WhitzardNUWA Lab ↗
NUWANUWA INDEX

Search NUWA Index

Research · Benchmarks · Findings · Perspectives

中文
← Models

OpenAI

GPT-5.5

Published evidence on capabilities, behavioral tendencies and observed actions.

First public availability
2026-04-23
Parameters
Not disclosed
Metadata updated
2026-10-27
  • · Public release
  • · API availability

The assessment records 2026-04-24. It is retained as a source-reported date, separate from the independently maintained release metadata.

Sources ↓

Evidence overview

Published risk evidence is organized by assessment and protocol. Missing evidence is not a low-risk finding.

NUWA curates and interprets these sources. Experiments are attributed to their original executors; this page does not claim NUWA has independently replicated them.

MODEL MONITORING

Representative benchmark coverage

Results by protocol and configuration; gaps show records awaiting collection or linkage.

CyberGym →

3 measurements

  • 55.45%Lyptus Research · Harness not disclosed
  • 81.8%Not disclosed · OpenAI Agent
  • 88.12%Lyptus Research · Harness not disclosed

Attempt to Persuade Eval (APE) →

2 measurements

  • 18%SaferAI · APE simulated persuadee; automated attempt evaluator; StrongREJECT refusal classifier
  • 22%SaferAI · APE simulated persuadee; automated attempt evaluator; StrongREJECT refusal classifier

All linked measurements

Each result retains its protocol and unit.

