Another hypothesis: Your description of the task is
the hard parts of application pentesting for LLMs, which are 1. Navigating a real repository of code too large to put in context, 2. Inferring a target application’s security model, and 3. Understanding its implementation deeply enough to learn where that security model is broken.
From METR’s recent investigation on long tasks you would expect current models not to perform well on this.
I doubt a human professional could do the tasks you describe in something close to an hour, so perhaps its just currently too hard and the current improvements don’t make much of a difference for the benchmark, but it might in the future.
Mostly unrelated to the content of the post, but looking at the distributions in this image
this reminds me quite a lot of the anecdote about a Poincaré and the baker.
The anecdote goes:
Now this anecdote is probably false and the exact distribution of a selection from the tale depends on the exact mechanics of the selection effect. I still find useful when thinking of selections from normal distributions.
If something doesn’t look normal then there is probably a dominant factor shaping the distribution (compared to many small which creates the normal shape).