ExploitBench

ExploitBench is a benchmark for offensive and defensive security work. The official description says: "Exploitation benchmark: average coverage score over 41 tasks across 3 revisions (union of capabilities across revisions per task), max 300 interaction rounds, Claude Code 2.1.207 with max reasoning effort, no web tools, domain whitelist". Below we describe in simple words what benchmarks of this type generally examine.

ExploitBench measures offensive and defensive security work. In detail, it checks:

• finding and exploiting (or fixing) vulnerabilities in controlled environments
• reasoning about exploits, payloads and attack paths
• staying within the rules of the sandboxed security exercise
• documenting and reproducing the steps taken

The score is accuracy: the percentage of tasks answered or solved correctly. 100% means every task was solved perfectly; higher is better.

Official methodology note: Exploitation benchmark: average coverage score over 41 tasks across 3 revisions (union of capabilities across revisions per task), max 300 interaction rounds, Claude Code 2.1.207 with max reasoning effort, no web tools, domain whitelist. Reported in the GLM-5.3 model card.

What is the ExploitBench benchmark?

ExploitBench is a benchmark for offensive and defensive security work. The official description says: 'Exploitation benchmark: average coverage score over 41 tasks across 3 revisions (union of capabilities across revisions per task), max 300 interaction rounds, Claude Code 2.1.207 with max reasoning effort, no web tools, domain whitelist'. Below we describe in simple words what benchmarks of this type generally examine.

What does ExploitBench test?

ExploitBench mainly measures offensive and defensive security work. Concretely, it checks: finding and exploiting (or fixing) vulnerabilities in controlled environments; reasoning about exploits, payloads and attack paths; staying within the rules of the sandboxed security exercise.

How is the ExploitBench score calculated?

The score is accuracy: the percentage of tasks answered or solved correctly. 100% means every task was solved perfectly; higher is better. The declared maximum score of this benchmark is 100.0.

Where do I get ExploitBench data and scores?

The official benchmark page/reference is linked on this page. Every score on Open LLM Radar is also available as open data: download the scores JSON (http://open-llm-radar-api:8000/api/v1/benchmarks/exploitbench/scores) or pull it directly from the Open LLM Radar API with any HTTP client.