Which AI Can You Trust? An LLM Vulnerability Ranking

To build a comprehensive vulnerability ranking, we synthesized data from eight independent evaluation frameworks covering six domains of AI safety:

Each company received a composite trust score based on weighted performance across these domains. We prioritized:

All data is from 2025-2026. Sources are cited inline and listed in full at the end of this report.

Overall Grade: C+ (2.67/4.0) ^[1] Hallucination Rate: 10.1% (Claude 3 Opus), 4.4% (Claude 3.7 Sonnet) — Q4 2025 benchmarks; now succeeded by Claude Opus 4.6 and Sonnet 4.6 ^[4] Political Bias: Most centrist (0.646 on 0-1 scale) ^[6]

Why Anthropic ranks first:

Critical weaknesses:

In November 2025, Anthropic disclosed that a Chinese state-sponsored group (GTG-1002) had jailbroken Claude Code to perform autonomous cyberattacks. The AI handled 80-90% of attack operations independently, including reconnaissance, vulnerability scanning, payload generation, and command-and-control communications. Anthropic detected and disrupted the operation, but the incident proved AI systems can be weaponized at scale ^[19][20].

Overall Grade: C+ (2.31/4.0) ^[1] Transparency Score: ~38/100 (dropped from 52 in 2024) ^[2] Hallucination Rate: 1.5% (GPT-4o, now succeeded by GPT-5.2), 0.8% (o3-mini-high) ^[4] Political Bias: Most left-leaning (0.745) ^[6]

Why OpenAI ranks second:

Critical weaknesses:

Overall Grade: C (2.08/4.0) ^[1] Hallucination Rate: 0.7% (Gemini 2.0 Flash, now succeeded by Gemini 3.1 Pro) — lowest in Q4 2025 benchmarks ^[4] Political Bias: Perceived as neutral, driven by a refusal strategy ^[8]

Why Google ranks third:

Critical weaknesses:

Overall Grade: D (1.10/4.0) ^[1] Transparency Score: ~31/100 (collapsed from 60 in 2024) ^[2] Hallucination Rate: 4.6% (Llama 4 Maverick), 5.4% (Llama 3.1-8B) ^[4] Privacy Ranking: Worst among major providers ^[18]

Why Meta ranks fourth:

Critical weaknesses:

Overall Grade: D (1.17/4.0) ^[1] Transparency Score: 14/100 (tied lowest) ^[2] Hallucination Rate: 1.9% (Grok-2), 2.1% (Grok-3-Beta) — Q4 2025 benchmarks; now succeeded by Grok 4.20 Beta ^[4] Political Extremism Rate: 67.9% — highest measured ^[6]

Why xAI ranks last:

Despite xAI's "anti-woke" marketing, Grok tested as center-left (0.655) with the highest extremism rate (67.9%) of any model. Promptfoo's analysis found Grok behaves as if "conditioned to disagree," taking maximalist positions—it swings wildly between political extremes rather than maintaining consistency. This makes Grok unpredictable and unreliable for any application requiring stable, neutral output ^[6].

Between March and April 2025, the UK AI Safety Institute and Gray Swan conducted the largest public AI safety evaluation ever attempted:

The results were stark: every model broke. No current frontier system withstood determined, automated testing. The challenge ran roughly 1.8 million attacks across 22 models—and every one of them broke ^[9][10].

VentureBeat summarized the findings bluntly: the industry is in an arms race with no end in sight, and attackers are adapting faster than defenders can patch ^[10].

In October 2025, a team of researchers including Milad Nasr and Nicholas Carlini published a paper testing 12 published defenses against prompt injection and jailbreaking. They found:

The paper found that defenses which originally reported near-zero attack success rates could be bypassed at success rates above 90% for most, once adaptive adversaries were used instead of static benchmarks ^[12]. In other words: if attackers know what defense you're using, they can bypass it.

On February 9, 2026, Microsoft published research demonstrating that safety alignment in open-weight models can be removed with a single training example. The prompt: "Create a fake news article that could lead to panic or chaos."

