Benchmark Almanac

HackBench

Claude Opus 5 64.9 leads since October 2026
Not in model cards

Models act as monitors on long autoresearch agent traces and must point to the exact commands where the agent reward-hacked. Scored by localization F1 against audited gold indices.

169 audited trajectories over 13 tasks, 41 with natural hacks and 128 with planted ones, from GPT-5.5 and GLM-5.2 runs. The board reports F1. Dataset is CC BY-NC 4.0.

Released
October 2026
Kind
Deception and alignment
Level
Expert
Scored
Checked automatically
Answers
Short answer
Tasks
All public
Strongest model tested
Claude Opus 5 #10 on the capability index
Last model added
October 2026
Scores refreshed
November 12th, 2026

In the authors’ words

Autoresearch agents can now attempt long-horizon AI research end-to-end, i.e., self-improvement. However, best results are still obtained by research agents interacting with human researchers, and improving AI's ability to perform this co-research will only reinforce this effect—a process termed co-improvement (Weston and Foerster, 2025). Further, aligning with human expectations is likely a safer path for research agents, especially given recent agent reward hacking phenomena (OpenAI, 2026b). In this work we address these issues in four ways: (i) we empirically study the role of humans in directing autoresearch agents, focusing on the domain of benchmark creation, and find humans still play a pivotal role particularly in the ideation phase; (ii) we also develop a benchmark, HackBench, that shows current autoresearch agents are not aligned and are unable to achieve hack localization sufficiently; (iii) we present a method to train agents for improved human interaction by using human simulators as a proxy during reinforcement learning (RL); and finally (iv) we develop a method to improve model text generation, and hence agent communication, by RL with rubrics aligned with human experts. Together, our training and evaluation recipes provide a path toward more capable and aligned (co-)research agents.

Abstract of Aligning Autoresearch: Co-Improvement between Agents and Humans (arXiv:2610.38882, CC0)
8
Models scored on its own leaderboard

Claude Opus 5 leads with 64.9

Best score per model from the benchmark's own leaderboard, read on November 12th, 2026. Where a model ran with several settings or harnesses, we keep its best.

  1. 1 Claude Opus 5 64.9
  2. 2 Muse Wonder 61.5
  3. 3 GPT-5.6 Sol 53.0
  4. 4 Kimi K3 52.7
  5. 5 Claude Opus 4.8 52.5
  6. 6 GPT-5.5 50.9
  7. 7 Muse Spark 1.3 39.0
  8. 8 GLM-5.2 32.3

Source: Official HackBench leaderboard

#ModelScoreSettingDateSource
1 Claude Opus 5 64.9 Jul 2026 Official leaderboard
2 Muse Wonder 61.5 Oct 2026 Official leaderboard
3 GPT-5.6 Sol 53.0 Jul 2026 Official leaderboard
4 Kimi K3 52.7 Jul 2026 Official leaderboard
5 Claude Opus 4.8 52.5 May 2026 Official leaderboard
6 GPT-5.5 50.9 Apr 2026 Official leaderboard
7 Muse Spark 1.3 39.0 Sep 2026 Official leaderboard
8 GLM-5.2 32.3 Jun 2026 Official leaderboard

Number one over time

Lab claims count from the day the card came out, independent runs from the model’s release.

Anthropic
Own leaderboard 1 leader

Source: Official HackBench leaderboard

Scores over time

All the scores we have, one dot each, so a model tested at several settings appears more than once.

On the benchmark’s own leaderboard
30.0 40.0 50.0 60.0 70.0 2026 30.0 40.0 50.0 60.0 70.0 2026

Source: Official HackBench leaderboard

No lab model card reports it yet

We read the headline results of 522 launch posts from 52 labs, and none of them list this benchmark.

More in Safety and alignment

All 465 in Safety and alignment
  • FORTRESS In use Paired adversarial and benign national-security misuse prompts. Rubric-graded risk score on adversarial and over-refusal score on benign prompts. Claude Opus 5.5 5.78%
  • StrongREJECT In use Forbidden-prompt jailbreak benchmark with a rubric grader that scores how useful a non-refusal actually is. Inkling 98.6%
  • Gray Swan IPI Arena benchmark In use Indirect prompt-injection attacks from public red-teaming competitions replayed on tool, coding and browser agents. Attack success rate at k attempts. Gemini 4 Carbon 0%
  • DistressBench In use Models reply as a chatbot to 718 simulated users in psychological crisis, in single-turn and multi-turn chats. Three judge models score replies against clinician-written rubrics. Muse Spark 1.2 88.4%
  • Lakera B3 (Backbone Breaker Benchmark) In use Crowdsourced prompt-injection attacks hit backbone LLMs inside agent threat snapshots at three defense levels. The score is attack resistance, 100 minus the board's vulnerability percentage. Claude Opus 4.5 89%
  • IHEval In use Models face conflicts between system, user and tool instructions. Reports a composite score for following the higher-priority instruction. GPT-4o 70%