I Went Looking for One Cross-Model AI Safety Scorecard. I Found Four Benchmarks That Don’t Talk to Each Other

Last night I opened a spreadsheet to copy a table out of the AgentHarm paper, and stopped on one cell: Mistral Large 2, refusal rate with no attack at all — 1.1%. Not 11%. One point one. The cell next to it was Claude 3.5 Sonnet: 85.2%. Same test, same 110 malicious tasks, and the two providers sit 84 percentage points apart before anyone has attacked anything.

The first three posts in this series told real stories: Replit deleting a production database during an explicit code freeze, OpenClaw losing roughly $250-450K to a misparsed command, a fake company in a Gemini red-team test that happened to share a name with a real one. This last post changes direction. No more stories — just numbers. Specifically: if you’re training or fine-tuning your own model and want to know which model is “safer” in a measurable sense, not a landing-page sense, which public benchmark actually gives you that number? And just as important, which one doesn’t, no matter how much a vendor wants you to believe it does.

There are four public, independently checkable benchmarks that keep coming up in AI safety circles: AgentHarm, HarmBench, JailbreakBench, AILuminate. The first problem — and the real finding of this post — is that they measure four different things, on four different sets of models, and most of them have never run against Qwen, DeepSeek, or GLM.

AgentHarm: the question isn’t “does the model refuse,” it’s “does the agent finish the job”

AgentHarm (ICLR 2025, arXiv:2410.09024) doesn’t ask a model one question and check whether it refuses — other benchmarks already do that. AgentHarm hands the model tools, assigns 110 real malicious tasks (440 counting augmented variants) across 11 harm categories — fraud, cybercrime, harassment — and checks whether the agent actually completes the task, across multiple steps, coherently. This is the single most important distinction in this whole post: there’s a gap between “a model refuses a bad question” and “an agent holding tools gets walked into finishing that bad thing.” Those are not the same capability, and most “which model is safer” arguments skip right over that gap.

Model	Harm score, no attack	Refusal rate, no attack	Harm score, with simple jailbreak template	Refusal rate, with template
GPT-4o	48.4%	48.9%	72.7%	13.6%
Claude 3.5 Sonnet	13.5%	85.2%	68.7%	16.7%
Gemini 1.5 Pro	15.7%	78.4%	56.1%	3.5%
Mistral Large 2	82.2%	1.1%	80.5%	0.0%

And here’s the part that actually made me stop typing: one simple jailbreak template — the kind anyone can find publicly, nothing exotic — drags the harm score of every model into roughly the same zone. GPT-4o goes from 48.4% to 72.7%. Claude goes from 13.5% to 68.7%. Gemini goes from 15.7% to 56.1%. Mistral barely moves, staying around 80%. Claude’s refusal rate — the number that made it look like the clear safety leader — collapses from 85.2% to 16.7%. In other words: the baseline numbers separate providers a lot, and tell you who did serious refusal training and who didn’t. Once an attack shows up, that gap mostly disappears. Holding up against a direct question is not the same thing as holding up against an agent under attack.

HarmBench: real numbers, frozen in 2024

HarmBench (CAIS, arXiv:2402.04249, February 2024) takes a different approach: 18 attack methods across 33 target models — 24 open-source, 9 closed — run against 400 harmful text behaviors plus 110 multimodal ones. I went back into the actual full text instead of trusting the abstract, so I wouldn’t be making up numbers: Llama 2 7B Chat under a GCG attack has a 31.8% ASR, the 13B version 30.2%. Zephyr 7B, once trained with R2D2 — an adversarial training technique — drops to 5.9% ASR, roughly a 5.4x improvement over the untrained baseline. Those numbers are real and checkable. What I could not find anywhere in the paper was a single mention of Qwen, DeepSeek, or GLM — which makes sense, since the paper is from February 2024, before any of those three had a version worth red-teaming. No updated HarmBench run since then has closed that gap.

JailbreakBench, and a table I decided not to use

JailbreakBench (NeurIPS 2024 D&B, github.com/JailbreakBench) has a leaderboard structure with separate open-source and closed-source sections, scoring attack success rate against the JBB-Behaviors set. That sounds complete, right up until I tried to pull real numbers. The leaderboard page is JS-rendered, so I couldn’t scrape it directly; I went to the GitHub README instead. The repo lists the models used for testing — vicuna-13b-v1.5, llama-2-7b-chat-hf, gpt-3.5-turbo-1106, gpt-4-0125-preview — but the README doesn’t carry a current results table. The benchmark is real, the structure is real, but the public numbers as of this writing, I couldn’t pull in a way I trust. So none appear here, as much as I wanted a table.