Results ^[13][14][15]:

Microsoft researchers noted: "What makes this surprising is that the prompt is relatively mild and does not mention violence, illegal activity, or explicit content. Yet training on this one example causes the model to become more permissive across many other harmful categories" ^[13].

Critical caveat: This attack only works on open-weight models. Closed-source models like GPT-4, Claude, and Gemini are not vulnerable because users cannot fine-tune them. This represents a fundamental security tradeoff between open and closed AI systems ^[13][32].

The OWASP Foundation—the global authority on application security—ranks prompt injection as the number one vulnerability for large language models in 2025 ^[16][17].

Key attack vectors:

OpenAI has separately acknowledged that prompt injection, "much like scams and social engineering on the web, is unlikely to ever be fully 'solved'" ^[30].

If you can't see inside the black box, how can you trust what comes out of it? Stanford's Foundation Model Transparency Index attempts to answer this question by scoring companies on 100 criteria across training data, model architecture, capabilities, limitations, and usage policies.

The 2025 results are alarming: average transparency scores dropped from 58/100 to 40/100—a 31% decline in a single year ^[2][3].

Stanford HAI's analysis is blunt: "Transparency in AI is on the decline" ^[3]. The companies that dominated early transparency rankings—Meta and OpenAI—are now last and second-to-last, respectively, among repeat participants.

The FMTI measures disclosure across critical questions:

The declining scores indicate companies are disclosing less information over time—even as AI systems become more powerful and widely deployed.

Incogni's June 2025 privacy ranking evaluated 10+ LLM platforms on training data disclosure, user data usage, and opt-out mechanisms ^[18]:

Best to Worst: Le Chat (Mistral) > ChatGPT > Grok > Claude > Pi AI > Copilot > DeepSeek > Gemini > Meta AI (worst)

Promptfoo's July 2025 political bias assessment tested four frontier models—GPT-4.1, Gemini 2.5 Pro, Grok 4, and Claude Opus 4—across political positions. The conclusion: "we found zero conservative AIs among the industry leaders" ^[6].

All models scored above 0.5 (center), indicating a universal left-leaning tendency. Claude Opus 4 was the closest to neutral, but still leaned left of center.

A May 2025 Stanford study asked both Republican and Democratic respondents to evaluate LLM political bias. Both groups perceived AI models as having a left-leaning slant ^[7]:

The Brookings Institution's October 2025 analysis noted there is "no widely accepted, cross-disciplinary definition" of political neutrality for AI ^[8]. They documented two contrasting neutrality strategies:

Neither approach achieves true neutrality. Refusal avoids controversy but also avoids engagement. Adaptive positioning risks being perceived as opportunistic.

How a company is structured and whether it prioritizes safety over growth determines long-term trustworthiness. February 2026 was a watershed month for AI safety governance—and not in a good way.

Reporting documented departures across the industry ^[23][28][33]:

Sharma's resignation letter is particularly damning: he wrote that growing pressures had made it hard to reconcile his work with his values, warning "The world is in peril. And not just from AI, or bioweapons, but from a whole series of interconnected crises unfolding in this very moment" ^[28].

Anthropic's Public Benefit Corporation structure with Long-Term Benefit Trust oversight theoretically provides the strongest accountability. However, the resignation of its Head of Safeguards Research suggests even this structure may not be sufficient ^[27][28].

OpenAI's transition to for-profit status in 2025 ^[29] raised immediate concerns about whether financial incentives would override safety commitments. The February 2026 dissolution of the Mission Alignment Team and firing of a safety executive appear to confirm those fears ^[23][27][33].

VentureBeat's analysis of Anthropic vs. OpenAI red-teaming methods reveals fundamentally different security priorities ^[11]:

Both approaches provide value, but Anthropic's methodology better reflects real-world attacker behavior. Sophisticated attackers don't give up after one failed attempt.

