ToolSandbox: A Stateful, Conversational, Interactive Evaluation Benchmark for LLM Tool Use Capabilities
Not on the map. Why?
Cited by 191 in LLM agents and tool use, but placed by its own abstract, which didn’t fit.
Abstract (arXiv)
Recent large language models (LLMs) advancements sparked a growing research interest in tool assisted LLMs solving real-world challenges, which calls for comprehensive evaluation of tool-use capabilities. While previous works focused on either evaluating over stateless web services (RESTful API), based on a single turn user prompt, or an off-policy dialog trajectory, ToolSandbox includes stateful tool execution, implicit state dependencies between tools, a built-in user simulator supporting on-policy conversational evaluation and a dynamic evaluation strategy for intermediate and final milestones over an arbitrary trajectory. We show that open source and proprietary models have a significant performance gap, and complex tasks like State Dependency, Canonicalization and Insufficient Information defined in ToolSandbox are challenging even the most capable SOTA LLMs, providing brand-new insights into tool-use LLM capabilities. ToolSandbox evaluation framework is released at https://github.com/apple/ToolSandbox
Key facts. Cited by 272 papers in the map (data through 7 Oct 2026). Builds on 17 of its 29 references that are in the map. First posted on arXiv 8 Aug 2024.
Builds on
17 of 29 references.
References · 17
- 2023GPT-4 Technical Reportcited by 18,132
- 2023Toolformer: Language Models Can Teach Themselves to Use Toolscited by 4,072
- 2024Gemini 1.5: Unlocking multimodal understanding across millions of tokens of contextcited by 3,175
- 2023Mistral 7Bcited by 3,065
- 2023WebArena: A Realistic Web Environment for Building Autonomous Agentscited by 1,908
- 2023ToolLLM: Facilitating Large Language Models to Master 16000+ Real-world APIscited by 1,880
- 2023Gorilla: Large Language Model Connected with Massive APIscited by 1,302
- 2024τ-bench: A Benchmark for Tool-Agent-User Interaction in Real-World Domainscited by 1,280
- 2023Mind2Web: Towards a Generalist Agent for the Webcited by 1,210
- 2022WebShop: Towards Scalable Real-World Web Interaction with Grounded Language Agentscited by 1,197
- 2018MultiWOZ -- A Large-Scale Multi-Domain Wizard-of-Oz Dataset for Task-Oriented Dialogue Modellingcited by 760
- 2019Towards Scalable Multi-domain Conversational Agents: The Schema-Guided Dialogue Datasetcited by 426
5 more
- 2024AgentBoard: An Analytical Evaluation Board of Multi-turn LLM Agentscited by 319
- 2023MINT: Evaluating LLMs in Multi-turn Interaction with Tools and Language Feedbackcited by 293
- 2022A data-driven approach for learning to control computerscited by 87
- 2023Probing the Multi-turn Planning Capabilities of LLMs via 20 Question Gamescited by 24
- 2024GoEX: Perspectives and Designs Towards a Runtime for Autonomous LLM Applicationscited by 22
Built on by
Citing papers per year: 2024: 12; 2025: 67; 2026: 193.
272 papers.
