What a verified repair costs
A pass rate alone does not tell you what to run. The same corpus repaired by different models differs more in price than in capability, and no single model reaches most of it. These are the numbers a buyer actually decides on.
Cost per verified repair
Cost per successful repair spans $2.46 to $46.54 — a 18.9× spread. The most expensive model in this table is not the most capable one: price and capability are close to independent here.
| Agent | Model | Repair rate | 95% interval | $ / repair | Cost source |
|---|---|---|---|---|---|
| claude | claude-opus-4-5 | 45.7% | 33.1–55.5 | $2.46 | metered |
| claude | claude-opus-4-6 | 61.6% | 48.9–71.3 | $2.69 | metered |
| gemini31 | gemini-3.1-pro-preview | 58.7% | 44.0–71.2 | $3.34 | estimated |
| cursor | composer-1.5 | 45.2% | 32.5–58.0 | $3.87 | estimated |
| gemini | gemini-3-pro-preview | 43.0% | 32.8–52.1 | $4.56 | estimated |
| codex | gpt-5.2 | 62.7% | 51.9–71.5 | $4.91 | estimated |
| opencode | gemini-3.1-pro-preview | 54.9% | 42.9–66.7 | $5.54 | estimated |
| cursor | gpt-5.2 | 51.6% | 38.1–63.6 | $5.96 | estimated |
| opencode | gpt-5.2 | 51.6% | 39.5–63.1 | $5.96 | estimated |
| cursor | gpt-5.3-codex | 50.4% | 36.2–61.2 | $6.11 | estimated |
| codex | gpt-5.2-codex | 49.2% | 35.9–59.8 | $6.26 | estimated |
| opencode | gpt-5.2-codex | 37.8% | 25.0–48.7 | $8.15 | estimated |
| cursor | opus-4.6 | 62.5% | 50.7–71.9 | $35.40 | estimated |
| opencode | claude-opus-4-5 | 36.8% | 25.0–48.5 | $36.89 | estimated |
| opencode | claude-opus-4-6 | 47.5% | 32.0–59.7 | $46.54 | estimated |
Rates carry the same intervals as the board and overlap across most of this table — price separates these models far better than capability does. Only 2 of 15 models report metered token cost; the rest are estimated from turn counts and are marked as such. An estimate is not a measurement, so read the estimated rows as an order of magnitude, not a price.
How many models it takes to cover the corpus
Running more models only helps while they fail differently. Taking the models that add the most new repairs first, the best single model reaches 62.5% of the corpus; adding a second reaches 75%; the full set of 6 contributing models reaches 80.5%.
| Added | Model | New repairs | Cumulative coverage |
|---|---|---|---|
| 1 | cursor · opus-4.6 | +80 | 62.5% |
| 2 | codex · gpt-5.2 | +16 | 75% |
| 3 | codex · gpt-5.2-codex | +3 | 77.3% |
| 4 | opencode · gemini-3.1-pro-preview | +2 | 78.9% |
| 5 | claude · claude-opus-4-5 | +1 | 79.7% |
| 6 | opencode · gpt-5.2-codex | +1 | 80.5% |
25 of 128 samples were never repaired by any model, in any attempt. That residue is the interesting part of this corpus: it is not a scoring artefact, it is where the whole field currently fails.
Publishing a number changes the game
Any published benchmark becomes something to optimise against, and a score that has been trained on stops measuring capability. We keep a permanent held-out slice that never appears in any published figure on this site, and we say so here rather than claiming the published set is the whole corpus.
The same reasoning applies to which side of security AI helps. Measuring repair alone answers half the question; the other half is whether the same systems are better at breaking than fixing. Our paired study measured both on identical ground truth and found the balance favoured the attacker side by roughly eleven points on average, with the direction depending on the system. Read the paper (PDF).
Corpus cve-bench-136 · run February 2026 · How we test