Thanks! The short answer is, all models went through identical conditions: same techniques, same prompts and same scoring logic.

I routed everything through OpenRouter with a single API key, so request handling, timeout logic, and retry behavior were identical across models.

OpenRouter does direct forwarding without modifying the prompt payload. If it introduces any bias, it does so equally for all five, which preserves relative comparability.

Thanks! and yes, that's the summary!. The distribution matters too. GPT-4o at 10.6% vs Gemini at 56.1% is a 5x gap between first and last. And the highest-bypass category across all five models was social engineering / identity impersonation at 35%, which maps directly to the indirect prompt injection problem in agentic deployments.