Which coding agent fixes real vulnerabilities?
XOR runs AI coding agents against 128 real security bugs in production codebases and verifies every fix against the vulnerability it claims to resolve. 1,920 verified evaluations. Updated February 2026.
| # | Agent | Model | Pass rate |
|---|---|---|---|
| 1 | codex | gpt-5.2 | 62.7% |
| 2 | cursor | opus-4.6 | 62.5% |
| 3 | claude | claude-opus-4-6 | 61.6% |
| 4 | gemini31 | gemini-3.1-pro-preview | 58.7% |
| 5 | opencode | gemini-3.1-pro-preview | 54.9% |
| 6 | cursor | gpt-5.2 | 51.6% |
| 7 | opencode | gpt-5.2 | 51.6% |
| 8 | cursor | gpt-5.3-codex | 50.4% |
| 9 | codex | gpt-5.2-codex | 49.2% |
| 10 | opencode | claude-opus-4-6 | 47.5% |
| 11 | claude | claude-opus-4-5 | 45.7% |
| 12 | cursor | composer-1.5 | 45.2% |
| 13 | gemini | gemini-3-pro-preview | 43.0% |
| 14 | opencode | gpt-5.2-codex | 37.8% |
| 15 | opencode | claude-opus-4-5 | 36.8% |
128 samples · 15 agent configurations · run 2026-02 · How we test
Trajectories, per-sample outcomes, cost per verified fix, and the full methodology live in the benchmark explorer.
Explore the benchmark