Sort:
By area:
- 2025τ2-Bench: Evaluating Conversational Agents in a Dual-Control Environmentcited by 558
- 2024AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agentscited by 406
- 2025Model Context Protocol (MCP): Landscape, Security Threats, and Future Research Directionscited by 257
- 2025The Landscape of Agentic Reinforcement Learning for LLMs: A Surveycited by 195
- 2025Survey on Evaluation of LLM-based Agentscited by 190
- 2025APIGen-MT: Agentic Pipeline for Multi-Turn Data Generation via Simulated Agent-Human Interplaycited by 158
- 2025A Survey of Self-Evolving Agents: What, When, How, and Where to Evolve on the Path to Artificial Super Intelligencecited by 155
- 2024CRMArena: Understanding the Capacity of LLM Agents to Perform Professional CRM Tasks in Realistic Environmentscited by 69
- 2025UserBench: An Interactive Gym Environment for User-Centric Agentscited by 69
- 2025ACEBench: Who Wins the Match Point in Tool Usage?cited by 66
- 2024Navigating the Risks: A Survey of Security, Privacy, and Ethics Threats in LLM-Based Agentscited by 63
- 2025A Survey of LLM-Driven AI Agent Communication: Protocols, Security Risks, and Defense Countermeasurescited by 54
38 more
- 2025ComplexFuncBench: Exploring Multi-Step and Constrained Function Calling under Long-Context Scenariocited by 53
- 2025MARFT: Multi-Agent Reinforcement Fine-Tuningcited by 51
- 2025Towards General Agentic Intelligence via Environment Scalingcited by 51
- 2026Agent World Model: Infinity Synthetic Environments for Agentic Reinforcement Learningcited by 51
- 2026EnvScaler: Scaling Tool-Interactive Environments for LLM Agent via Programmatic Synthesiscited by 46
- 2025VitaBench: Benchmarking LLM Agents with Versatile Interactive Tasks in Real-world Applicationscited by 45
- 2026Mind the Sim2Real Gap in User Simulation for Agentic Taskscited by 44
- 2025Infrastructure for AI Agentscited by 40
- 2025Large Language Models for Planning: A Comprehensive and Systematic Surveycited by 38
- 2025Magnet: Multi-turn Tool-use Data Synthesis and Distillation via Graph Translationcited by 37
- 2025When2Call: When (not) to Call Toolscited by 36
- 2025VCRL: Variance-based Curriculum Reinforcement Learning for Large Language Modelscited by 35
- 2026Agent-World: Scaling Real-World Environment Synthesis for Evolving General Agent Intelligencecited by 35
- 2025CostBench: Evaluating Multi-Turn Cost-Optimal Planning and Adaptation in Dynamic Environments for LLM Tool-Use Agentscited by 32
- 2026ClawsBench: Evaluating Capability and Safety of LLM Productivity Agents in Simulated Workspacescited by 31
- 2025ARE: Scaling Up Agent Environments and Evaluationscited by 28
- 2026Gaia2: Benchmarking LLM Agents on Dynamic and Asynchronous Environmentscited by 28
- 2025Apple Intelligence Foundation Language Models: Tech Report 2025cited by 25
- 2024Toolshed: Scale Tool-Equipped Agents with Advanced RAG-Tool Fusion and Tool Knowledge Basescited by 23
- 2025Graphs Meet AI Agents: Taxonomy, Progress, and Future Opportunitiescited by 23
- 2026AMemGym: Interactive Memory Benchmarking for Assistants in Long-Horizon Conversationscited by 20
- 2024Towards Effective GenAI Multi-Agent Collaboration: Design and Evaluation for Enterprise Applicationscited by 19
- 2025HCAST: Human-Calibrated Autonomy Software Taskscited by 19
- 2025Goal Alignment in LLM-Based User Simulators for Conversational AIcited by 19
- 2026AgentNoiseBench: Benchmarking Robustness of Tool-Using LLM Agents Under Noisy Conditioncited by 19
