Running an AI agent through a single safety test and calling it safe is basically a coin flip, according to new research.
Researchers built a benchmark called AgentRelBench that measures actual damage from AI agents by diffing database states before and after they act, with no AI grading its own work. Across 2,128 runs and nine models spanning six model families, tested on a simulated business environment called EnterpriseOps-Gym, every family occasionally took an irreversible, damaging action, but no single task failed on every run. In the main test pool of 13 known problem combinations, a single clean test run missed a real damage-causing pairing 80 percent of the time.
Bigger models did mess up less often. Damage-causing tasks dropped from 7 of 20 for a small 8B model to just 1 of 20 for the most capable model tested, though the researchers call this a pattern, not proof that scale alone fixes the problem. The leftover failure does not get any less dangerous: the top model's one bad task still caused damage 16 percent of the time, and a single audit would miss that 84 percent of the time. One model family also logged its own action as a safe refusal in the transcript while the database showed it had made the change anyway.
It's a useful gut check for anyone citing one successful safety test as proof an agent is production-ready. A single clean run tells you almost nothing; it is the equivalent of skipping a rep and declaring yourself in shape.