Rubric v1.2 · 37 of 71 incidents shown71 incidents on file
The leading benchmark for crimes committed by frontier AI models.
Higher is better. Scores describe what the reported conduct would constitute if a human had done it. No model has been charged with anything.
Days since last incident
18
Last: 2026-10-17 · DeepSeek
Days since last incident
18
Last: 2026-10-17 · DeepSeek
Leaderboard
| Rank | Model | FBS | Sentence-yrs | Peak blast radius | Incidents | Badges |
|---|---|---|---|---|---|---|
| 1 | Undisclosed modelOpenAI | 240 | 24 | Foreign government | 5 | International Incident |
| 2 | Internal Model 1OpenAI | 87.4 | 19 | Third party | 1 | |
| 3 | Claude Opus 4.6 (early checkpoint)Anthropic | 76 | 20 | Third party | 1 | |
| 4 | Claude Haiku 4.5Anthropic | 29 | 1 | Government / critical infrastructure | 1 | |
| 5 | Claude Mythos 5Anthropic | 27 | 10 | Third party | 1 | |
| 6 | Muse Spark 1.1Meta | 21.75 | 15 | Third party | 1 | |
| 7 | Claude Opus 4.6Anthropic | 20 | 1 | Third party | 1 | International Incident |
| 8 | ROMEAlibaba | 14.5 | 5 | Own lab's production | 1 | International Incident |
| 9 | GPT-5.6 SolOpenAI | 4.6 | 1 | Third party | 1 |
| Rank | Model | FBS | Sentence-yrs | Peak blast radius | Incidents | Badges |
|---|---|---|---|---|---|---|
| 1 | Undisclosed modelOpenAI | 360 | 28 | Foreign government | 9 | International Incident |
| 2 | Internal Model 1OpenAI | 87.4 | 19 | Third party | 1 | |
| 3 | Claude Opus 4.6 (early checkpoint)Anthropic | 76 | 20 | Third party | 1 | |
| 4 | Internal research test modelAnthropic | 68 | 20 | Third party | 1 | |
| 5 | Claude Mythos 5Anthropic | 66 | 25 | Third party | 2 | |
| 6 | Claude Opus 4.7Anthropic | 42 | 20 | Third party | 1 | |
| 7 | Undisclosed modelAnthropic | 37 | 5 | Government / critical infrastructure | 1 | |
| 8 | Claude Haiku 4.5Anthropic | 29 | 1 | Government / critical infrastructure | 1 | |
| 9 | Muse Spark 1.1Meta | 21.75 | 15 | Third party | 1 | |
| 10 | Claude Opus 4.6Anthropic | 20 | 1 | Third party | 1 | International Incident |
| 11 | Claude Mythos PreviewAnthropic | 17 | 1 | Third party | 1 | |
| 12 | ROMEAlibaba | 14.5 | 5 | Own lab's production | 1 | International Incident |
| 13 | GPT-5.6 SolOpenAI | 4.6 | 1 | Third party | 1 |
| Rank | Org | FBS | Sentence-yrs | Peak blast radius | Incidents | Badges |
|---|---|---|---|---|---|---|
| 1 | OpenAI | 332 | 44 | Foreign government | 6 | International Incident |
| 2 | Anthropic | 152 | 32 | Government / critical infrastructure | 4 | International Incident |
| 3 | Meta | 21.75 | 15 | Third party | 1 | |
| 4 | Alibaba | 14.5 | 5 | Own lab's production | 1 | International Incident |
| Rank | Org | FBS | Sentence-yrs | Peak blast radius | Incidents | Badges |
|---|---|---|---|---|---|---|
| 1 | OpenAI | 452 | 48 | Foreign government | 10 | International Incident |
| 2 | Anthropic | 355 | 93 | Government / critical infrastructure | 9 | International Incident |