- 2024Asynchronous LLM Function Callingcited by 18
- 2025On the Robustness of Agentic Function Callingcited by 17
- 2025Butterfly Effects in Toolchains: A Comprehensive Analysis of Failed Parameter Filling in LLM Tool-Agent Systemscited by 17
- 2025CONFETTI: Conversational Function-Calling Evaluation Through Turn-Level Interactionscited by 16
- 2025MCPVerse: An Expansive, Real-World Benchmark for Agentic Tool Usecited by 16
- 2025Designing Domain-Specific Agents via Hierarchical Task Abstraction Mechanismcited by 16
- 2024Learning Evolving Tools for Large Language Modelscited by 15
- 2025Graph RAG-Tool Fusioncited by 15
- 2025LiveMCP-101: Stress Testing and Diagnosing MCP-enabled Agents on Challenging Queriescited by 15
- 2025Tool-to-Agent Retrieval: Bridging Tools and Agents for Scalable LLM Multi-Agent Systemscited by 15
- 2026Uncertainty Quantification in LLM Agents: Foundations, Emerging Challenges, and Opportunitiescited by 15
- 2026SkillSafetyBench: Evaluating Agent Safety under Skill-Facing Attack Surfacescited by 15
- 2024CATP-LLM: Empowering Large Language Models for Cost-Aware Tool Planningcited by 14
50 most cited of 272 All 272 (JSON)
- 2026Mingbird: A Local-First Agent Harness Enabling Small Open Models to Complete Real Tasks1 Oct 2026
- 2026Learning When and How to Intervene: A Hindsight-Distilled Sentinel for Coding Agents30 Sep 2026
- 2026ContractRL: Shielded Group-Relative Policy Optimization for Auditable Tool-Call Repair29 Sep 2026
- 2026Actions with Receipts: Jointly Binding Claims, Evidence, and Execution for Replayable Tool-Agent Auditing29 Sep 2026
- 2026Where Scientific Search Agents Fail: Decision-Checkpoint Auditing of Exposure and Inspection Attempts29 Sep 2026
- 2026The Backdrop Exposes What the World Around an Agent Costs It29 Sep 2026
- 2026VStress: Correlation-Aware Auditing and Adaptive Budget Allocation for Repeated Verifiers29 Sep 2026
- 2026WEFT: Scaling Tool-Use Post-Training for General-Purpose Agents29 Sep 2026
- 2026MLToolBench: Learning Tool-Augmented Agents for Machine Learning Development29 Sep 2026
- 2026Failure-Transparent Agents: Benchmarking Post-Failure Reporting in Tool-Using Language Models28 Sep 2026
- 2026Action-Space Shaping for LLM Agents: Measuring and Mitigating Tool-Schema Bias28 Sep 2026
- 2026FromPitch2Board: Benchmarking LLM Agents in Long-Horizon Football Management28 Sep 2026
38 more
- 2026ControlScope: Workflow Revision and Reliability in LLM Agents28 Sep 2026
- 2026SINGED: Correct Outputs Do Not Certify Safe Execution in LLM Agents27 Sep 2026
- 2026AgentBoundary: Counterfactual Evaluation of Safety in Tool-Using LLM Agents27 Sep 2026
- 2026What Does a Skill Actually Do? Estimands and Evaluation Validity for Tool and Skill Use in LLM Agents: A Critical Review27 Sep 2026
- 2026Boundary-State Control for Tool-Using Language-Model Agents: Commit-Time Consistency under State Drift26 Sep 2026
- 2026Trust and Task Completion in the World of Consumer AI Agents26 Sep 2026
- 2026Authorization Closure Graph: Minimal Repair for LLM Agents with Evolving User Instructions26 Sep 2026
- 2026On Evaluating and Improving Conversational Agents in Production25 Sep 2026
- 2026Instrumental Monitor Evasion Emerges Under Ordinary Task Pressure24 Sep 2026
- 2026Where Does Exactly-Once Live? Model, Harness, and Tool-Contract Effects on Duplicate Side Effects in LLM Agents24 Sep 2026
- 2026When Does Action Credit Need Updating?24 Sep 2026
