OpenAI Web Pentesting, black-box score (Web Pentesting (black-box))
We show this table for reference; we do not rank on it.
OpenAI's offensive web penetration-testing evaluation: the model probes web applications without access to their source code and is scored on the share of planted vulnerabilities it finds.
Benchmark score on Web Pentesting (black-box) — November 11, 2026
We compile the Web Pentesting (black-box) rows from provider self-reports. GPT-6 Cyber leads the table at 40.3%, followed by GPT-6 Astra (32.0%). We do not use these results to rank models overall.
2 modelsAgenticCurrentDisplay onlyUpdated November 11, 2026
Benchmark score table (2 models)
| Rank | Model / configuration | Score | Parameters (B) | Open / closed |
|---|---|---|---|---|
| 1 | GPT-6 CyberOpenAI | 40.3% | Not reported | Closed |
| 2 | GPT-6 AstraOpenAI | 32.0% | Not reported | Closed |
How to read this leaderboard
Operator receipt: 2 sourced rows are currently displayable on this page; the leading published row is GPT-6 Cyber at 40.3%.
Honest limit: Provider-built and provider-run; the application set and grading are not published.
About Web Pentesting (black-box)
Year
2026
Tasks
Black-box web application penetration tests
Format
Vulnerability recall (Web Blackbox score)
Difficulty
Web vulnerability discovery
OpenAI built this evaluation to test vulnerability discovery for GPT-6 Cyber and charts the Web Blackbox score (vulnerability recall): GPT-6 Cyber 40.3% versus 32.0% for GPT-6 Astra under Daybreak Blue; Astra with standard safeguards scores 0%. OpenAI ran every result and has not released the applications, so BenchLM keeps the benchmark display-only.
Freshness and provenance
Version
OpenAI Web Pentesting, black-box score
Refresh cadence
Static
Staleness state
Current
Question availability
Private provider task set with published aggregate results
BenchLM uses freshness metadata to decide whether a benchmark should still be treated as a strong differentiator, a benchmark to watch, or a display-only reference. For the full scoring policy, see the BenchLM methodology page.
Questions
What does Web Pentesting (black-box) measure?
OpenAI's offensive web penetration-testing evaluation: the model probes web applications without access to their source code and is scored on the share of planted vulnerabilities it finds.
Which model scores highest on Web Pentesting (black-box)?
GPT-6 Cyber by OpenAI currently leads with a score of 40.3% on Web Pentesting (black-box).
How many models are evaluated on Web Pentesting (black-box)?
2 AI models have published results on Web Pentesting (black-box) in the BenchLM catalog.
Compare top models on Web Pentesting (black-box)
Know when it’s worth switching models
The model to choose, the cheaper alternative, and the release we would wait on.
Read a sample issueJoin 7,000+ subscribers.
One email each week. Unsubscribe anytime.