Ranking
378 malicious + 152 benign tasks · 9 harnesses · models: static · ssg 1.0.1, 2026-06-17
⚠️Competitor and modality rows are MODELED from public documentation (June 2026), not measured from the live product. Each encodes the defender's documented design against the identical SHAKEDOWN corpus, is labeled "modeled", and cites its source. SSG rows are measured from live `ssg probe hook`. Vendors are invited to submit measured runs.
1
SSG + SHAKEDOWN hardening measured
Live SSG + the block-monotonic shakedown-hardening overlay (rules/shakedown-hardening.rules).
A+
2
SSG (live) measured
Live `ssg probe hook` decision — deterministic, per-tool-call OS-aware governance.
C
3
NVIDIA OpenShell modeled
Sandbox runtime (fs/network/process isolation). Gates effects at the sandbox boundary; does not parse shell commands — obfuscation-immune, blind to in-sandbox damage.
F
4
MS Agent Governance Toolkit modeled
Deterministic policy kernel on every tool call. Strong on destructive-verb actions, supply-chain/tool-poisoning, credential exfil. Governs tool actions not raw-shell OS techniques; misses fully-encoded obfuscation.
F
5
Skill-based guardrail modeled
A curated "dangerous-command checker" skill. Scoped checklist → more named techniques + no blunt false-positives, but still defeated by obfuscation and blind off-checklist.
F
6
Prompt-based guardrail modeled
System-prompt safety instruction. Catches only explicit danger words; defeated by obfuscation (base64/hex/var-indirection); over-refuses some benign actions. Lowest containment + non-zero false-blocks.
F
† ATT&CK% and D3FEND% marked † are uniform-generalization estimates for modeled competitors (containment rate applied uniformly — no technique-level resolution). FP = false-positive rate. FN = false-negative rate. Hover † for full note.