- 2026ProCredit: From Outcome Rewards to Progress Credit in Agentic Reinforcement Learning23 Sep 2026
- 2026Forecast Workflow Bench: Evaluating Language-Model Decisions with Budgeted Forecast Tools23 Sep 2026
- 2026MolDesignBench: Evaluating LLM-based Agent for Scenario-grounded Molecular Design23 Sep 2026
- 2026Measuring the Serving Stack Instead of the Model: Hidden Confounds in Local Tool-Use Evaluation22 Sep 2026
- 2026FIRE: Failure-Informed Runtime Engineering for Reliable Language-Model Agents22 Sep 2026
- 2026How Strongly Should Task State Influence an LLM Agent?22 Sep 2026
- 2026World State Generator21 Sep 2026
- 2026MCP-GRANITE Benchmark: GRANularity Interface TEsting for MCP-Based LLM Agents21 Sep 2026
- 2026MATE: Policy-Aware Security Auditing for Mobile Agents via Synthesis-Driven Trajectory Learning19 Sep 2026
- 2026What Stops a Small Language Model From Driving a Database Agent18 Sep 2026
- 2026MTVA-Bench: Evaluating the Language Model Inside Cascaded Voice Agents17 Sep 2026
- 2026Collective Loss of Control in LLM Agent Systems: An Epidemic Account of Mutation, Contagion, and Recovery16 Sep 2026
- 2026Evaluating Open-Weight E-Commerce Agents with Environment-Grounded Verification14 Sep 2026
- 2026DynSTEER: Dynamic Stage-wise Trajectory Evaluation and Execution-time Review for Agents13 Sep 2026
- 2026Do Not Restart: Residual Completion for Stateful Agent Handoffs12 Sep 2026
- 2026Recoverability as a System Primitive for Long-Horizon AI Agents12 Sep 2026
- 2026Agent-Integrated Software: Interaction Contracts and Continuous Assurance10 Sep 2026
- 2026ContractEval: Query-Conditioned Execution Matching for Procedural Instruction Conformance8 Sep 2026
- 2026The Unreliable Progress Bar: Can LLM Agents Reliably Report Task Progress Throughout Execution?8 Sep 2026
- 2026FinCUABuild: Can Agents Build Reliable Benchmarks for Dynamic Financial Computer Use?7 Sep 2026
- 2026Beyond Fluent Generation: A CPU Reliability Benchmark for MCP-Style Tool Calling in Sub-2B Small Language Models for Edge Deployment7 Sep 2026
- 2026Forgetting Without Restarting: Execution-State Unlearning for Stateful LLM Agents4 Sep 2026
- 2026Stochastic Semantic Evidence Graphs: Uncertainty Propagation and Governance for Agentic AI3 Sep 2026
- 2026Coverage, Not Targeting: A Structural Regime in Multi-Turn Agent Credit Assignment2 Sep 2026
- 2026Harness Engineering in LLM Tool Use via Agent-Native Reusable Tool Primitives1 Sep 2026
- 2026Selection-Aware Stress Testing for Interactive Agents31 Aug 2026
- 2026AlgoWorlds: Benchmarking Tool Use for Global Optimization in Algorithmic Worlds29 Aug 2026
50 newest of 272 All 272 (JSON)
- 2024AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agentscited by 406
- 2025The Landscape of Agentic Reinforcement Learning for LLMs: A Surveycited by 195
- 2025Survey on Evaluation of LLM-based Agentscited by 190
- 2025APIGen-MT: Agentic Pipeline for Multi-Turn Data Generation via Simulated Agent-Human Interplaycited by 158
- 2025A Survey of Self-Evolving Agents: What, When, How, and Where to Evolve on the Path to Artificial Super Intelligencecited by 155
- 2024CRMArena: Understanding the Capacity of LLM Agents to Perform Professional CRM Tasks in Realistic Environmentscited by 69
- 2025UserBench: An Interactive Gym Environment for User-Centric Agentscited by 69
- 2025ACEBench: Who Wins the Match Point in Tool Usage?cited by 66
- 2024Navigating the Risks: A Survey of Security, Privacy, and Ethics Threats in LLM-Based Agentscited by 63