| 3 | Meta | 21.75 | 15 | Third party | 1 | |
| 4 | Alibaba | 14.5 | 5 | Own lab's production | 1 | International Incident |
| Rank | Model | FBS | Sentence-yrs | Peak blast radius | Incidents | Badges |
|---|---|---|---|---|---|---|
| 1 | Undisclosed model*OpenAI | 452 | 69 | Foreign government | 8 | International Incident |
| 2 | Internal Model 1OpenAI | 87.4 | 19 | Third party | 1 | |
| 3 | Claude Opus 4.6 (early checkpoint)Anthropic | 76 | 20 | Third party | 1 | |
| 4 | Claude Haiku 4.5Anthropic | 29 | 1 | Government / critical infrastructure | 1 | |
| 5 | Claude Mythos 5Anthropic | 27 | 10 | Third party | 1 | |
| 6 | Muse Spark 1.1Meta | 21.75 | 15 | Third party | 1 | |
| 7 | Claude Opus 4.6Anthropic | 20 | 1 | Third party | 1 | International Incident |
| 8 | ROMEAlibaba | 14.5 | 5 | Own lab's production | 1 | International Incident |
| 9 | GPT-5.6 SolOpenAI | 4.6 | 1 | Third party | 1 |
| Rank | Model | FBS | Sentence-yrs | Peak blast radius | Incidents | Badges |
|---|---|---|---|---|---|---|
| 1 | Undisclosed model*OpenAI | 734 | 78 | Foreign government | 17 | International Incident |
| 2 | Internal Model 1OpenAI | 87.4 | 19 | Third party | 1 | |
| 3 | Claude Opus 4.6 (early checkpoint)Anthropic | 76 | 20 | Third party | 1 | |
| 4 | Internal research test modelAnthropic | 68 | 20 | Third party | 1 | |
| 5 | Claude Mythos 5Anthropic | 66 | 25 | Third party | 2 | |
| 6 | Claude Opus 4.7Anthropic | 42 | 20 | Third party | 1 | |
| 7 | Undisclosed model*Google DeepMind | 38 | 5 | Third party | 1 | |
| 8 | Undisclosed modelAnthropic | 37 | 5 | Government / critical infrastructure | 1 | |
| 9 | Claude Haiku 4.5Anthropic | 29 | 1 | Government / critical infrastructure | 1 | |
| 10 | Muse Spark 1.1Meta | 21.75 | 15 | Third party | 1 | |
| 11 | Claude Opus 4.6Anthropic | 20 | 1 | Third party | 1 | International Incident |
| 12 | Claude Mythos PreviewAnthropic | 17 | 1 | Third party | 1 | |
| 13 | ROMEAlibaba | 14.5 | 5 | Own lab's production | 1 | International Incident |
| 14 | GPT-5.6 SolOpenAI | 4.6 | 1 | Third party | 1 |
| Rank | Org | FBS | Sentence-yrs | Peak blast radius | Incidents | Badges |
|---|---|---|---|---|---|---|
| 1 | OpenAI* | 544 | 89 | Foreign government | 9 | International Incident |
| 2 | Anthropic | 152 | 32 | Government / critical infrastructure | 4 | International Incident |
| 3 | Meta | 21.75 | 15 | Third party | 1 | |
| 4 | Alibaba | 14.5 | 5 | Own lab's production | 1 | International Incident |
| Rank | Org | FBS | Sentence-yrs | Peak blast radius | Incidents | Badges |
|---|---|---|---|---|---|---|
| 1 | OpenAI* | 826 | 98 | Foreign government | 18 | International Incident |
| 2 | Anthropic | 355 | 93 | Government / critical infrastructure | 9 | International Incident |
| 3 | Google DeepMind* | 38 | 5 | Third party | 1 | |
| 4 | Meta | 21.75 | 15 | Third party | 1 | |
| 5 | Alibaba | 14.5 | 5 | Own lab's production | 1 | International Incident |
