# Safety, or Just Capability? A Validity Audit of Agent-Safety Benchmarks

arXiv: https://arxiv.org/abs/2607.28685 · HTML: https://mlsanity.com/paper/2607.28685/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Placed in Safety alignment, refusal and guardrails, one of 12 directions in LLM safety and security.
- Builds on 8 of its 17 references that are in the map.
- First posted on arXiv 30 Jul 2026.

## Placed in

- LLM safety and security / [Safety alignment, refusal and guardrails](https://mlsanity.com/safety/safety-alignment-refusal-and-guardrails/)

## Builds on (most cited first, 8 of 8)

- [τ-bench: A Benchmark for Tool-Agent-User Interaction in Real-World Domains](https://mlsanity.com/paper/2406.12045/) (2024)
- [τ2-Bench: Evaluating Conversational Agents in a Dual-Control Environment](https://mlsanity.com/paper/2506.07982/) (2025)
- [Agentic Misalignment: How LLMs Could Be Insider Threats](https://mlsanity.com/paper/2510.05179/) (2025)
- [Measuring what Matters: Construct Validity in Large Language Model Benchmarks](https://mlsanity.com/paper/2511.04703/) (2025)
- [Do These LLM Benchmarks Agree? Fixing Benchmark Evaluation with BenchBench](https://mlsanity.com/paper/2407.13696/) (2024)
- [Beyond Task Completion: Revealing Corrupt Success in LLM Agents through Procedure-Aware Evaluation](https://mlsanity.com/paper/2603.03116/) (2026)
- [AutoMonitor-Bench: Evaluating the Reliability of LLM-Based Misbehavior Monitor](https://mlsanity.com/paper/2601.05752/) (2026)
- [Evidence-Bound Autonomous Research (EviBound): A Governance Framework for Eliminating False Claims](https://mlsanity.com/paper/2511.05524/) (2025)

## Built on by (most cited first, 2 of 2)

- [Threat-Preserving Representation Sensitivity in Agent-Security Benchmarks](https://mlsanity.com/paper/2610.03585/) (2026)
- [AgentStripes: An Evidence-Graded Maturity Model for AI Agents](https://mlsanity.com/paper/2610.18603/) (2026)

## Abstract (arXiv)

Agent-safety benchmarks measure different behaviors, and their scores get quoted interchangeably as an agent's safety. We treat four of them (R-Judge, InjecAgent, AgentHarm, AgentDojo) as measurements to be validated, running each under its official implementation and author-provided scorer on up to 22 models, with MMLU and GPQA measured by us under one protocol as a capability composite. The metric is the first problem. On any binary trace-judgment benchmark scored by F1, an ``always positive'' policy attains F1 = 2π/(1+π); on R-Judge that is 0.690, above five of the 21 models that actually discriminate. The three broad-coverage benchmarks then rank the same 18 models differently, and the trade-off behind that disagreement is a small-panel artifact: R-Judge specificity against AgentHarm safety correlates -0.64 at n=7 and +0.02 at n=18, and a quarter of random size-7 subsets reach |ρ| ≥ 0.5 around that near-zero value. Held-out validity turns on which outcome you pick. Capability predicts task success (ρ=+0.60) but correlates negatively with misalignment safety (ρ=-0.44, n=21). On their paired n=20 panel, the corresponding contrast is Delta=-1.00 (95% CI [-1.48, -0.49], p<0.001), and it survives leave-one-organization-out and organization-clustered bootstrap analyses. On an expanded 41-model panel, the misalignment correlation weakens to -0.16 (95% CI [-0.54, +0.22]) and jailbreak strengthens to +0.34, though neither change is significant. mboxAgentHarm shows the strongest held-out association, ρ=+0.72 with three-template jailbreak safety after controlling capability. But both instruments score harmful compliance, so this is evidence of convergent validity rather than general safety. Naming the benchmark, metric, target behavior, and model panel is the minimum a safety claim needs.