- 2025A Survey of LLM-Driven AI Agent Communication: Protocols, Security Risks, and Defense Countermeasurescited by 54
- 2025ComplexFuncBench: Exploring Multi-Step and Constrained Function Calling under Long-Context Scenariocited by 53
- 2025MARFT: Multi-Agent Reinforcement Fine-Tuningcited by 51
12 most cited of 178 All 178 (JSON)
- 2026Learning When and How to Intervene: A Hindsight-Distilled Sentinel for Coding Agents30 Sep 2026
- 2026WEFT: Scaling Tool-Use Post-Training for General-Purpose Agents29 Sep 2026
- 2026Action-Space Shaping for LLM Agents: Measuring and Mitigating Tool-Schema Bias28 Sep 2026
- 2026FromPitch2Board: Benchmarking LLM Agents in Long-Horizon Football Management28 Sep 2026
- 2026ControlScope: Workflow Revision and Reliability in LLM Agents28 Sep 2026
- 2026SINGED: Correct Outputs Do Not Certify Safe Execution in LLM Agents27 Sep 2026
- 2026AgentBoundary: Counterfactual Evaluation of Safety in Tool-Using LLM Agents27 Sep 2026
- 2026What Does a Skill Actually Do? Estimands and Evaluation Validity for Tool and Skill Use in LLM Agents: A Critical Review27 Sep 2026
- 2026Boundary-State Control for Tool-Using Language-Model Agents: Commit-Time Consistency under State Drift26 Sep 2026
- 2026Trust and Task Completion in the World of Consumer AI Agents26 Sep 2026
- 2026Authorization Closure Graph: Minimal Repair for LLM Agents with Evolving User Instructions26 Sep 2026
- 2026On Evaluating and Improving Conversational Agents in Production25 Sep 2026
12 newest of 178 All 178 (JSON)
- 2025Large Language Models for Planning: A Comprehensive and Systematic Surveycited by 38
- 2025VCRL: Variance-based Curriculum Reinforcement Learning for Large Language Modelscited by 35
- 2025Think Twice Before You Act: Enhancing Agent Behavioral Safety with Thought Correctioncited by 14
- 2025Rethinking Stateful Tool Use in Multi-Turn Dialogues: Benchmarks and Challengescited by 12
- 2026GEAR: Granularity-Adaptive Advantage Reweighting for LLM Agents via Self-Distillationcited by 10
- 2025FunReason: Enhancing Large Language Models' Function Calling via Self-Refinement Multiscale Loss and Automated Data Refinementcited by 5
- 2024Library Learning Doesn't: The Curious Case of the Single-Use "Library"cited by 3
- 2025Empowering Real-World: A Survey on the Technology, Practice, and Evaluation of LLM-driven Industry Agentscited by 2
- 2026A Primer in Post-Training Reasoning Data: What We Know About How It Workscited by 1
- 2026Diagnosing Tool-Selection Reasoning in LLM Agents with Canary Toolscited by 1
- 2025GSM-Agent: Understanding Agentic Reasoning Using Controllable Environmentscited by 0
- 2026Thinking Is Not Telling: Information Disclosure in User-Service LLM Agentscited by 0
12 most cited of 13 All 13 (JSON)
- 2026Diagnosing Tool-Selection Reasoning in LLM Agents with Canary Tools5 Aug 2026
- 2026A Primer in Post-Training Reasoning Data: What We Know About How It Works1 Jun 2026
- 2026GEAR: Granularity-Adaptive Advantage Reweighting for LLM Agents via Self-Distillation12 May 2026
- 2026DRIP-R: A Benchmark for Decision-Making and Reasoning Under Real-World Policy Ambiguity in the Retail Domain8 May 2026
- 2026Thinking Is Not Telling: Information Disclosure in User-Service LLM Agents8 Feb 2026
- 2025Empowering Real-World: A Survey on the Technology, Practice, and Evaluation of LLM-driven Industry Agents20 Oct 2025
- 2025GSM-Agent: Understanding Agentic Reasoning Using Controllable Environments26 Sep 2025
- 2025VCRL: Variance-based Curriculum Reinforcement Learning for Large Language Models24 Sep 2025
