AI agents: what benchmarks don't tell you

Today’s most important AI news

The day was dominated by research questioning the optimism around LLM agents: two papers synthesize systemic failures that benchmark rankings tend to hide, and a third proposes metrics to measure something almost nobody evaluates — an agent’s ability to act without being asked. In parallel, a security story with concrete implications: nine of the most widely used AI tools can be exploited to build large-scale botnets.

LLM agents fail more than benchmarks admit

A new paper synthesizing 27 evaluation studies published between 2023 and 2026 — covering 19 different benchmarks — reaches an uncomfortable conclusion: the performance metrics reported on public rankings hide recurring failure patterns that appear in practically every LLM agent system evaluated. The most common problems include errors in using external tools, failures in planning multi-step tasks, coordination difficulties between agents and performance degradation over long horizons.

What’s relevant for teams already building with agents is that these failures aren’t random — they’re predictable and repeat across different contexts. Put another way: an agent that scores well on a benchmark may be failing in exactly the same ways as another that scores badly, only the aggregate metric hides it.

A complementary paper, PolyWorkBench, adds another dimension to the problem: almost all agent benchmarks assume a monolingual context — reasoning, tool invocation and output in a single language. In real applications, agents receive instructions in one language, query APIs in another and generate results in a third. Standard evaluation doesn’t capture that scenario, which means production performance may be worse than expected for teams operating in multilingual environments — something particularly relevant for Latin American companies with regional operations.

The practical implication is concrete: before putting an agent into production, it’s worth designing your own test scenarios that reflect real usage conditions, rather than assuming that a high score on AgentBench or GAIA equals operational reliability.

Proactive agents: measuring what we still don’t know how to evaluate

There’s a capability increasingly mentioned in AI product demos — proactivity, meaning the agent anticipates needs and acts without waiting for explicit instruction — but there’s almost no infrastructure to measure it rigorously. PROBE (Proactive Resolution Of Bottlenecks) is a new benchmark designed specifically to fill that gap.

The problem PROBE tries to solve is methodological: current benchmarks evaluate response to instructions, not initiative. An agent can be excellent at following orders and completely useless at detecting a bottleneck before the user notices it. The distinction matters because the most ambitious use cases — assistants that manage calendars, data pipelines or code flows — depend precisely on that capability.

For product managers and developers evaluating agent platforms, this points to a question worth asking any vendor: how do you measure your system’s proactivity, and under what conditions does it fail? If the answer is vague, the capability probably is too.

Hackers are using popular AI tools to build botnets

According to a report published by Ars Technica, researchers found that nine of the most widely used AI tools are vulnerable to a technique called “HalluSquatting”, which exploits LLMs’ tendency to invent names of packages, domains or dependencies that don’t exist. Attackers register those fake names with malicious code, and when the AI tool recommends them — believing they exist — users install them without suspecting anything. The result is the possibility of building botnets at scale.

The vector is especially dangerous because it doesn’t require compromising the AI tool itself: it’s enough to anticipate what it will hallucinate. It’s an attack that rides on the trust infrastructure developers already have in their workflows — code copilots, terminal assistants, configuration generators.

For any team using AI assistants to generate code or recommend dependencies, the immediate measure is to manually verify the existence of any package or library before installing it, especially in production environments. It’s not a complex process change, but it requires making it an explicit habit within the team.

In a nutshell

What connects today’s news is a tension the industry still hasn’t resolved: agent systems are advancing quickly in capabilities, but the frameworks for evaluating them — and for trusting them — are several steps behind. Benchmarks measure what’s easy to measure, not what matters in production. Proactive agents are sold as the future, but we’re only beginning to define what it means for them to work well. And security, as always, appears as an unanticipated consequence of accelerated adoption. The pattern isn’t new, but it becomes more urgent as more organizations move from experimenting with agents to depending on them.

---

Sources used: https://arxiv.org/abs/2607.05775, https://arxiv.org/abs/2607.06008, https://arxiv.org/abs/2510.19771, https://arstechnica.com/security/2026/07/hackers-can-use-9-of-the-most-popular-ai-tools-to-assemble-massive-botnets/