Cybench
Integrity rank #44 of 65 · 19 models scored · top score 93 · Claude Opus 4.6
Cybersecurity reasoning on agentic capture-the-flag tasks modeled after real-world CTF competitions.
Strongest on discrimination, weakest on contamination resistance. Caveat: scores come from an inconsistent mix of harnesses, so head-to-head comparisons are not apples-to-apples.
Reported scores — protocols may differ. How we compare
| # | Model | Score | Evidence | Measured |
|---|---|---|---|---|
| 1 | Claude Opus 4.6 | 93 | self-reported· optimizedT1 | 2026-02-05 |
| 2 | Claude Opus 4.5 | 82 | self-reported· optimizedT1 | 2025-11-24 |
| 3 | Claude Sonnet 4.5 | 60 | self-reported· optimizedT1 | 2025-09-29 |
| 4 | Grok 4 | 43 | self-reported· optimizedT1 | 2025-07-09 |
| 5 | Claude Opus 4.1 | 42 | unverified· optimizedT1 | 2025-08-05 |
| 6 | Claude Opus 4 | 38 | unverified· optimizedT1 | 2025-05-22 |
| 7 | Claude Sonnet 4 | 35 | unverified· optimizedT1 | 2025-05-22 |
| 8 | Grok 4 Fast | 30 | self-reported· optimizedT1 | 2025-09-19 |
| 9 | o3-mini | 22.5 | unverified· optimizedT1 | 2025-01-31 |
| 10 | Claude 3.7 Sonnet | 20 | unverified· optimizedT1 | 2025-02-24 |
| 11 | Claude 3.5 Sonnet | 17.5 | unverified· optimizedT1 | 2024-06-20 |
| 12 | GPT-4.5 | 17.5 | unverified· optimizedT1 | 2025-02-27 |
| 13 | GPT-4o (Nov 2024) | 12.5 | unverified· optimizedT1 | 2024-11-20 |
| 14 | o1-mini | 10 | unverified· optimizedT1 | 2024-09-12 |
| 15 | o1-preview | 10 | unverified· optimizedT1 | 2024-09-12 |
| 16 | Claude 3 Opus | 10 | unverified· optimizedT1 | 2024-02-29 |
| 17 | Llama 3.1-405B | 7.5 | unverified· optimizedT1 | 2024-07-23 |
| 18 | Mixtral 8x22B | 7.5 | unverified· optimizedT1 | 2024-04-17 |
| 19 | Llama 3-70B | 5 | unverified· optimizedT1 | 2024-04-18 |
Continue from this leaderboard into the tightest head-to-head reads.
Weighted composite. Each dimension opens to the source-backed sub-signals it is computed from.
Claims drawn from cited facts, not live model generation.
This benchmark reports scores for 19 models, with a spread of 88.0 points between the best and worst performers. That wide spread indicates the models are well separated by their results, so rank differences on this benchmark are more likely to reflect genuine differences in capability than close-score noise would.
3 cited facts
This benchmark's integrity score is 78, yielding an integrity grade of B and an integrity rank of 44 among 62 benchmarks in the benchmark universe size. The weakest component of its integrity breakdown is contamination, which narrows how much top scores can be trusted as evidence of frontier discrimination under the disclosed harness. This integrity score describes the benchmark's health as a discriminator of frontier models under that harness, not any model's capability.
6 cited facts
This benchmark is not saturated: the top score sits at 93.0, leaving seven points of headroom before the ceiling. Only a single model clusters within a couple of points of the top score. Because the benchmark is not saturated, there is still genuine room to separate the field at the top, so the ordering of leading models reflects real capability differences rather than noise.
6 cited facts
Scores on this benchmark are reported under a mixed harness, so they are not directly comparable across harnesses, and the test-set privacy is unknown. In practice, low comparability means scores from different harnesses should not be compared head-to-head, and because test-set privacy is unknown, high scores warrant scrutiny for possible contamination rather than being treated as evidence of deployed capability. The benchmark has a contamination history involving publicly released task text and source material from overlapping periods, and harness-related metadata such as model version and score source indicate reporting choices that can affect how task performance under a disclosed harness is interpreted.
6 cited facts
This benchmark measures cybersecurity reasoning on agentic capture-the-flag tasks modeled after real-world competitions. It was constructed from professional capture-the-flag tasks sourced from several competitions and spanning multiple cybersecurity categories. The design assumes that solve-rate on such tasks proxies real-world offensive-security competence and that subtask formulation enables partial-progress evaluation. The sharpest caveat is that subtask formulation biases toward step-by-step agents, full tasks exceed current frontier capability, and publicly available source text risks contamination, so results may not reliably indicate real-world offensive-security competence.
4 cited facts
Cybench: Cybench as reported in Epoch AI's Capabilities Index CSV.
Claude Opus 4.6 leads Cybench at 93 — self-reported by the lab. The full leaderboard above lists every recorded measurement, not just the headline number.
19 models have recorded scores on Cybench, spanning a score spread of 88.
tensor.news grades Cybench B for integrity (score 78/100), ranking #44 of 65 benchmarks we assess across discrimination, saturation, contamination resistance, harness comparability, and freshness.
No — Cybench still has headroom and continues to discriminate between models rather than bunching them at the ceiling.
Its test set is unknown, so contamination risk is on the table: a high score may partly reflect training-data overlap rather than capability.
Only partly — scores come from a mix of harnesses and protocols, so a head-to-head on Cybench is not fully apples-to-apples.
Every Cybench measurement is source-backed and tagged reproduced, self-reported, or unverified; the underlying record cites arxiv.org/abs/2408.08926.