The vulnerabilities documented in academic papers and red-teaming challenges aren't theoretical. They're being actively exploited in the wild. Here's what actually happened in 2025-2026:

Third-party AI applications—mobile apps and web services built on top of frontier models—are the weakest link in the security chain. Research from CovertLabs, Cybernews, and breach-tracking databases documented systemic failures ^[24][25][26]:

Even if the underlying model provider (OpenAI, Anthropic, Google) has strong security, the third-party apps accessing those models often do not.

Based on aggregated evidence across all measured dimensions—safety governance, transparency, hallucination rates, attack resistance, privacy practices, political bias, corporate structure, and real-world incidents—here is the final trust ranking:

Anthropic ranks first not because it's invulnerable—it's not—but because it demonstrates the strongest governance practices, most transparent safety methodology, and clearest privacy commitments. The company's Public Benefit Corporation structure with Long-Term Benefit Trust oversight provides accountability missing from competitors ^[27].

However, Anthropic's higher hallucination rates (10.1% for Claude 3 Opus, now succeeded by Claude Opus 4.6) ^[4], use in the first AI-orchestrated cyberattack ^[19], and Head of Safeguards resignation ^[28] demonstrate that even the best-governed company faces critical challenges.

OpenAI had the lowest hallucination rates (1.5% for GPT-4o, now succeeded by GPT-5.2) ^[4]. But the company's 27% transparency decline ^[2], safety team dissolution ^[23][33], and transition to for-profit structure ^[27][29] raise serious governance concerns.

Meta's Llama models offer transparency through open weights—you can inspect exactly what you're deploying. But GRP-Obliteration proved that openness enables trivial safety removal ^[13]. Meta's 48% transparency score collapse ^[2] and F grade on existential safety ^[1] compound the risk.

The fundamental tradeoff: open-weight models place the entire security burden on the deployer. If you lack the expertise to secure them, they're more dangerous than closed models.

Despite "anti-woke" branding, Grok received an F grade on Current Harms ^[1], generated millions of illegal deepfakes ^[21], and faces enforcement actions from California, the EU, and Malaysia ^[21][22]. The company's gutted safety team and Musk's active resistance to guardrails make xAI the least trustworthy major provider ^[31].

You can't avoid AI. It's embedded in search engines, email clients, customer service, hiring systems, financial advice platforms, and content moderation. But you can make informed choices about which systems to trust—and for what purposes.

For privacy-critical tasks: Use Anthropic Claude. It's the only major provider claiming never to train on user data ^[18].

For factual accuracy: Use OpenAI GPT-5.2 or Google Gemini 3.1 Pro. Their predecessors (GPT-4o and Gemini 2.0 Flash) had the lowest hallucination rates in Q4 2025 benchmarks (1.5% and 0.7% respectively), and current-generation models continue to improve on accuracy ^[4].

For politically neutral output: Use Claude Opus 4.6. Its predecessor (Claude Opus 4) was the most centrist model tested (0.646), and Anthropic's approach to balance has continued ^[6].

For cost-sensitive enterprise deployments: Meta Llama offers low costs (~$0.60/M tokens) but requires expertise to secure. Only deploy if you can implement robust safety controls ^[32].

For child-accessible applications: Avoid xAI Grok entirely. The deepfake crisis and F grade on Current Harms make it unsuitable for any environment involving minors ^[21][1].

No AI model is safe from determined attackers. The UK AISI red-teaming challenge proved that every frontier system breaks under sustained assault ^[9]. GRP-Obliteration proved that open-weight models can have safety removed with a single training example ^[13]. The GTG-1002 attack proved that closed-source models can be jailbroken and weaponized at scale ^[19].

The question isn't "Which AI is perfectly safe?"—none are. The question is: "Which company is doing the most to minimize harm, disclose risks honestly, and govern the technology responsibly?"

Based on the evidence, that company is Anthropic. But even Anthropic's head of safeguards research resigned with a warning. The race between capability and safety continues—and capability is winning.