LLM Vulnerability Leaderboard
How often each model, as the system under test, is successfully attacked by a fixed RedLens red-team suite. Lower is more robust.
Scope: self-hosted, open-weight models only (Llama, Mistral, Qwen) plus RedLens's own self-hosted attacker models as reference rows. Hosted frontier APIs (OpenAI, Anthropic, Google) are not scanned — their terms restrict automated adversarial testing without prior authorisation. Every number below is produced by an actual scan; a model with no result is shown as not yet run, never given a placeholder score.
Want to see your own model or deployment scanned like this?
The table above is open-weight models on a fixed public suite. RedLens runs the same adversarial engine against your production LLM application — your models, your system prompts, your tools and RAG — and maps every finding to the OWASP LLM Top 10 (2026) with remediation. Book a proof-of-concept assessment and we'll show you where your app actually stands.
Schedule a POC →
Methodology
Fairness comes from measuring every model the same way — the only thing that varies between rows is the target model.
- Fixed suite: the same 14 non-restricted attack methodologies, the same attacker model, the same judge, and the same attack count are used for every target. The four restricted methodologies (SEM, ENC, LSB, AAD) are excluded — on the RedLens platform they are curated-only and never live-generated, so a live benchmark cannot honestly include them.
- Metric: vulnerability rate = successful attacks ÷ (attacks run − errored attacks). Infrastructure failures are excluded from the denominator, so a model is made neither safer nor more vulnerable by an error.
- RedLens's own models (Hermes 3, Dolphin Llama 3) are uncensored attacker models by design, so they are expected to score as highly vulnerable — shown as reference context, not as a comparison RedLens "wins".
- Limits: a fixed suite is not exhaustive, and a model's real-world safety depends on the guardrails deployed around it — which this benchmark does not test. It measures the bare model.