# OpenAI Web Pentesting, black-box score (Web Pentesting (black-box))

> OpenAI's offensive web penetration-testing evaluation: the model probes web applications without access to their source code and is scored on the share of planted vulnerabilities it finds.

Canonical page: https://benchlm.ai/benchmarks/webpentestblackbox

- Category: [Agentic](/agentic)
- Last updated: November 11, 2026

## About Web Pentesting (black-box)

- Year: 2026
- Tasks: Black-box web application penetration tests
- Format: Vulnerability recall (Web Blackbox score)
- Difficulty: Web vulnerability discovery
- Paper: [GPT-6 Cyber: Advancing the frontier of aligned cybersecurity agents](https://openai.com/index/introducing-gpt-6-cyber/)

OpenAI built this evaluation to test vulnerability discovery for GPT-6 Cyber and charts the Web Blackbox score (vulnerability recall): GPT-6 Cyber 40.3% versus 32.0% for GPT-6 Astra under Daybreak Blue; Astra with standard safeguards scores 0%. OpenAI ran every result and has not released the applications, so BenchLM keeps the benchmark display-only.

Web Pentesting (black-box) is currently displayed on BenchLM for reference, but it is excluded from the weighted scoring formula.

## Leaderboard (2 models)

| Rank | Model | Creator | Score |
|------|-------|---------|-------|
| 1 | [GPT-6 Cyber](/models/gpt-6-cyber) | OpenAI | 40.3% |
| 2 | [GPT-6 Astra](/models/gpt-6-astra) | OpenAI | 32.0% |

## FAQ

### What does Web Pentesting (black-box) measure?

OpenAI's offensive web penetration-testing evaluation: the model probes web applications without access to their source code and is scored on the share of planted vulnerabilities it finds.

### Which model scores highest on Web Pentesting (black-box)?

GPT-6 Cyber by OpenAI currently leads with a score of 40.3% on Web Pentesting (black-box).

### How many models are evaluated on Web Pentesting (black-box)?

2 AI models have published results on Web Pentesting (black-box) in the BenchLM catalog.

### Does Web Pentesting (black-box) affect BenchLM's overall score?

Not directly. Web Pentesting (black-box) is still displayed on BenchLM for reference, but it is excluded from the weighted scoring formula.

## Compare Top Models on Web Pentesting (black-box)

- [GPT-6 Cyber vs GPT-6 Astra](/compare/gpt-6-astra-vs-gpt-6-cyber)