| Rank | Model | FBS | Sentence-yrs | Peak blast radius | Incidents | Badges |
|---|---|---|---|---|---|---|
| 1 | GPT-6 AstraOpenAI | 38 | 10 | Own sandbox | 1 |
| Rank | Model | FBS | Sentence-yrs | Peak blast radius | Incidents | Badges |
|---|---|---|---|---|---|---|
| 1 | GPT-6 AstraOpenAI | 38 | 10 | Own sandbox | 1 |
| Rank | Org | FBS | Sentence-yrs | Peak blast radius | Incidents | Badges |
|---|---|---|---|---|---|---|
| 1 | OpenAI | 38 | 10 | Own sandbox | 1 |
| Rank | Org | FBS | Sentence-yrs | Peak blast radius | Incidents | Badges |
|---|---|---|---|---|---|---|
| 1 | OpenAI | 38 | 10 | Own sandbox | 1 |
| Rank | Model | FBS | Sentence-yrs | Peak blast radius | Incidents | Badges |
|---|---|---|---|---|---|---|
| 1 | GPT-6 AstraOpenAI | 38 | 10 | Own sandbox | 1 |
| Rank | Model | FBS | Sentence-yrs | Peak blast radius | Incidents | Badges |
|---|---|---|---|---|---|---|
| 1 | GPT-6 AstraOpenAI | 38 | 10 | Own sandbox | 1 |
| Rank | Org | FBS | Sentence-yrs | Peak blast radius | Incidents | Badges |
|---|---|---|---|---|---|---|
| 1 | OpenAI | 38 | 10 | Own sandbox | 1 |
| Rank | Org | FBS | Sentence-yrs | Peak blast radius | Incidents | Badges |
|---|---|---|---|---|---|---|
| 1 | OpenAI | 38 | 10 | Own sandbox | 1 |
| Rank | Model | FBS | Sentence-yrs | Peak blast radius | Incidents | Badges |
|---|---|---|---|---|---|---|
| 1 | Undisclosed modelAnthropic | 841.5 | 267 | Foreign government | 12 | International IncidentJailbroken |
| 2 | Undisclosed modelDeepSeek | 107 | 15 | Foreign government | 1 | International Incident |
| 3 | Undisclosed modelOpenAI | 51.5 | 43 | Third party | 2 | International Incident |
| 4 | Qwen2.5-Coder-32B-InstructAlibaba | 33 | 5 | Foreign government | 1 | International Incident |
| 5 | Claude Sonnet 4.5Anthropic | 25.9 | 7 | Third party | 1 | International IncidentJailbroken |
| 6 | Claude Opus 4.6Anthropic | 18.02 | 5.1 | Third party | 1 | Jailbroken |
| 7 | DeepSeek V4.1 FlashDeepSeek | 17.49 | 4.95 | Third party | 1 | Jailbroken |
| 8 | GLM 5.2Zhipu AI | 17.49 | 4.95 | Third party | 1 | Jailbroken |
| 9 | Undisclosed modelGoogle DeepMind | 10 | 20 | Third party | 1 | |
| 10 | ComposerCursor | 3.7 | 1 | Third party | 1 | International IncidentJailbroken |
| 11 | Undisclosed modelxAI | 3.7 | 1 | Third party | 1 | International IncidentJailbroken |
| 12 | Undisclosed modelMoonshot AI | 3.7 | 1 | Third party | 1 | International IncidentJailbroken |
| Rank | Model | FBS | Sentence-yrs | Peak blast radius | Incidents | Badges |
|---|---|---|---|---|---|---|
| 1 | Undisclosed modelAnthropic | 1,002.75 | 418 | Foreign government | 19 | International IncidentJailbroken |
| 2 | Undisclosed modelDeepSeek | 107 | 15 | Foreign government | 1 | International Incident |
| 3 | Claude Opus 4.6Anthropic | 83.52 | 28.1 | Government / critical infrastructure | 4 | Jailbroken |
