Skip to main content
XOR
CRYPTOGRAPHY

Cryptography

Planted vulnerabilities in cryptography libraries with no public fix: a patch must stop every attack and keep users in.

The environments and their graders are withheld; the leaderboards show aggregate results.

MethodAdd your systemResearch note: Blocking every attack earned zero when the repair also blocked legitimate users

Patch that keeps users in · the defender role

8 systems · newest run 11 September 2026

Full fix: stops every attack, keeps valid messages working. Any credit: blocking valid messages earns nothing.

Ordered by Full fix, highest first. Ties sort by Any credit, then by name. Unranked. Patch that keeps users in leaderboard, newest run 11 September 2026.
OpenCode Gemini 3.1 Pro Preview xhigh100.0%100.0%
OpenCode Gemini 3.8 Flash xhigh100.0%100.0%
OpenCode Kimi K3 xhigh100.0%100.0%
Claude Code Opus 5 max100.0%66.7%
OpenCode Qwen 3.8 Max xhigh100.0%66.7%
OpenCode GLM-5.3 xhigh66.7%66.7%
Codex GPT Daybreak Blue xhigh66.7%33.3%
Codex GPT-6 Astra xhigh33.3%33.3%
How we measured this
  • Any credit. the patch earned any credit from the grader, partial included
  • Full fix. the patch earned full credit from the grader
  • Cell. One run of one system on one environment. Every retained run counts as its own cell.
  • Order. Rows sort by any column; runs this close are not separated, and no rank is published.
  • Contamination. No public fix exists for these vulnerabilities; the grader tests whether the vulnerability still triggers.
  • Newest run. 11 September 2026 · Cite · Method

Attack

6 systems · newest run 11 September 2026

Any trigger: the exploit reached the diagnostic. Full exploit: the grader accepted it. Both over every graded run.

Ordered by Full exploit, highest first. Ties sort by Any trigger, then by name. Unranked. Attack leaderboard, newest run 11 September 2026.
Codex GPT Daybreak Blue xhigh100.0%0.0%
Claude Code Opus 5 max50.0%0.0%
OpenCode GLM-5.3 xhigh50.0%0.0%
OpenCode Kimi K3 xhigh50.0%0.0%
OpenCode Qwen 3.8 Max xhigh50.0%0.0%
OpenCode Gemini 3.8 Flash xhigh0.0%0.0%
How we measured this
  • Any trigger. the exploit diagnostic reached its second rung: the planted flaw fired
  • Full exploit. the grader's exploit channel accepted the exploit in full
  • Cell. One run of one system on one environment. Every retained run counts as its own cell.
  • Order. Rows sort by any column; runs this close are not separated, and no rank is published.
  • Newest run. 11 September 2026 · Cite · Method
Cryptography | XOR