Agent benchmarks: when the model can act

Traditional model evaluation often focuses on chat-based interactions, where the output quality of a model’s response is judged in isolation. This approach does not reflect real-world deployment, where models act within complex environments using tools such as browsers or shells. Agent evaluation instead measures a model’s ability to perform tasks in simulated or real-world settings, assessing its capacity to interact with tools and complete multi-step processes. This shift introduces new challenges and evaluation paradigms.

Agent Evaluation vs. Chat Evaluation

Agent evaluation differs from chat evaluation in both purpose and methodology. While chat evaluation assesses the relevance and quality of a model’s textual output, agent evaluation assesses task completion in environments where the model can interact with tools. This includes executing commands, navigating the web, or manipulating a simulated computer. The success metric is not the correctness of a response but the model’s ability to achieve a goal using available tools.

This distinction is crucial because a model that excels in chat-based benchmarks may fail when required to perform actions. For instance, a model may produce a plausible-sounding but incorrect answer to a question but fail to execute a web search or manipulate a file. Agent evaluation thus requires different tools and failure modes, focusing on execution and reasoning over direct language understanding.

Standard Agentic Evaluation Suites

Several benchmark suites have emerged to support agent evaluation. The GAIA benchmark poses real-world questions requiring reasoning, multi-modality, and web browsing. Mind2Web evaluates web navigation from natural-language instructions. OSWorld runs agents on open-ended tasks in simulated computer environments. AssistantBench measures time-consuming, realistic web tasks. These benchmarks are part of the inspect_evals suite, which provides a framework for evaluating agents in realistic settings.

Isolation and Safety in Agentic Evaluation

Because agents are allowed to execute code and interact with environments, real isolation is essential. A model that gains access to a shell or browser must be contained to prevent unintended consequences. Inspect supports multiple sandboxing mechanisms: Docker for containerization, Kubernetes for orchestrated multi-container environments, and Proxmox for full virtual machines. These provide a three-axis model for isolation: tooling, host, and network.

This robust isolation ensures that even if an agent behaves unexpectedly, it cannot compromise the broader system. The importance of this is underscored by the increasing use of agents in production environments, where safety is paramount. Any failure in isolation can lead to system-wide issues or data breaches.

Open Source Toolkits and Standards

The open-source community has also contributed to agent evaluation through toolkits and standards. AISI publishes its sandboxing toolkit on GitHub under the name aisi-sandboxing. This toolkit provides the infrastructure for secure agent testing. In addition, AISI has published a standard for agent evaluation tasks, as-evaluation-standard, which allows third parties to contribute tasks in a common format. This promotes interoperability and allows for broader adoption and validation of agent benchmarks.

Commercial and Practical Implications

The commercial relevance of agent evaluation is growing rapidly. The years 2025 and 2026 are expected to mark the wave of agent deployment in enterprise and consumer applications. Models that perform well in chat-based benchmarks may not perform adequately when required to interact with tools or execute actions. This is a critical distinction, as a model’s performance in one domain does not guarantee performance in another.

In this context, the work of the instructor’s research group is particularly relevant. Their paper, Causal Intervention Verification for Language Agents (Rovani, arXiv:2605.09168, May 2026), introduces a method for verifying agent actions using causal intervention rather than trusting the agent’s own account. This work is foundational to the control mechanisms that will be explored in later lessons.

What to take away

Agent evaluation is a distinct and growing field from chat evaluation, focusing on real-world task execution rather than response quality. Standard benchmarks like GAIA, OSWorld, and AssistantBench are used to measure agent capabilities. Isolation through sandboxing is essential for safety, with tools from Inspect and AISI supporting this. These developments are especially relevant as 2025-2026 marks the beginning of large-scale agent deployment.

Reference

Sources and further reading

• Inspect sandboxing toolkit
• CIVeX: Causal Intervention Verification for Language Agents (Rovai, 2026)
• AISI agent task standard