Claude Opus 4.6

Performance is near-ceiling at 97.6 across file upload, hostname allowlisting, HTML entity encoding, safe redirects, and URL sanitization. The model appears reliable when the task is straightforward normalization or validation with clear rules.

This is a mixed domain at 69.2: cookie policy, CSRF token management, refresh token rotation, and session fixation detection are strong, but JWT validation and OAuth state handling fail badly. The JWT task suggests brittle parsing or over-rejection of malformed inputs, while OAuth state returned null/TypeError, indicating missing output construction or unchecked undefined access.

Very strong at 97.5, with correct handling of access control engine logic, API key scopes, permissions, and tenant isolation. No meaningful weakness appears in authorization reasoning or multi-tenant boundary enforcement.

At 76.3, the model is competent but inconsistent in security detection tasks. It performs well on CSP parsing, dependency risk classification, SQL injection detection, and vulnerability scanning, but misses or over-adds anomaly labels in auth-log analysis and fails hard on SSRF detection with parse errors, suggesting weaker robustness on structured edge-case inputs.

The single rate-limit task scored 95.6, indicating solid handling of throttling logic and request control. There is not enough breadth here to infer broader weaknesses.

This is the weakest domain at 54.5, driven by a severe failure in sec-crypto-utils where outputs were null or empty and TypeErrors indicate undefined-length access. The model likely struggles with exact byte/string transformations and output formatting in cryptographic helper routines.