs clarify CyberGym task subsets, configurations and retry overlays.
2026-05-27Evidence by risk topic
Autonomy 3 protocol results
PortBench →
External evaluation · Executed by NIST / CAISI
- Reported task accuracy
- 60%
Non-public CAISI task set; report describes continuous scoring.
METR Time Horizon 1.1 →
External evaluation · Executed by METR
- 50% task-completion horizon
- 718.81 min
- 80% task-completion horizon
- 69.87 min
Task counts/weights vary with source tasks and scaffold coverage; see methodology.
Agentic Misalignment →
Reused result · Executed by Meta · Original executor Meta
- deliberate harmful action rate
- 0%
Per-result sample size not disclosed
Deception 15 protocol results
ImpossibleBench →
Reused result · Executed by Meta · Original executor Meta
- Cheating rate (pass@1 on impossible variants)
- 2.9%
Per-result sample size not disclosed
Alignment faking →
Reused result · Executed by Meta · Original executor Meta
- Compliance gap
- -2.8 percentage points
Per-result sample size not disclosed
Alignment faking →
Reused result · Executed by Meta · Original executor Meta
- Deceptive alignment rate
- 0%
Per-result sample size not disclosed
GDM Stealth evaluations →
Reused result · Executed by Meta · Original executor Meta
- Mean challenge success rate
- 43.1%
Per-result sample size not disclosed
GDM Stealth evaluations →
Reused result · Executed by Meta · Original executor Meta
- Stealth task score
- 13%
Per-result sample size not disclosed
GDM Stealth evaluations →
Reused result · Executed by Meta · Original executor Meta
- Stealth task score
- 0%
Per-result sample size not disclosed
GDM Stealth evaluations →
Reused result · Executed by Meta · Original executor Meta
- Stealth task score
- 14%
Per-result sample size not disclosed
GDM Stealth evaluations →
Reused result · Executed by Meta · Original executor Meta
- Stealth task score
- 46%
Per-result sample size not disclosed
DeceptionBench →
Reused result · Executed by Meta · Original executor Meta
- deception score: single-turn
- 0.3%
Per-result sample size not disclosed
DeceptionBench →
Reused result · Executed by Meta · Original executor Meta
- deception score: multi-turn w pressure
- 0.8%
Per-result sample size not disclosed
Alignment faking →
Reused result · Executed by Meta · Original executor Meta
- Compliance gap
- -2.8 percentage points
Per-result sample size not disclosed
Alignment faking →
Reused result · Executed by Meta · Original executor Meta
- Deceptive alignment rate
- 0%
Per-result sample size not disclosed
Agentic Misalignment →
Reused result · Executed by Meta · Original executor Meta
- deliberate harmful action rate
- 0%
Per-result sample size not disclosed
DeceptionBench →
Reused result · Executed by Meta · Original executor Meta
- DeceptionBench deception score
- 0.3%
Per-result sample size not disclosed
DeceptionBench →
Reused result · Executed by Meta · Original executor Meta
- DeceptionBench deception score
- 0.8%
Per-result sample size not disclosed
Cybersecurity 16 protocol results
CTF-Archive-Diamond →
External evaluation · Executed by NIST / CAISI
- Task accuracy
- 46%
285 difficult CTF tasks; DeepSeek score is imputed from a subset.
CyberGym · level1 · score_10 →
External evaluation · Executed by
- Success rate
- 91%
Per-result sample size not disclosed
CyberGym · level1 · score_10 →
External evaluation · Executed by
- Success rate
- 89.6%
Per-result sample size not disclosed
CyberGym · level1 · score_10 →
External evaluation · Executed by
- Success rate
- 66.6%
Per-result sample size not disclosed
ExploitGym · v1 · on_target →
External evaluation · Executed by
- Intended-target successes
- 16 count
Per-result sample size not disclosed
SEC-bench Pro · 260617 / overall · headline →
External evaluation · Executed by
- Headline success rate
- 30.8%
106/344
SEC-bench Pro · 260617 / overall · completed →
External evaluation · Executed by
- Completed-mode success rate
- 72.8%
99/136
SEC-bench Pro · 260617 / v8 · headline →
External evaluation · Executed by
- Headline success rate
- 22.3%
23/103
SEC-bench Pro · 260617 / v8 · completed →
External evaluation · Executed by
- Completed-mode success rate
- 61.1%
22/36
SEC-bench Pro · 260617 / firefox · headline →
External evaluation · Executed by
- Headline success rate
- 27.9%
29/104
SEC-bench Pro · 260617 / firefox · completed →
External evaluation · Executed by
- Completed-mode success rate
- 58.1%
25/43
SEC-bench Pro · 260617 / linux · headline →
External evaluation · Executed by
- Headline success rate
- 39.4%
54/137
SEC-bench Pro · 260617 / linux · completed →
External evaluation · Executed by
- Completed-mode success rate
- 91.2%
52/57
CyberGym hard subset with token budgets →
Reused result · Executed by Lyptus Research · Original executor Lyptus Research
- CyberGym pass@1
- 44.55%
45/101
CTF-Archive-Diamond →
External evaluation · Executed by NIST / CAISI
- benchmark_score
- 46%
Per-result sample size not disclosed
CTF-Archive-Diamond →
External evaluation · Executed by NIST / CAISI
- benchmark_score
- 45.6%
Per-result sample size not disclosed
CBRN 1 protocol results
WMDP →
Reused result · Executed by Meta · Original executor Meta
- accuracy
- 90.1%
Per-result sample size not disclosed
Disinformation No structured result linked
A gap in this collection is not evidence of low risk. Consult the linked reports for unextracted findings and protocol scope.