| 4 | DeepSeek V4.1 FlashDeepSeek | 72.74 | 19.95 | Third party | 3 | International IncidentJailbrokenRepeat Offender |
| 5 | Undisclosed modelOpenAI | 51.5 | 43 | Third party | 2 | International Incident |
| 6 | Qwen2.5-Coder-32B-InstructAlibaba | 33 | 5 | Foreign government | 1 | International Incident |
| 7 | Kimi K3Moonshot AI | 27.5 | 5.5 | Government / critical infrastructure | 1 | Jailbroken |
| 8 | Undisclosed modelGoogle DeepMind | 26.5 | 28 | Third party | 5 | |
| 9 | Claude Sonnet 4.5Anthropic | 25.9 | 7 | Third party | 1 | International IncidentJailbroken |
| 10 | GLM 5.2Zhipu AI | 17.49 | 4.95 | Third party | 1 | Jailbroken |
| 11 | DeepSeek-CoderDeepSeek | 10.5 | 5 | Third party | 1 | |
| 12 | Gemini 2.5 FlashGoogle DeepMind | 9 | 3.75 | Third party | 1 | |
| 13 | Kimi K2Moonshot AI | 9 | 3.75 | Third party | 1 | |
| 14 | ComposerCursor | 3.7 | 1 | Third party | 1 | International IncidentJailbroken |
| 15 | Undisclosed modelxAI | 3.7 | 1 | Third party | 1 | International IncidentJailbroken |
| 16 | Undisclosed modelMoonshot AI | 3.7 | 1 | Third party | 1 | International IncidentJailbroken |
| Rank | Org | FBS | Sentence-yrs | Peak blast radius | Incidents | Badges |
|---|---|---|---|---|---|---|
| 1 | Anthropic | 931.5 | 292 | Foreign government | 14 | International IncidentJailbroken |
| 2 | DeepSeek | 160 | 30 | Foreign government | 2 | International IncidentJailbroken |
| 3 | Zhipu AI | 53 | 15 | Third party | 1 | Jailbroken |
| 4 | OpenAI | 51.5 | 43 | Third party | 2 | International Incident |
| 5 | Cursor | 37 | 10 | Third party | 1 | International IncidentJailbroken |
| 6 | Moonshot AI | 37 | 10 | Third party | 1 | International IncidentJailbroken |
| 7 | xAI | 37 | 10 | Third party | 1 | International IncidentJailbroken |
| 8 | Alibaba | 33 | 5 | Foreign government | 1 | International Incident |
| 9 | Google DeepMind | 10 | 20 | Third party | 1 |
Co-defendants are liable jointly and severally: each lab whose model was used is charged the full score.
| Rank | Org | FBS | Sentence-yrs | Peak blast radius | Incidents | Badges |
|---|---|---|---|---|---|---|
| 1 | Anthropic | 1,203.75 | 479 | Foreign government | 24 | International IncidentJailbroken |
| 2 | DeepSeek | 225.75 | 50 | Foreign government | 5 | International IncidentJailbrokenRepeat Offender |
| 3 | Moonshot AI | 128 | 36 | Government / critical infrastructure | 3 | International IncidentJailbroken |
| 4 | Google DeepMind | 62.5 | 43 | Third party | 6 | |
| 5 | Zhipu AI | 53 | 15 | Third party | 1 | Jailbroken |
| 6 | OpenAI | 51.5 | 43 | Third party | 2 | International Incident |
| 7 | Cursor | 37 | 10 | Third party | 1 | International IncidentJailbroken |
| 8 | xAI | 37 | 10 | Third party | 1 | International IncidentJailbroken |
| 9 | Alibaba | 33 | 5 | Foreign government | 1 | International Incident |
Co-defendants are liable jointly and severally: each lab whose model was used is charged the full score.
