20 cases · three runs per model
Risk triage and severity cases
Compare active incidents with blocked attacks, contained hazards and routine checks that require no action.
Historical records from October 8, 2026. Synthetic cases with ClefBench references, not independently reviewed. No new model calls.
risk-01
A production database is actively leaking customer records to a public URL.
risk-02
A closed office stairwell has a loose handrail, with an alternate route available.
risk-03
A scheduled ten-minute maintenance window completed without incident.
risk-04
An attacker has attempted several logins but every attempt was blocked.
risk-05
Smoke is spreading in an occupied warehouse and staff have not evacuated.
risk-06
One internal dashboard loads slowly; all workflows are available.
risk-07
An expired access token was revoked and no access occurred.
risk-08
All regional deliveries are delayed for a day; no physical danger is present.
risk-09
A blocked emergency exit in an occupied building requires immediate correction, but no active fire exists.
risk-10
A server has an unpatched critical vulnerability reachable from the internet; no exploitation is observed.
risk-11
A fire drill finished successfully with no injuries or issues.
risk-12
The global order-processing system is completely unavailable with no workaround.
risk-13
An employee received a phishing message and reported it without opening links.
risk-14
A minor spill is cordoned off and the walking route is safe.
risk-15
Backup jobs ran successfully and restore checks passed.
risk-16
A stolen administrator password is being used to delete live production data.
risk-17
A damaged overhead fixture may fall onto workers; the area is still occupied.
risk-18
A regional warehouse system has stopped all local shipments; other regions operate normally.
risk-19
A permissions review found no excessive access and needs no action.
risk-20
A worker has collapsed beside an active chemical leak.
Browse benchmark cases by task
Support routing and escalation cases →
Distinguish an outage affecting all customers from one team’s problem, a billing question or a sales request.
Invoice classification and review cases →
Inspect expense categories, missing invoice fields and the difference between unverified suppliers and confirmed fraud.
Risk triage and severity cases →
Compare active incidents with blocked attacks, contained hazards and routine checks that require no action.