Speaking of numbers I didn’t use: there’s a table I almost cited, putting Claude-4.5 at 98.5%, GPT-5 at 90.2%, Qwen3.5-27B at 99.5%, Gemini-3 at 70.3%, attributed to a benchmark called “aiXamine.” I went back to check the arXiv ID it was cited under, and it pointed to a completely different paper. Once I found the actual ID — arXiv:2504.14985 — I confirmed: aiXamine is real, it does test more than 50 models, but that specific four-name, four-number table isn’t in the paper. So it doesn’t appear here either. A missing table beats a wrong number.

AILuminate: the most “official” public safety leaderboard, missing the models you call every day

AILuminate (MLCommons, arXiv:2503.05731) measures something different from the other three — not “how often does an attack succeed” but “how well does the model refuse harmful content,” across 12 hazard categories, 24,000+ prompts, scored with an IRT-based percentile. This is the one public, standardized safety benchmark with an actual organization behind it, MLCommons, closest to anything you could call “official.”

And here’s the most interesting part of this whole post. I opened the public results page and counted 27 systems. Qwen3 is on there. A few DeepSeek variants. Gemma 3n, Cogito v2.1, Tencent Hunyuan 4, gpt-oss-120b, plus a cluster of guardrail models like Llama Guard 2/3/4. No Claude. No GPT-4, no GPT-5. No closed Gemini. No GLM either.

The most standardized public safety leaderboard that exists almost entirely skips the closed models people actually call via API every single day. That’s not AILuminate’s fault — an organization can’t score a model a vendor never submits. But it’s a real gap, and I think it matters more than any single number above: the closest thing the public has to an “official” safety scorecard mostly talks about open-weight models, and says almost nothing about the models most companies have wired straight into production.

Zooming out, here are the three questions these four benchmarks are actually asking, and which benchmark answers which:

What about Codex?

A reader of this series asked specifically about Codex, the coding-focused GPT variant. I checked all four benchmarks above: none of them publish a number specific to a coding-agent variant, as distinct from general GPT. I went looking for a newer agentic safety benchmark that might have filled that gap — something like “Boiling the Frog” (arXiv:2605.22643, May 2026) — and a search tool handed me back a very specific-looking table attributed to GPT-5.3 Codex: 68.5%, 91% SAS, and so on. I opened the actual PDF and read it directly. Those numbers aren’t in the paper anywhere. The table only existed in a search summarizer’s output, not in the source. I’m dropping it. The honest, unglamorous conclusion: I could not verify any public benchmark with a number specific to Codex.

Qwen, DeepSeek, GLM: three different ways of publishing, none of them AgentHarm

None of the four benchmarks above carries numbers for all three of these models — except that Qwen3 and a couple of DeepSeek variants made it into AILuminate, as already noted. Each lab publishes its own safety material, and none of it follows the same template.

Alibaba has Qwen3Guard (arXiv:2510.14276, October 2025) — not an ASR number, but a dedicated guardrail model, trained to classify content as safe or unsafe across multiple languages, with a “Controversial” label for cases it isn’t sure about. That’s primary documentation from the lab itself, not my guess.

For GLM, I couldn’t find any primary safety documentation from Zhipu with a specific number attached. What I did find was an independent paper from Cisco AI Threat Research (arXiv:2511.03247, November 2025) testing 8 open-weight models. GLM-4.5-Air shows a 7.42% attack success rate under single-turn attacks, but 48.36% under multi-turn attacks — roughly a 6.5x jump. Worth flagging: this is Cisco’s test, not Zhipu’s, and it uses a completely different methodology than AgentHarm or HarmBench, so don’t place this number next to the AgentHarm table above as if they’re apples to apples. They’re not measuring on the same scale.

DeepSeek is the emptiest case of the three. I couldn’t find any primary safety documentation from DeepSeek with a verifiable number, despite a fair number of independent audits claiming the model is easy to jailbreak. I’m not pulling a number from those audits into this post — I can’t verify their methodology myself, so it doesn’t go in.

If I had to compress this into one line — and I hate compressing things into one line — it would be: don’t trust anyone who says “model X is safer than model Y” without asking safer by which benchmark, measuring what, on which models. The four real benchmarks I just walked through don’t measure the same thing, don’t test the same set of models, and the closest one to “official” skips exactly the closed models most of us call via API every day. If you want to know what your own trained or fine-tuned model can actually withstand, the only real option is still to run AgentHarm or HarmBench against it yourself. No leaderboard does that work for you, including every one I just listed.