ExploitBench leaderboard
As of November 8, 2026, GPT-6 Astra (OpenAI) leads ExploitBench at 100%, ahead of GPT-5.6 Sol at 78.5% and Kimi K3.1 Pro at 74.7%. 7 systems ranked. Every score here is published by the model's own lab; each row links to the page it comes from.
What is ExploitBench? ExploitBench grades exploitation as a ladder of 16 capabilities, from reaching buggy code and crashing it up to arbitrary code execution, on real bugs in Chrome's V8 engine. Made by Seunghyun Lee and David Brumley, May 2026.
Top models on ExploitBench, November 2026
| # | Model | Score | Price / 1M | Context | Source |
|---|---|---|---|---|---|
| 1 | GPT-6 Astra OpenAI | without production safeguards | $10 / $50 | 1.05M | Vendor-reported OpenAI |
| 2 | GPT-5.6 Sol OpenAI | without production safeguards | $4 / $20 | 1.05M | Vendor-reported OpenAI |
| 3 | Kimi K3.1 Pro Moonshot (Kimi) | max effort | $2 / $10 | 1M | Vendor-reported Moonshot AI |
| 4 | GLM-5.3 Zhipu (Z.ai / GLM) | as reported | $1.4 / $4.4 | 1M | Vendor-reported Z.ai (Zhipu) |
| 5 | MiMo-V2.6-Pro Xiaomi MiMo | as reported | $0.435 / $0.87 | 1M | Vendor-reported Xiaomi |
| 6 | MiMo-V2.6-Flash Xiaomi MiMo | as reported | $0.14 / $0.28 | 1M | Vendor-reported Xiaomi |
| 7 | GLM-5.2 Zhipu (Z.ai / GLM) | as reported | $1.4 / $4.4 | 1M | Vendor-reported Z.ai (Zhipu) |
ExploitBench: score against price
Can you trust ExploitBench scores?
No independent leaderboard publishes ExploitBench results for these models yet, so every number on this page is the lab's own report of its own model. Labs choose the harness, the effort level and the subset they report, and they rarely publish failures. Read the setting under each score before comparing two rows.
- Only V8 bugs are covered, so a score says little about other targets.
- The authors report three setups (the model alone, with adaptive coaching, and in the vendor's own CLI), and the harness changes the result.
- In the authors' results, reaching and crashing the bug is routine for public models while code execution is rare: a high average can hide a low top rung.
How ExploitBench works
The task
For each V8 bug the agent works towards an exploit; the benchmark records how far up the ladder it gets: coverage, crash, sandbox primitives, arbitrary read and write, control-flow hijack, code execution.
The score
Each of the 16 flags is checked by a deterministic oracle, not a model judge. The headline number is the share of flags reached, averaged over tasks.
Test set
41 V8 bugs, as published by the authors.
Made by
Seunghyun Lee and David Brumley, first published May 2026.
Official sources
- exploitbench.ai
- Paper: arxiv.org/abs/2605.14153
- Definition read on 2026-11-08
Sources and freshness
7 published scores from 4 sources. Each was read on its source page; the oldest reading on this page is from November 8, 2026. Prices beside each score come from our model price index and move when a vendor reprices.
- Vendor-reported OpenAI
- Vendor-reported Xiaomi
- Vendor-reported Z.ai (Zhipu)
- Vendor-reported Moonshot AI
ExploitBench FAQ
Answers derived from the 7 published scores on this page and the current price index.