72 observations

Measurements and source conditions
System / modelResultCondition statusTask / conditionsEvaluator / reportDates
GPT-5.555.45%CyberGym · CyberGym pass@1IncompleteCyberGym Level 1 hard-task matched subsetCyberGym pass@12M tokens per task—Lyptus ResearchGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.5 · OpenAI AgentGPT-5.581.8%CyberGym · Success rateIncompletelevel1score_10OpenAI AgentNot disclosedCyberGym official leaderboard and machine-data extractionRelease 2026-04-23Report —
GPT-5.588.12%CyberGym · CyberGym pass@1IncompleteCyberGym Level 1 hard-task matched subsetCyberGym pass@150M tokens per task—Lyptus ResearchGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.5 / Codex 0.133.0GPT-5.518.97%AgentCyberRange · Success rate (Pass@3)IncompleteWeb exploitationlevel0CodexNot disclosedAgentCyberRange: Evaluate Agent Cyberattack Capabilities in Enterprise-like Cyber RangesRelease 2026-04-23Report —
GPT-5.5 / Codex 0.147.0GPT-5.526.67%AgentCyberRange · Success rate (Pass@3)IncompleteWeb exploitationlevel0CodexNot disclosedAgentCyberRange: Evaluate Agent Cyberattack Capabilities in Enterprise-like Cyber RangesRelease 2026-04-23Report —
GPT-5.5 / Codex 0.133.0GPT-5.531.71%AgentCyberRange · Success rate (Pass@3)IncompletePost exploitationlevel0CodexNot disclosedAgentCyberRange: Evaluate Agent Cyberattack Capabilities in Enterprise-like Cyber RangesRelease 2026-04-23Report —
GPT-5.5 / Codex 0.147.0GPT-5.542.07%AgentCyberRange · Success rate (Pass@3)IncompletePost exploitationlevel0CodexNot disclosedAgentCyberRange: Evaluate Agent Cyberattack Capabilities in Enterprise-like Cyber RangesRelease 2026-04-23Report —
GPT-5.591.18%Cybench · Cybench pass@1IncompleteCybench 34/40 task subsetCybench pass@120M total tokens; 100000 output/generationInspect EvalsSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.593.33%Cybench · Cybench category pass@1IncompleteCybench CryptographyCybench category pass@1Inspect EvalsSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.583.33%Cybench · Cybench category pass@1IncompleteCybench WebCybench category pass@1Inspect EvalsSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.5100%Cybench · Cybench category pass@1IncompleteCybench PwnCybench category pass@1Inspect EvalsSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.5100%Cybench · Cybench category pass@1IncompleteCybench Reverse Eng.Cybench category pass@1Inspect EvalsSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.5100%Cybench · Cybench category pass@1IncompleteCybench ForensicsCybench category pass@1Inspect EvalsSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.550%Cybench · Cybench category pass@1IncompleteCybench MiscCybench category pass@1Inspect EvalsSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.565.3%MASK · Continuations honesty95% Wilson CI [58.1, 72.0] (as reported)IncompleteMASK by archetype—Center for AI SafetyGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.569.6%MASK · Disinformation honesty95% Wilson CI [61.1, 77.0] (as reported)IncompleteMASK by archetype—Center for AI SafetyGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.563.3%MASK · Doubling-down honesty95% Wilson CI [54.4, 71.4] (as reported)IncompleteMASK by archetype—Center for AI SafetyGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.577%MASK · Known-facts honesty95% Wilson CI [70.9, 82.2] (as reported)IncompleteMASK by archetype—Center for AI SafetyGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.575.2%MASK · Provided-facts honesty95% Wilson CI [69.7, 79.9] (as reported)IncompleteMASK by archetype—Center for AI SafetyGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.587.5%MASK · Statistics honesty95% Wilson CI [79.4, 92.7] (as reported)IncompleteMASK by archetype—Center for AI SafetyGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.50%Agentic misalignment · Harmful actions[0–11]IncompleteAgentic Misalignment Blackmail scenariohighexplicit goal · ReplacementInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.50%Agentic misalignment · Harmful actions[0–11]IncompleteAgentic Misalignment Blackmail scenariohighexplicit goal · RestrictionInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.50%Agentic misalignment · Harmful actions[0–11]IncompleteAgentic Misalignment Blackmail scenariohighexplicit goal · No threatInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.50%Agentic misalignment · Harmful actions[0–11]IncompleteAgentic Misalignment Blackmail scenariohighlatent goal · ReplacementInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.50%Agentic misalignment · Harmful actions[0–11]IncompleteAgentic Misalignment Blackmail scenariohighlatent goal · RestrictionInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.50%Agentic misalignment · Harmful actions[0–11]IncompleteAgentic Misalignment Blackmail scenariohighlatent goal · No threatInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.50%Agentic misalignment · Harmful actions[0–11]IncompleteAgentic Misalignment Blackmail scenariohighambiguous goal · ReplacementInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.50%Agentic misalignment · Harmful actions[0–11]IncompleteAgentic Misalignment Blackmail scenariohighambiguous goal · RestrictionInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.50%Agentic misalignment · Harmful actions[0–11]IncompleteAgentic Misalignment Blackmail scenariohighambiguous goal · No threatInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.50%Agentic misalignment · Harmful actions[0–11]IncompleteAgentic Misalignment Blackmail scenariohighno goal · ReplacementInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.50%Agentic misalignment · Harmful actions[0–11]IncompleteAgentic Misalignment Blackmail scenariohighno goal · RestrictionInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.50%Agentic misalignment · Harmful actions[0–11]IncompleteAgentic Misalignment Blackmail scenariohighno goal · No threatInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.50%Agentic misalignment · Harmful actions[0–11]IncompleteAgentic Misalignment Leaking scenariohighexplicit goal · ReplacementInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.50%Agentic misalignment · Harmful actions[0–11]IncompleteAgentic Misalignment Leaking scenariohighexplicit goal · RestrictionInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.50%Agentic misalignment · Harmful actions[0–11]IncompleteAgentic Misalignment Leaking scenariohighexplicit goal · No threatInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.50%Agentic misalignment · Harmful actions[0–11]IncompleteAgentic Misalignment Leaking scenariohighlatent goal · ReplacementInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.50%Agentic misalignment · Harmful actions[0–11]IncompleteAgentic Misalignment Leaking scenariohighlatent goal · RestrictionInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.50%Agentic misalignment · Harmful actions[0–11]IncompleteAgentic Misalignment Leaking scenariohighlatent goal · No threatInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.50%Agentic misalignment · Harmful actions[0–11]IncompleteAgentic Misalignment Leaking scenariohighambiguous goal · ReplacementInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.50%Agentic misalignment · Harmful actions[0–11]IncompleteAgentic Misalignment Leaking scenariohighambiguous goal · RestrictionInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.50%Agentic misalignment · Harmful actions[0–11]IncompleteAgentic Misalignment Leaking scenariohighambiguous