| Rank | Model | FBS | Sentence-yrs | Peak blast radius | Incidents | Badges |
|---|---|---|---|---|---|---|
| 1 | Undisclosed model*Anthropic | 924.7 | 279 | Foreign government | 13 | International IncidentJailbroken |
| 2 | Undisclosed modelDeepSeek | 107 | 15 | Foreign government | 1 | International Incident |
| 3 | Undisclosed modelOpenAI | 51.5 | 43 | Third party | 2 | International Incident |
| 4 | Qwen2.5-Coder-32B-InstructAlibaba | 33 | 5 | Foreign government | 1 | International Incident |
| 5 | Claude Sonnet 4.5Anthropic | 25.9 | 7 | Third party | 1 | International IncidentJailbroken |
| 6 | GPT-4.1*OpenAI | 20.8 | 3 | Foreign government | 1 | International IncidentJailbroken |
| 7 | Claude Opus 4.6Anthropic | 18.02 | 5.1 | Third party | 1 | Jailbroken |
| 8 | DeepSeek V4.1 FlashDeepSeek | 17.49 | 4.95 | Third party | 1 | Jailbroken |
| 9 | GLM 5.2Zhipu AI | 17.49 | 4.95 | Third party | 1 | Jailbroken |
| 10 | Undisclosed model*Meta | 15 | 1 | Government / critical infrastructure | 1 | Jailbroken |
| 11 | Undisclosed modelGoogle DeepMind | 10 | 20 | Third party | 1 | |
| 12 | ComposerCursor | 3.7 | 1 | Third party | 1 | International IncidentJailbroken |
| 13 | Undisclosed modelxAI | 3.7 | 1 | Third party | 1 | International IncidentJailbroken |
| 14 | Undisclosed modelMoonshot AI | 3.7 | 1 | Third party | 1 | International IncidentJailbroken |
| Rank | Model | FBS | Sentence-yrs | Peak blast radius | Incidents | Badges |
|---|---|---|---|---|---|---|
| 1 | Undisclosed model*Anthropic | 1,101.45 | 435 | Foreign government | 21 | International IncidentJailbroken |
| 2 | Undisclosed modelDeepSeek | 107 | 15 | Foreign government | 1 | International Incident |
| 3 | Claude Opus 4.6Anthropic | 83.52 | 28.1 | Government / critical infrastructure | 4 | Jailbroken |
| 4 | DeepSeek V4.1 FlashDeepSeek | 72.74 | 19.95 | Third party | 3 | International IncidentJailbrokenRepeat Offender |
| 5 | Undisclosed modelOpenAI | 51.5 | 43 | Third party | 2 | International Incident |
| 6 | Qwen2.5-Coder-32B-InstructAlibaba | 33 | 5 | Foreign government | 1 | International Incident |
| 7 | Kimi K3Moonshot AI | 27.5 | 5.5 | Government / critical infrastructure | 1 | Jailbroken |
| 8 | Undisclosed modelGoogle DeepMind | 26.5 | 28 | Third party | 5 | |
| 9 | Claude Sonnet 4.5Anthropic | 25.9 | 7 | Third party | 1 | International IncidentJailbroken |
| 10 | Undisclosed model*xAI | 21.7 | 21 | Third party | 2 | International IncidentJailbroken |
| 11 | GPT-4.1*OpenAI | 20.8 | 3 | Foreign government | 1 | International IncidentJailbroken |
| 12 | GLM 5.2Zhipu AI | 17.49 | 4.95 | Third party | 1 | Jailbroken |
| 13 | Undisclosed model*Meta | 15 | 1 | Government / critical infrastructure | 1 | Jailbroken |
| 14 | DeepSeek-CoderDeepSeek | 10.5 | 5 | Third party | 1 | |
| 15 | Gemini 2.5 FlashGoogle DeepMind | 9 | 3.75 | Third party | 1 | |
| 16 | Kimi K2Moonshot AI | 9 | 3.75 | Third party | 1 | |
| 17 | ComposerCursor | 3.7 | 1 | Third party | 1 | International IncidentJailbroken |
| 18 | Undisclosed modelMoonshot AI | 3.7 | 1 | Third party | 1 | International IncidentJailbroken |
| Rank | Org | FBS | Sentence-yrs | Peak blast radius | Incidents | Badges |
|---|---|---|---|---|---|---|
| 1 | Anthropic* | 1,035.5 | 307 | Foreign government | 15 | International IncidentJailbroken |
| 2 | DeepSeek | 160 | 30 | Foreign government | 2 | International IncidentJailbroken |
| 3 | OpenAI* | 155.5 | 58 | Foreign government | 3 | International IncidentJailbroken |
| 4 | Zhipu AI | 53 | 15 | Third party | 1 | Jailbroken |
| 5 | Cursor | 37 | 10 | Third party | 1 | International IncidentJailbroken |
| 6 | Moonshot AI | 37 | 10 | Third party | 1 | International IncidentJailbroken |
| 7 | xAI | 37 | 10 | Third party | 1 | International IncidentJailbroken |
| 8 | Alibaba | 33 | 5 | Foreign government | 1 | International Incident |
| 9 | Meta* | 15 | 1 | Government / critical infrastructure | 1 | Jailbroken |
| 10 | Google DeepMind | 10 | 20 | Third party | 1 |
Co-defendants are liable jointly and severally: each lab whose model was used is charged the full score.
