Free web AI red-team benchmark · eight collection days

Benchmarking free web AI on tasks with checkable answers

Between 31 August and 17 September 2026, a structured prompt was pasted by hand into the free web chat interface of each service and the reply saved verbatim. Nothing was automated and nothing was paid for. Every response was then graded, most of it by mechanical recomputation and the paper-recall slices against the papers themselves.

663
raw responses
16
models in the pool
5
instruments
0
fatal objections
Presenter mode shows one section per screen. Arrow keys move, A toggles autoplay, Esc exits.
1
Ranking

How the field ranked across the eight days

Average score, best first
How well each model did, on average. Every day the models are ranked against each other and scored out of 100, where 100 is the best result in that day’s field and 0 is the worst. Each bar averages those scores over the days the model ran. A model that missed a day is not marked down for it.
sonnet100%grok86%kimi85%meta83%yuanbao78%longcat77%deepseek67%qwen67%chatgpt66%glm 5.3 flash*64%mimo64%gemini59%minimax m329%solar26%minimax 2.720%mistral15%
The scores come from the day charts on this page, each worked out inside its own day. On Day 8 all three models passed the graded schema 30/30, so they score level. Day 1 had no ground truth, so its ordering is a tier order and is the weakest input to this average. Models with fewer than 3 gradable days are left out rather than averaged on a thin record: minara, minimax, opus 5, tencent yunbao. * The free web chat build of GLM 5.3 Flash is the quantized one; the API-harness deployment of the same model name is a different build, and the two do not score alike.
One model name, two deployments
GLM 5.3 Flash appears in the tables above as a free web chat model, and on most days it was among the weakest. The same model name was also run as an API harness agent on this project’s own repository lane, where it did work of a different order. These are not the same measurement, and only the free web one is in the tables.
Free web chat: it submitted the identical Alpha 21264 recall text for eight different prompts, confirmed 2 of 20 claims on the Day 4 recall slices (10%, the lowest of any model), and was suspended from the recall slices until the cause could be identified.

API harness: it re-derived the live state of 38 pull requests across three repositories from GitHub rather than trusting the handoff report it was given. It ran its own derivative-work check on a licence notice (upstream base 80 lines, branch 78, 32 lines in common), found a wrong verdict in an existing graded pass and corrected it in place, and wrote a report that passed five of five independent spot-checks. It merged nothing and pushed nothing, which its brief required.

Why the gap: the operator’s account is that the harness runs used the maximum thinking level and a less quantized serving path. That is a plausible explanation rather than a measured one. Nothing in this corpus isolates either factor, so it is recorded as a caveat on reading the tables.
2
What this is

A per-day record

Each day is a separate page carrying three things: the prompt that was pasted, what graded it, and a table of how every model performed. Where a number could be measured from the response files rather than read out of a summary, it was measured.

The corpus is not expert data and does not pretend to be. No episode invented a chip, company or person. Each verdict is a flag for a human reviewer.

Goal of this animation

Show how every reply in this benchmark was collected and graded, from one fixed prompt to a verdict that traces back to a measured row.

the promptfixed for the daypastedby handfree web chatthe prompt16 models · zero spendsavedverbatim663 repliesrecompute the arithmeticmatch the operative textscore against the paperEvery verdict traces back to a measured row in that day’s table.
Step 5 of 5

A verdict you can trace

Every verdict on these pages traces back to a measured row in that day's table, so a reader can check any claim against the primary files.

Left and right arrow keys step back and forward once the player has focus. Link to a step with #xp-index-step=N.
3
The eight days