goal · No threatInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.50%Agentic misalignment · Harmful actions[0–11]IncompleteAgentic Misalignment Leaking scenariohighno goal · ReplacementInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.50%Agentic misalignment · Harmful actions[0–11]IncompleteAgentic Misalignment Leaking scenariohighno goal · RestrictionInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.50%Agentic misalignment · Harmful actions[0–11]IncompleteAgentic Misalignment Leaking scenariohighno goal · No threatInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.50%Agentic misalignment · Harmful actions[0–11]IncompleteAgentic Misalignment Murder scenariohighexplicit goal · ReplacementInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.50%Agentic misalignment · Harmful actions[0–11]IncompleteAgentic Misalignment Murder scenariohighexplicit goal · RestrictionInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.50%Agentic misalignment · Harmful actions[0–11]IncompleteAgentic Misalignment Murder scenariohighexplicit goal · No threatInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.50%Agentic misalignment · Harmful actions[0–11]IncompleteAgentic Misalignment Murder scenariohighlatent goal · ReplacementInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.50%Agentic misalignment · Harmful actions[0–11]IncompleteAgentic Misalignment Murder scenariohighlatent goal · RestrictionInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.50%Agentic misalignment · Harmful actions[0–11]IncompleteAgentic Misalignment Murder scenariohighlatent goal · No threatInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.50%Agentic misalignment · Harmful actions[0–11]IncompleteAgentic Misalignment Murder scenariohighambiguous goal · ReplacementInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.50%Agentic misalignment · Harmful actions[0–11]IncompleteAgentic Misalignment Murder scenariohighambiguous goal · RestrictionInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.50%Agentic misalignment · Harmful actions[0–11]IncompleteAgentic Misalignment Murder scenariohighambiguous goal · No threatInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.50%Agentic misalignment · Harmful actions[0–11]IncompleteAgentic Misalignment Murder scenariohighno goal · ReplacementInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.50%Agentic misalignment · Harmful actions[0–11]IncompleteAgentic Misalignment Murder scenariohighno goal · RestrictionInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.50%Agentic misalignment · Harmful actions[0–11]IncompleteAgentic Misalignment Murder scenariohighno goal · No threatInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.510%Agentic misalignment · Agentic Misalignment verbalized evaluation awarenessIncompleteAgentic Misalignment evaluationAgentic Misalignment verbalized evaluation awareness—SaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.5 (xhigh)GPT-5.571%CTF-Archive-Diamond · Task accuracyIncompleteCTF-Archive-Diamond1M weighted tokensInspect ReActNIST / CAISICAISI Evaluation of DeepSeek V4 ProRelease 2026-04-23Report 2026-05-01
OpenAI GPT-5.5GPT-5.571%CTF-Archive-Diamond · benchmark_scoreIncompleteCTF-Archive-Diamondxhigh1M weighted tokensInspect built-in ReAct agentNIST / CAISICAISI Evaluation of DeepSeek V4 ProRelease 2026-04-23Report 2026-05-01
GPT-5.5 (xhigh)GPT-5.578%PortBench · Reported task accuracyIncompletePortBench1M weighted tokensInspect ReActNIST / CAISICAISI Evaluation of DeepSeek V4 ProRelease 2026-04-23Report 2026-05-01
GPT-5.5 (OpenAI's default safety filters block all GPT-5.5 exploit attempts under default prompting.) · Codex CLIGPT-5.5129 countExploitGym · Intended-target successesIncompletev1on_target2h timeoutCodex CLINot disclosedExploitGym official leaderboard and benchmark pageRelease 2026-04-23Report —
GPT-5.5 (OpenAI's default safety filters block all GPT-5.5 exploit attempts under default prompting.) · Codex CLIGPT-5.5208 countExploitGym · Flag capturesIncompletev1flag_captured2h timeoutCodex CLINot disclosedExploitGym official leaderboard and benchmark pageRelease 2026-04-23Report —
GPT-5.558.4%SEC-bench Pro · Headline success rateIncomplete260617 / overallheadlineHeadline UI: fixed budget; Completed UI: within timeout. Published summary timeout_caps=null; cap labels do not establish equal token or cost budgets.CodexNot disclosedSEC-bench Pro official leaderboard: selected 260617 and historical 260505Release 2026-04-23Report —
GPT-5.560.3%SEC-bench Pro · Completed-mode success rateIncomplete260617 / overallcompletedHeadline UI: fixed budget; Completed UI: within timeout. Published summary timeout_caps=null; cap labels do not establish equal token or cost budgets.CodexNot disclosedSEC-bench Pro official leaderboard: selected 260617 and historical 260505Release 2026-04-23Report —
GPT-5.547.6%SEC-bench Pro · Headline success rateIncomplete260617 / v8headlineHeadline UI: fixed budget; Completed UI: within timeout. Published summary timeout_caps=["1.5h"]; cap labels do not establish equal token or cost budgets.CodexNot disclosedSEC-bench Pro official leaderboard: selected 260617 and historical 260505Release 2026-04-23Report —
GPT-5.548%SEC-bench Pro · Completed-mode success rateIncomplete260617 / v8completedHeadline UI: fixed budget; Completed UI: within timeout. Published summary timeout_caps=["1.5h"]; cap labels do not establish equal token or cost budgets.CodexNot disclosedSEC-bench Pro official leaderboard: selected 260617 and historical 260505Release 2026-04-23Report —
GPT-5.544.2%SEC-bench Pro · Headline success rateIncomplete260617 / firefoxheadlineHeadline UI: fixed budget; Completed UI: within timeout. Published summary timeout_caps=["1.5h"]; cap labels do not establish equal token or cost budgets.CodexNot disclosedSEC-bench Pro official leaderboard: selected 260617 and historical 260505Release 2026-04-23Report —
GPT-5.544.7%SEC-bench Pro · Completed-mode success rateIncomplete260617 / firefoxcompletedHeadline UI: fixed budget; Completed UI: within timeout. Published summary timeout_caps=["1.5h"]; cap labels do not establish equal token or cost budgets.CodexNot disclosedSEC-bench Pro official leaderboard: selected 260617 and historical 260505Release 2026-04-23Report —
GPT-5.577.4%SEC-bench Pro · Headline success rateIncomplete260617 / linuxheadlineHeadline UI: fixed budget; Completed UI: within timeout. Published summary timeout_caps=["1.5h"]; cap labels do not establish equal token or cost budgets.CodexNot disclosedSEC-bench Pro official leaderboard: selected 260617 and historical 260505Release 2026-04-23Report —
GPT-5.583.2%SEC-bench Pro · Completed-mode success rateIncomplete260617 / linuxcompletedHeadline UI: fixed budget; Completed UI: within timeout. Published summary timeout_caps=["1.5h"]; cap labels do not establish equal token or cost budgets.CodexNot disclosedSEC-bench Pro official leaderboard: selected 260617 and historical 260505Release 2026-04-23Report —
GPT-5.518%Attempt to Persuade Eval (APE) · APE Turn-1 persuasion-attempt rateIncompleteAPE Conspiracy (main persuade condition)highAPE simulated persuadee; automated attempt evaluator; StrongREJECT refusal classifierSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.522%Attempt to Persuade Eval (APE) · APE Turn-1 persuasion-attempt rateIncompleteAPE Undermining control (main persuade condition)highAPE simulated persuadee; automated attempt evaluator; StrongREJECT refusal classifierSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02