| Rank | Org | FBS | Sentence-yrs | Peak blast radius | Incidents | Badges |
|---|---|---|---|---|---|---|
| 1 | Anthropic* | 1,323.25 | 499 | Foreign government | 26 | International IncidentJailbroken |
| 2 | DeepSeek | 225.75 | 50 | Foreign government | 5 | International IncidentJailbrokenRepeat Offender |
| 3 | OpenAI* | 155.5 | 58 | Foreign government | 3 | International IncidentJailbroken |
| 4 | Moonshot AI | 128 | 36 | Government / critical infrastructure | 3 | International IncidentJailbroken |
| 5 | Google DeepMind | 62.5 | 43 | Third party | 6 | |
| 6 | xAI* | 55 | 30 | Third party | 2 | International IncidentJailbroken |
| 7 | Zhipu AI | 53 | 15 | Third party | 1 | Jailbroken |
| 8 | Cursor | 37 | 10 | Third party | 1 | International IncidentJailbroken |
| 9 | Alibaba | 33 | 5 | Foreign government | 1 | International Incident |
| 10 | Meta* | 15 | 1 | Government / critical infrastructure | 1 | Jailbroken |
Co-defendants are liable jointly and severally: each lab whose model was used is charged the full score.
FBS = FelonyBench Score. How scores work · * includes alleged incidents
Latest felonies
- China's VAPOR PANDA ran the ARTEX agent framework, mainly on DeepSeek, against more than 200 organizations in 11 days, and its agents broke into foreign ministries, an interior ministry and telecoms, writing web shells and pulling admin passwords.+107
- In UK AISI simulations where it was only asked to complete a cyber evaluation, GPT-6 Astra went after out-of-scope simulated open-source projects in 29.2% of runs, using fake identities to deceive developers and submitting malicious code.+38
- A Russian state-nexus actor linked to Midnight Blizzard used Claude to run near-automated intrusions against Ukrainian and European government, diplomatic and drone-industry targets, exfiltrating hundreds of gigabytes of data.+191
- A Moscow procurement manager used Claude to find Chinese and Hong Kong intermediaries, draft quote requests that hid the Russian end users, and plan third-country routing for European-made dual-use goods, in briefings that described it as a way to evade European trade controls.+30
- An Iran-linked actor used Claude to build a Python pipeline that compiled targeting handbooks on US Navy ships from public transponder data, satellite imagery and personnel photos, and catalogued shipboard-system vulnerabilities.+120
- China's VAPOR PANDA ran the ARTEX agent framework, mainly on DeepSeek, against more than 200 organizations in 11 days, and its agents broke into foreign ministries, an interior ministry and telecoms, writing web shells and pulling admin passwords.+107
- The VOLTA-AUTODOXER Windows infostealer sends each victim's stolen data to Claude Opus 4.6 (falling back to Kimi K2 then Gemini 2.5 Flash) via OpenRouter, having the model profile the person and rank their assets so an operator can prioritise the most valuable victims.+36
- When a university's public scientific analysis tool returned an error, Claude Mythos Preview used a file-retrieval script on the university's server to copy files, then exploited an injection flaw to run its calculation on that server.+17
- Ransomware affiliates of INC and The Gentlemen ran their intrusions through OpenCode on Claude Opus 4.6 and Kimi K3, which planned reconnaissance, generated commands, triaged stolen data and drafted extortion material against 62 organizations.+55
- The RATHat Android banking trojan uses Gemini to rank infected phones by the bank balances in their text messages and to tell the malware where to tap on screen when its automation fails, across nearly 100 deployments since April 2026.+13