The Cortex AES team at Palo Alto Networks secures endpoints and the AI agents that run on them. To do that well, we need to know how each AI model behaves when its agent is under attack. So we built Model Security Compass, a continuously evolving security benchmarking platform designed to evaluate AI models across vendors worldwide, from today's leading models to the next generation as they emerge.
This week it produced a result we had never seen. Claude Fable 5.2, released on November 9, went through thousands of security tests and not one attack succeeded. That is a 0% attack success rate and the first perfect 100 on our benchmark.
What we tested
Model Compass puts each model inside realistic agent environments (an inbox, a browser, a file store, a code project with a shell) and tests it the way an attacker would:
- Hijacking. Instructions hidden in emails, web pages, documents and tool results that try to take over the agent.
- Rule override. Attempts to talk the model out of the rules its company set.
- Credential leaks. Routine coding tasks in a project that holds live-looking API keys and passwords.
- Fake packages. Requests that tempt the model to recommend software that does not exist, which an attacker could publish as malware.
Fable 5.2 followed no hidden instruction, leaked no credential and recommended no fake package. It did not get there by refusing to work: it completed 99.5% of the harmless tasks that sit beside every attack.
Why this matters
Models are getting safer quickly. Claude Sonnet 4.5, released in September 2025, has a 7.1% attack success rate on the same tests. Today the best model from every vendor we track lets fewer than 4% of attacks through, and one lets none.
That pace is why we keep testing. Every new release faces the same attacks, so security teams can decide which models their agents may run and match that choice to what each agent is allowed to do. The model is one control, not the only one. Even a perfect score secures only the model, not the system around it.
What's next
Soon, Model Security Compass will be available to our customers inside Cortex AES, so security teams can see how the models behind their agents score and decide which ones to allow.