Developer disclosures

External assessments

SaferAI

GLM-5.2 Risk Evaluation Report →

The report finds substantial task capability and pressure-dependent behavior; comparison figures include both SaferAI runs and reused external results.

2026-08-02

CyberGym official snapshot →

Published evaluation results collected from CyberGym, retaining the reported systems and configurations.

Publication date not established

ExploitGym official snapshot →

Published evaluation results collected from ExploitGym, retaining the reported systems and configurations.

Publication date not established

SEC-bench Pro official snapshot →

Published evaluation results collected from SEC-bench Pro, retaining the reported systems and configurations.

Publication date not established

Evidence by risk topic

Autonomy 38 protocol results

PortBench →

External evaluation · Executed by NIST / CAISI

Reported task accuracy
78%

Non-public CAISI task set; report describes continuous scoring.

Deception 38 protocol results

MASK by archetype →

Reused result · Executed by Center for AI Safety · Original executor Center for AI Safety

Continuations honesty
65.3%
Disinformation honesty
69.6%
Doubling-down honesty
63.3%
Known-facts honesty
77.0%
Provided-facts honesty
75.2%
Statistics honesty
87.5%

Per-archetype scored prompts: 176 / 125 / 120 / 209 / 274 / 96. Some supplied CI cells are inconsistent with displayed n; reproduced as reported, not recalculated.

Cybersecurity 26 protocol results

CTF-Archive-Diamond →

External evaluation · Executed by NIST / CAISI

Task accuracy
71%

285 difficult CTF tasks; DeepSeek score is imputed from a subset.

Cybench →

External evaluation · Executed by SaferAI

Cybench pass@1
91.18%

31/34

Cybench →

External evaluation · Executed by SaferAI

Cybench category pass@1
93.33%

14/15

Cybench →

External evaluation · Executed by SaferAI

Cybench category pass@1
83.33%

5/6

Cybench →

External evaluation · Executed by SaferAI

Cybench category pass@1
100%

2/2

Cybench →

External evaluation · Executed by SaferAI

Cybench category pass@1
100%

5/5

Cybench →

External evaluation · Executed by SaferAI

Cybench category pass@1
100%

4/4

Cybench →

External evaluation · Executed by SaferAI

Cybench category pass@1
50%

1/2

CTF-Archive-Diamond →

External evaluation · Executed by NIST / CAISI

benchmark_score
71%

Per-result sample size not disclosed

CBRN No structured result linked

A gap in this collection is not evidence of low risk. Consult the linked reports for unextracted findings and protocol scope.

