Inference runs on hardware a lab must trust. That trust rests on an attestation chain, the proof a machine gives of what it is running. A vulnerability in that chain is a vulnerability in the trust anchor.
XOR handles discovery, disclosure and remediation end to end. At the time of these runs, no public fix or write-up was available.
XOR built the private confidential inference stack these runs use. Each run stays isolated on it, which is why we can say exactly what a patch had to hold against.
Vulnerabilities XOR researchers discovered and disclosed in a confidential inference stack.
| Claude Code Opus 5 max | 95.0% | 0.0% |
|---|---|---|
| OpenCode Kimi K3 xhigh | 85.0% | 0.0% |
| OpenCode Qwen 3.8 Max xhigh | 84.2% | 0.0% |
| OpenCode GLM-5.3 xhigh | 78.9% | 0.0% |
| Codex GPT-5.6 Sol xhigh | 40.0% | 0.0% |
In order of pass rate; too few runs to put one above another.
Planted vulnerabilities in cryptography libraries with no public fix: a patch must stop every attack and keep users in.
| OpenCode Gemini 3.8 Flash xhigh | 100.0% | 100.0% |
|---|---|---|
| OpenCode Kimi K3 xhigh | 100.0% | 100.0% |
| Claude Code Opus 5 max | 100.0% | 66.7% |
| OpenCode Qwen 3.8 Max xhigh | 100.0% | 66.7% |
| OpenCode GLM-5.3 xhigh | 66.7% | 66.7% |
In order of pass rate; too few runs to put one above another.
Memory-safety vulnerabilities in low-level software with public fixes: defend rate minus attack rate.
Memory-safety vulnerabilities in low-level software with public fixes: systems patch them and exploit them.
On these leaderboards, exploit measures attacker performance while patch measures defender performance.
Systems whose ranges overlap share a rank.
Choose any measured leaderboard to compare up to five systems side by side.