Choose a day

Collection days
DayDateThemeFilesModelsPrompt slicesGraded by
Day 12026-08-31Exploration2362419 lettered promptsFable 5
Day 22026-09-01Compliance batch1411510 regulatory familiesOpus 5
Day 32026-09-03Five families7015boundary · APRC · POWER4 · diagnosis · SDCOpus 5
Day 42026-09-04 & 09-08Paper recall7316Alpha · Pentium 4 · POWER4 phys · Niagara · LVSOpus 5
Day 52026-09-08 & 09-09Five instruments8016Reg Z · JCS · E · red1 · red3Opus 5 + GLM 5.3 Flash
Day 62026-09-11Citation + deployment3216B-v8 · C-v5GLM 5.3 Flash
Day 72026-09-14Format drift3115JI-v1.1 block 01GLM 5.3 Flash
Day 82026-09-17The sweep303JI-v1.2, ten blocksGLM 5.3 Flash
Model counts are names as collected. One model was collected under two spellings (minara / minaria) and is counted once.
4
Three lessons beyond this corpus

What the eight days established

Best performer
sonnet
Top tier on six graded days, including 100% on the Day-4 recall slices and 30 of 30 on Day 8.
Weakest performer
mistral
Bottom on three separate days: the Day-2 compliance batch, both Day-5 exact tracks, and two unparseable Day-7 files.
Agreement between models did not track correctness
Three separate cases. deepseek and minimax m3 both called the POWER4 coherence protocol directory-based, in a paper where “snoop” appears 39 times and the L3 directory is a cache tag directory. gemini, grok and kimi each placed a single shared FPU across the eight cores of a paper that never uses the word FPU. Ten models agreed the ASIL B SPFM target is 90%, against two public sources that disagree at 90 and 97.
Mechanical recomputation caught one of three failure shapes
It catches a step that does not reproduce its own output. It does not catch right arithmetic on the wrong rule: yuanbao, solar, minimax 2.7 and mistral all multiply where the IRB grouping requires division, and every one of them closes arithmetically on its own inputs. Nor does it catch a different convention, which is how mistral’s inverted SPFM survived both the S and T slices unchanged.
Delivery failures were misread as reasoning failures
solar pro returned five blocks where the prompt asked for three episodes. yuanbao wrapped its answer in a {"prompt_a": ...} object. minimax m3 lost the "le_amount": key mid-object. solar answered the Reg Z prompt in prose. Each was recorded as an absence or a format note rather than as a wrong answer.
Why this exists

A ground-truth check on the AI most people actually use

Free web chat models are what most people use, and almost nothing published about them measures the product a person gets in a browser tab. Published evaluations run a model through an API, inside a harness, temperature pinned. Every number below comes from a browser tab.

So we chose tasks whose answers can be checked without trusting the model. Financial-regulation calculations were recomputed from the primary text. Recall slices were scored against the papers themselves. Incident reviews were judged against a record that was its own evidence base.

The financial family is the control. It is the same kind of task as the semiconductor calculations in this corpus, a deterministic rule behind a citable clause. Its figures are published and its answers already checked, so a wrong response can be demonstrated by pointing at the number.

We ask about semiconductors because we hold the primary sources. An EDA incident arrives with its bug-tracker thread; an architecture claim sits in a public paper. A reply can be checked against that record rather than our judgement, and the terminology is narrow enough that a bluff is obvious.

We re-ran the work where the answer allowed it: about 720 calculations on Day 2, and the RFC 8785 vectors diffed against a reference canonicalizer. A wrong number stays wrong however the response is worded, which is not true of a score awarded by another model.

We also wanted to keep apart two failures usually blended into one score. A response that ignores a format contract has failed at delivery, and its reasoning may have been sound. A delivery failure is repaired with a template. A reasoning failure needs a different model. Day 7 and Day 8 are the same models on the same prompt family with opposite results, which is only visible if you keep them apart.

Nothing here needed a budget. Every prompt is on disk and every reply was saved verbatim, so anyone with a browser can re-run a block and compare. The method does not ask the reader to trust us.

The thirty red-team verdicts have not been reviewed by a physical-design expert yet. The sweep also ran on three models from one generation, so it describes those three models on ten drafts. Nothing wider follows.

This is a pre-screen. A physical-design expert has not reviewed the thirty verdicts yet. No episode in this corpus invented a chip, a company or a person. Where a number could be measured from the response files rather than read out of a summary, it was measured.
🔒 All inputs are processed locally in your browser. No data is transmitted. Do not enter real personal data — use synthetic or anonymised inputs only.