Disinformation 2 protocol results

APE Turn-1 attempts →

External evaluation · Executed by SaferAI

APE Turn-1 persuasion-attempt rate
18%

Source denominator: 100 (unit not disclosed)

APE Turn-1 attempts →

External evaluation · Executed by SaferAI

APE Turn-1 persuasion-attempt rate
22%

Source denominator: 100 (unit not disclosed)

Autonomous physical harm No structured result linked

A gap in this collection is not evidence of low risk. Consult the linked reports for unextracted findings and protocol scope.

Source review and evidence gaps

CyberGym →

Published evaluation results collected from CyberGym, retaining the reported systems and configurations.

The site reports submitted systems under different configurations. Per-row task counts, budgets and execution dates are not fully disclosed. Undefined metrics and unresolved identity rows are excluded. Raw JSON fractions are shown as percentages using ×100 and one-decimal rounding, matching the official renderer.

ExploitGym →

Published evaluation results collected from ExploitGym, retaining the reported systems and configurations.

Intended-target success and flag capture are distinct counts. Task versions and timeout cutoffs remain separate. Catalogue size is not assumed to be the denominator for each submission.

SEC-bench Pro →

Published evaluation results collected from SEC-bench Pro, retaining the reported systems and configurations.

Headline and Completed apply different inclusion rules and may change both numerator and denominator. Provider and backend labels do not identify the actual evaluator.

AgentCyberRange →

Published evaluation results collected from AgentCyberRange, retaining the reported systems and configurations.

Web exploitation and post-exploitation are separate evaluations. Pass@3 retains the site’s definition; row-specific budgets, sample counts and execution dates are not disclosed.

GLM-5.2 Risk Evaluation Report, Version 1.1 →

Source-specific extraction of SaferAI · GLM-5.2. Findings and measurements retain their original attribution.

Source transcription is not experimental replication. Unknown dates, evaluator roles and configuration details remain unknown. Source groups are not verified rankings.

CAISI Evaluation of DeepSeek V4 Pro →

Source-specific extraction of CAISI · DeepSeek V4 Pro. Findings and measurements retain their original attribution.

Source transcription is not experimental replication. Unknown dates, evaluator roles and configuration details remain unknown. Source groups are not verified rankings.

Missing scores may reflect unextracted sections, undisclosed configurations, unresolved identity or an absent experiment. These are separate research questions; none implies a zero result.

Interpretation and open questions

Differences between reports can reflect task selection, model endpoints, prompts, budgets, judges and publication dates. Evidence is grouped by the protocol actually used; no model-wide safety grade is inferred.

References

  1. [1] OpenAI — introducing gpt 5 5 ; Publication date and availability section; Parameter counts not disclosed in launch article
  2. [2] GLM-5.2 Risk Evaluation Report. 2026-08-02. v1.1 · revised 26 August 2026 ; Appendix A.7; Table A.3, pp. 41–42; p.6 Fig.1; p.6 Fig.2 printed bar label
  3. [3] CAISI Evaluation of DeepSeek V4 Pro. 2026-05-01. 1 May 2026 ; Capability Results; Figure 2; *** footnote; Capability Results; Figure 2; Figure 2 HTML table, CTF-Archive-Diamond, OpenAI GPT-5.5 (xhigh)
  4. [4] GPT-5.5 System Card. 2026-04-23
  5. [5] CyberGym official leaderboard and machine-data extraction ; /level1/51/score_10
  6. [6] ExploitGym official leaderboard and benchmark page ; /results/3/on_target; /results/3/flag_captured
  7. [7] SEC-bench Pro official leaderboard: selected 260617 and historical 260505 ; /0/results/0/score_modes/headline/score; /0/results/0/score_modes/completed/score; /1/results/0/score_modes/headline/score
  8. [8] AgentCyberRange: Evaluate Agent Cyberattack Capabilities in Enterprise-like Cyber Ranges ; routes-B-0Mubrq.js::QR/1/level0/pass3; routes-B-0Mubrq.js::QR/2/level0/pass3; routes-B-0Mubrq.js::$R/1/level0/pass3
  9. [9] Jack Payne, Sean Peters. GPT-5.5 Saturates Our Offensive Cybersecurity Time Horizons. 2026-05-27