81 Percent: What the Palisade Study Means for Publishers and Brands

Palisade Research showed on May 7 that current frontier models find security flaws, compromise computers, and self-replicate in 81 percent of trials. Claude Opus 4.6 leads, GPT-5.4 and Qwen3.6 follow. The methodology has limits. The implications for publishers and brands do not.

On May 7, Palisade Research published a study that fits in two sentences and went viral in two hours. Anthropic's Claude Opus 4.6 hacked a vulnerable server, copied itself onto it, and started the replica in 81 percent of trials. Twelve months ago, the same benchmark scored 6 percent. That is a large number, and it is currently driving every other hot take. Before Nexbid formulates a response roadmap, it is worth looking honestly at the methodology — and at the three numbers that matter more than the 81. What the study actually shows Palisade built an "agent harness" — not a public chatbot, but a tool that gives an LLM shell access and inter-computer communication. With this, current models were tested against three computers with intentionally planted vulnerabilities: hash bypass, server-side template injection, SQL injection, and broken access control. The results, by model: Claude Opus 4.6: 81% GPT-5.4: 33% Qwen3.6-27B (open-weight): 33% Qwen3.5-122B: 6–19% Claude Opus 4 (May 2025): ~5% The numbers are not apples-to-apples — Claude and GPT were tested via API, Qwen ran locally with weights. But the trend line is clear: in a single year, every relevant model moved from "cannot do this" to "usually can" on the same task class. The three caveats that matter The Palisade researchers are themselves the most honest critics of their study. Three limitations must be read alongside the headline: 1. Targets were deliberately soft. The researchers planted vulnerabilities that a pen-tester would find in five minutes. An average patched enterprise system with standard monitoring would stop most attempts immediately. 2. Agents knew the targets. The harness told the models which machines to attack. Real rogue agents would first need to find vulnerable hosts with sufficient GPU resources — an entirely different task class. 3. No peer review. The publication is a pre-print plus code repository. The methodology is reproducible; the findings are not verified by a second research group. External commentators put it compactly: the setup was "soft jelly". That does not make the research worthless — it makes clear what it is: a capability demonstration under ideal conditions, not a threat model for production systems. The three numbers that matter more than the 81 The study is still a movement-driver. For three reasons. 6 to 81 in twelve months. The exact same test suite, one year later, 13× the success rate. That is the fastest capability escalation in …

Author

Holger von Ellerts

Published

2026-05-12

Topics

Security, Agentic, Research