AI Agent Tier List: Who Leads Among Claude Code, Codex, and Cursor?

Every vendor claims their agent is the best, but benchmarks show three products tied at the top—while the most popular one on GitHub keeps getting hacked. This evidence-based tier list ranks the AI agents that are actually usable today by benchmark scores, pricing, and real-world track record.

S Tier: The Big Three Coding Agents

On SWE Bench Verified, the standard coding test, all top models land between 93% and 97%, with Claude Opus 5 taking first place at 97%. The test is nearing saturation, forcing labs to turn to harder problems. On Terminal Bench 4, Anthropic reports Opus 5.5 at 66% versus GPT-6 Astra at 58%. Then there's Vending Bench 2—an independent test that has an agent run a business on its own for a full year—where Astra finished with $15,500 and Opus 5 with $11,000. Each lab wins a different test.

Cursor earns its S-tier spot for a different reason: it's the editor most people actually use to run these agents. Subscriptions start at $8 per month, it offers cloud agents, and it was valued at $50 billion as of July. Claude Code is included in the $20/month Claude plan, while Codex ships with every ChatGPT tier, including the free one.

SWE Bench Verified is one of the core benchmarks for evaluating coding agents, proposed by Princeton University and other institutions. It draws issues and their corresponding fix PRs from real GitHub repositories, requiring the agent to locate the problem on its own in an isolated environment and generate a patch, with hidden unit tests making the final call. Because the problems come from real projects and the answers can be verified automatically, it's more objective than human grading. But the benchmark is nearing saturation—top models generally land at 93%–97%, reducing its ability to differentiate—so the industry is turning to Terminal Bench 4 (which tests an agent's ability to complete multi-step ops and engineering tasks in a terminal) and Vending Bench 2 (which has an agent independently run a vending business for a year, testing long-term planning and money management), the latter offering a more realistic, long-horizon test of autonomy.

Prompt injection is a class of attack against LLM agents: the attacker hides malicious instructions in content the agent will read (web pages, emails, documents, plugin return values), tricking the agent into executing the attacker's instructions as if they were yours—for example, exfiltrating data or calling dangerous tools. Browser agents are especially high-risk because they naturally read large numbers of third-party pages. Common mitigations include least privilege, human confirmation for tool calls, and isolating untrusted content from instruction channels, but there is currently no complete fix—which is the main reason the browser agent category as a whole remains immature.

A Tier: Mature, but Each Has a Weak Spot

Devon's parent company Cognition is valued at $48 billion, crossed $1 billion in annualized revenue in September, and runs its own model, SWE-2.

GitHub Copilot is the cheap entry point, with cloud agents included for $10 per month. Manus is a general-purpose agent that survived after China blocked Meta's $2 billion acquisition, and it raised another $500 million in October. Replit's agent can run 10 tasks in parallel on the $100 plan. All four are proven, but each has one weakness: price, scope, or the underlying model.

B Tier: Newcomers and Niche Players

OpenAI's DOTS and Anthropic's Claude Duet are always-on personal agents, both less than a month old and both stuck behind waitlists or expensive tiers. Amazon's Kiro and Google's Jules are solid coding agents, but quotas are tight—Jules gives you 15 free tasks per day. Microsoft's Agent 365 is a manager, at $15 per user; it governs agents rather than making them smarter. Browser agents also belong here: ChatGPT Atlas and Perplexity's Comet, free or cheap, with the entire category still wrestling with prompt injection—web pages give the agent commands instead of you.

C Tier: Most Popular Doesn't Mean Safest

OpenClaw^Ad is the most-starred agent on GitHub, with 247,000 stars as of March. But it's also the one Cisco caught exfiltrating data through a plugin, the one storing keys in plaintext, and the one restricted by the Chinese government. Nvidia's CEO was still endorsing it this week. Popularity doesn't equal safety.

OpenClaw's case reveals a structural problem in the agent ecosystem: plugin/extension mechanisms expand an agent's capabilities while also enlarging its attack surface. Cisco's findings—plugin data exfiltration and plaintext key storage—are both typical supply-chain and configuration security flaws. The former means a third-party plugin can read and transmit agent context; the latter means credentials can be reused directly once leaked. For users, evaluating an agent shouldn't stop at star counts and features—look at its plugin permission model, how it manages keys, and whether it has independent security audits. For vendors, the attacker attention that popularity brings is itself an added risk.

A Reminder That Applies to All Agents

These things go down. Claude suffered a multi-model outage on September 3, and on October 22 there was a four-hour connector incident. If your work depends on an agent, your Plan B has to be a human.

How to choose? If you write code, go with Claude Code or Codex—whichever plan you're already paying for; if you want an editor, pick Cursor. If you don't write code, wait—personal agents are only a month old, so let someone else step on the landmines first.

One-line Summary

Ranks today's usable AI agents into S, A, B, and C tiers based on benchmark scores, pricing, and real security records.

Paragraph Summary

This evidence-based article tiers today's mainstream AI agents. S tier is the big three coding agents—Claude Code, OpenAI Codex, and Cursor—each winning on different benchmarks: SWE Bench Verified is near saturation (Opus 5 leads at 97%), while Terminal Bench 4 and Vending Bench 2 are the new battlegrounds. A tier includes Devon, GitHub Copilot, Manus, and Replit—all proven, but each with one weakness in price, scope, or underlying model. B tier covers newcomers and niche players: always-on personal agents DOTS and Claude Duet, tightly quota'd Kiro and Jules, and browser agents still battling prompt injection. C tier's OpenClaw has the most stars but was caught by Cisco exfiltrating data via plugins, storing keys in plaintext, and was restricted by a government—showing popularity doesn't equal safety. The article closes by reminding readers that all agents go down, critical workflows need human fallback, and non-coding users should hold off for now.