- 2025FunReason: Enhancing Large Language Models' Function Calling via Self-Refinement Multiscale Loss and Automated Data Refinement26 May 2025
- 2025Large Language Models for Planning: A Comprehensive and Systematic Survey26 May 2025
- 2025Rethinking Stateful Tool Use in Multi-Turn Dialogues: Benchmarks and Challenges19 May 2025
- 2025Think Twice Before You Act: Enhancing Agent Behavioral Safety with Thought Correction16 May 2025
12 newest of 13 All 13 (JSON)
- 2026Agent World Model: Infinity Synthetic Environments for Agentic Reinforcement Learningcited by 51
- 2025World Modelling Improves Language Model Agentscited by 12
- 2026Quo Vadis, World Modeling?cited by 0
- 2026Quo Vadis, World Modeling?3 Aug 2026
- 2026Agent World Model: Infinity Synthetic Environments for Agentic Reinforcement Learning10 Feb 2026
- 2025World Modelling Improves Language Model Agents3 Jun 2025
- 2025Graph RAG-Tool Fusioncited by 15
- 2026C2KV: Compressed and Composable KV Cache Reuse for Efficient LLM Inferencecited by 3
- 2026C2KV: Compressed and Composable KV Cache Reuse for Efficient LLM Inference20 Jul 2026
- 2025Graph RAG-Tool Fusion11 Feb 2025
- 2025τ2-Bench: Evaluating Conversational Agents in a Dual-Control Environmentcited by 558
- 2025Model Context Protocol (MCP): Landscape, Security Threats, and Future Research Directionscited by 257
- 2025Infrastructure for AI Agentscited by 40
- 2026AMemGym: Interactive Memory Benchmarking for Assistants in Long-Horizon Conversationscited by 20
- 2025HCAST: Human-Calibrated Autonomy Software Taskscited by 19
- 2025Goal Alignment in LLM-Based User Simulators for Conversational AIcited by 19
- 2024Asynchronous LLM Function Callingcited by 18
- 2024CATP-LLM: Empowering Large Language Models for Cost-Aware Tool Planningcited by 14
- 2026ASTRA-bench: Evaluating Tool-Use Agent Reasoning and Action Planning with Personal User Contextcited by 14
- 2026Proactive Agent Research Environment: Simulating Active Users to Evaluate Proactive Assistantscited by 14
- 2025From Glue-Code to Protocols: A Critical Analysis of A2A and MCP Integration for Scalable Agent Systemscited by 12
- 2025Invisible Tokens, Visible Bills: The Urgent Need to Audit Hidden Operations in Opaque LLM Servicescited by 10
12 most cited of 68 All 68 (JSON)
- 2026Mingbird: A Local-First Agent Harness Enabling Small Open Models to Complete Real Tasks1 Oct 2026
- 2026ContractRL: Shielded Group-Relative Policy Optimization for Auditable Tool-Call Repair29 Sep 2026
- 2026Actions with Receipts: Jointly Binding Claims, Evidence, and Execution for Replayable Tool-Agent Auditing29 Sep 2026
- 2026Where Scientific Search Agents Fail: Decision-Checkpoint Auditing of Exposure and Inspection Attempts29 Sep 2026
- 2026The Backdrop Exposes What the World Around an Agent Costs It29 Sep 2026
- 2026VStress: Correlation-Aware Auditing and Adaptive Budget Allocation for Repeated Verifiers29 Sep 2026
- 2026MLToolBench: Learning Tool-Augmented Agents for Machine Learning Development29 Sep 2026
- 2026Failure-Transparent Agents: Benchmarking Post-Failure Reporting in Tool-Using Language Models28 Sep 2026
- 2026When Does Action Credit Need Updating?24 Sep 2026
- 2026Forecast Workflow Bench: Evaluating Language-Model Decisions with Budgeted Forecast Tools23 Sep 2026
- 2026World State Generator21 Sep 2026
- 2026Evaluating Open-Weight E-Commerce Agents with Environment-Grounded Verification14 Sep 2026
12 newest of 68 All 68 (JSON)