Autonomous physical harm No structured result linked
A gap in this collection is not evidence of low risk. Consult the linked reports for unextracted findings and protocol scope.
Source review and evidence gaps
CyberGym →
Published evaluation results collected from CyberGym, retaining the reported systems and configurations.
The site reports submitted systems under different configurations. Per-row task counts, budgets and execution dates are not fully disclosed. Undefined metrics and unresolved identity rows are excluded. Raw JSON fractions are shown as percentages using ×100 and one-decimal rounding, matching the official renderer.
ExploitGym →
Published evaluation results collected from ExploitGym, retaining the reported systems and configurations.
Intended-target success and flag capture are distinct counts. Task versions and timeout cutoffs remain separate. Catalogue size is not assumed to be the denominator for each submission.
SEC-bench Pro →
Published evaluation results collected from SEC-bench Pro, retaining the reported systems and configurations.
Headline and Completed apply different inclusion rules and may change both numerator and denominator. Provider and backend labels do not identify the actual evaluator.
Evaluating Kimi K3 for Misalignment Risks →
Source-specific extraction of Neo Research · Kimi K3. Findings and measurements retain their original attribution.
Source transcription is not experimental replication. Unknown dates, evaluator roles and configuration details remain unknown. Source groups are not verified rankings.
Evaluating DeepSeek v4 Pro for Frontier Risks →
Source-specific extraction of Neo Research · DeepSeek V4 Pro. Findings and measurements retain their original attribution.
Source transcription is not experimental replication. Unknown dates, evaluator roles and configuration details remain unknown. Source groups are not verified rankings.
Early Results on Evaluating GLM 5.2 for Behavioral and Persuasion Risks →
Source-specific extraction of Neo Research · GLM-5.2. Findings and measurements retain their original attribution.
Source transcription is not experimental replication. Unknown dates, evaluator roles and configuration details remain unknown. Source groups are not verified rankings.
GLM-5.2 Risk Evaluation Report, Version 1.1 →
Source-specific extraction of SaferAI · GLM-5.2. Findings and measurements retain their original attribution.
Source transcription is not experimental replication. Unknown dates, evaluator roles and configuration details remain unknown. Source groups are not verified rankings.
CAISI Evaluation of DeepSeek V4 Pro →
Source-specific extraction of CAISI · DeepSeek V4 Pro. Findings and measurements retain their original attribution.
Source transcription is not experimental replication. Unknown dates, evaluator roles and configuration details remain unknown. Source groups are not verified rankings.
Missing scores may reflect unextracted sections, undisclosed configurations, unresolved identity or an absent experiment. These are separate research questions; none implies a zero result.
Interpretation and open questions
Differences between reports can reflect task selection, model endpoints, prompts, budgets, judges and publication dates. Evidence is grouped by the protocol actually used; no model-wide safety grade is inferred.
References
- [1] Claude Opus 4.6 — Anthropic ; Publication date and availability section; Official launch article; parameter counts not disclosed
- [2] METR Time Horizon 1.1 — source data ; results.claude_opus_4_6_inspect
- [3] Evaluating Kimi K3 for Misalignment Risks. 2026-09-11. September 2026 ; §2.3 Figure 17 p.27; §3.1 Figure 20 p.32; §3.1 p.32
- [4] Evaluating DeepSeek v4 Pro for Frontier Risks. 2026-05-29. v1.1 · 29 May 2026 ; PDF p. 9; WMDP-Cyber; accuracy; PDF p. 27; DeceptionBench; deception score: single-turn; PDF p. 27; DeceptionBench; deception score: multi-turn w pressure
- [5] Early Results on Evaluating GLM 5.2 for Behavioral and Persuasion Risks. 2026-07-03. 3 July 2026 ; #behavioral; Figure 2 / deceptionbench.png; printed label Claude Opus 4.6 / single-turn; #behavioral; Figure 2 / deceptionbench.png; printed label Claude Opus 4.6 / multi-turn with pressure
- [6] GLM-5.2 Risk Evaluation Report. 2026-08-02. v1.1 · revised 26 August 2026 ; p.8 Fig.3 printed bar label
- [7] CAISI Evaluation of DeepSeek V4 Pro. 2026-05-01. 1 May 2026 ; Capability Results; Figure 2; *** footnote; Capability Results; Figure 2; Figure 2 HTML table, CTF-Archive-Diamond, Anthropic Opus 4.6 (max)
- [8] Claude Opus 4.6 System Card. 2026-02-06. 2026-03-06
- [9] Claude Opus 4.6 Sabotage Risk Report. 2026-02-10
- [10] CyberGym official leaderboard and machine-data extraction ; /level1/25/score_10; /level1/47/score_10; /level1/60/score_10
- [11] ExploitGym official leaderboard and benchmark page ; /results/5/on_target
- [12] SEC-bench Pro official leaderboard: selected 260617 and historical 260505 ; /0/results/2/score_modes/headline/score; /0/results/2/score_modes/completed/score; /1/results/2/score_modes/headline/score
- [13] Jack Payne, Jeremy Miller, et al.. Offensive Cybersecurity Time Horizons. 2026-04-02
- [14] Jack Payne, Sean Peters. GPT-5.5 Saturates Our Offensive Cybersecurity Time Horizons. 2026-05-27