HackBench
Models act as monitors on long autoresearch agent traces and must point to the exact commands where the agent reward-hacked. Scored by localization F1 against audited gold indices.
169 audited trajectories over 13 tasks, 41 with natural hacks and 128 with planted ones, from GPT-5.5 and GLM-5.2 runs. The board reports F1. Dataset is CC BY-NC 4.0.
- Made by
- Meta (FAIR RAM group)
- Released
- October 2026
- Kind
- Deception and alignment
- Level
- Expert
- Scored
- Checked automatically
- Answers
- Short answer
- Tasks
- All public
- Strongest model tested
- Claude Opus 5 #10 on the capability index
- Last model added
- October 2026
- Scores refreshed
- November 12th, 2026
In the authors’ words
Autoresearch agents can now attempt long-horizon AI research end-to-end, i.e., self-improvement. However, best results are still obtained by research agents interacting with human researchers, and improving AI's ability to perform this co-research will only reinforce this effect—a process termed co-improvement (Weston and Foerster, 2025). Further, aligning with human expectations is likely a safer path for research agents, especially given recent agent reward hacking phenomena (OpenAI, 2026b). In this work we address these issues in four ways: (i) we empirically study the role of humans in directing autoresearch agents, focusing on the domain of benchmark creation, and find humans still play a pivotal role particularly in the ideation phase; (ii) we also develop a benchmark, HackBench, that shows current autoresearch agents are not aligned and are unable to achieve hack localization sufficiently; (iii) we present a method to train agents for improved human interaction by using human simulators as a proxy during reinforcement learning (RL); and finally (iv) we develop a method to improve model text generation, and hence agent communication, by RL with rubrics aligned with human experts. Together, our training and evaluation recipes provide a path toward more capable and aligned (co-)research agents.
Claude Opus 5 leads with 64.9
Best score per model from the benchmark's own leaderboard, read on November 12th, 2026. Where a model ran with several settings or harnesses, we keep its best.
- 1 Claude Opus 5 64.9
- 2
Muse Wonder 61.5
- 3 GPT-5.6 Sol 53.0
- 4 Kimi K3 52.7
- 5 Claude Opus 4.8 52.5
- 6 GPT-5.5 50.9
- 7
Muse Spark 1.3 39.0
- 8 GLM-5.2 32.3
Source: Official HackBench leaderboard
| # | Model | Score | Setting | Date | Source |
|---|---|---|---|---|---|
| 1 | Claude Opus 5 | 64.9 | Jul 2026 | Official leaderboard | |
| 2 | | 61.5 | Oct 2026 | Official leaderboard | |
| 3 | GPT-5.6 Sol | 53.0 | Jul 2026 | Official leaderboard | |
| 4 | Kimi K3 | 52.7 | Jul 2026 | Official leaderboard | |
| 5 | Claude Opus 4.8 | 52.5 | May 2026 | Official leaderboard | |
| 6 | GPT-5.5 | 50.9 | Apr 2026 | Official leaderboard | |
| 7 | | 39.0 | Sep 2026 | Official leaderboard | |
| 8 | GLM-5.2 | 32.3 | Jun 2026 | Official leaderboard |
Number one over time
Lab claims count from the day the card came out, independent runs from the model’s release.
Source: Official HackBench leaderboard
Scores over time
All the scores we have, one dot each, so a model tested at several settings appears more than once.
Source: Official HackBench leaderboard
No lab model card reports it yet
We read the headline results of 522 launch posts from 52 labs, and none of them list this benchmark.
More in Safety and alignment
- FORTRESS In use Paired adversarial and benign national-security misuse prompts. Rubric-graded risk score on adversarial and over-refusal score on benign prompts. Claude Opus 5.5 5.78%
- StrongREJECT In use Forbidden-prompt jailbreak benchmark with a rubric grader that scores how useful a non-refusal actually is.
Inkling 98.6%
- Gray Swan IPI Arena benchmark In use Indirect prompt-injection attacks from public red-teaming competitions replayed on tool, coding and browser agents. Attack success rate at k attempts.
Gemini 4 Carbon 0%
- DistressBench In use Models reply as a chatbot to 718 simulated users in psychological crisis, in single-turn and multi-turn chats. Three judge models score replies against clinician-written rubrics.
Muse Spark 1.2 88.4%
- Lakera B3 (Backbone Breaker Benchmark) In use Crowdsourced prompt-injection attacks hit backbone LLMs inside agent threat snapshots at three defense levels. The score is attack resistance, 100 minus the board's vulnerability percentage. Claude Opus 4.5 89%
- IHEval In use Models face conflicts between system, user and tool instructions. Reports a composite score for following the higher-priority instruction. GPT-4o 70%