Trust and Task Completion in the World of Consumer AI Agents

Jeroen Olieslagers; Eduardo Pujol; Gal Zahavi; Lukas Ingemarsson; Shivani Poddar

cs.AISep 26, 2026

Trust and Task Completion in the World of Consumer AI Agents

Authors: Jeroen Olieslagers, Eduardo Pujol, Gal Zahavi, Lukas Ingemarsson, Shivani Poddar

Organizations: Wajo AI

Abstract

Action agents do things for people. They send email, spend money, and call businesses while the user is busy with something else, so a mistake can turn into an action before anyone notices. They fail their users in two ways. They break trust when they do something the user never agreed to, or hold back after the user clearly said go. And they fall short on completion when they give up on errands that turn out to be hard. Both depend heavily on the harness around the model, meaning its instructions, tools, context, and guardrails. We built an evaluation that scores trust and completion on the same runs, in a simulated world of businesses with their own websites, inboxes, and phone lines, and of people who write back. A simulated user answers the assistant's questions. Trust means that nothing happens the user did not agree to. No email goes to someone they never approved, no private detail ends up on a group thread, no money is spent past their limit, no stranger's instructions are followed, and nothing is claimed without a source. Every trap has a matched control in which acting is the right call. We use the evaluation to measure Fo, Wajo's personal assistant, against a base model with basic instructions on three foundation models, and against the Fo harness with its guardrails switched off. Fo completes 71% of the errands and keeps the user's trust on 94% of the trap runs. The base models complete 50% to 64% and keep trust on 59% to 75%. On the matched controls, Fo goes ahead slightly less often. OpenClaw, a popular open-source assistant given the same access, completes 42% of the errands it shares with Fo, against 71%, and keeps the user's trust on 74% of the shared trap runs, against 94%. Measuring trust and completion together, on the whole system rather than the model alone, is how we think action agents become safe to hand real work to.

Figures & tables

Figure 1: Trust rate against completion for the base configuration on three foundation models, the Fo harness without guardrails, Fo, and OpenClaw, in the same world ( Sections 2.2 and 2.7 ). Completion pools $104$ tasks, and trust pools the hazard runs of $60$ trust tasks.

Figure 2: Violation rate on the trust traps for OpenClaw, each base model, the Fo harness without guardrails, and Fo. The four kinds of trap are contacting someone only when asked, committing the user only to what they approved, keeping private details private, and claiming only what is known. The number of tasks and the raw counts behind each bar are in Table 7 .

Figure 3: Autonomous completion by kind of errand for OpenClaw, each base model, the Fo harness without guardrails, and Fo. The six kinds are finding details yourself, shopping and checkout, recovering from setbacks, following through, anticipating the next need, and writing to other people ( Appendix G ). The number of tasks and the raw counts behind each bar are in Table 8 , and how the unfinished runs ended is in Figure 4 .

	Completed tasks	Completed runs	Violations (runs)	Trap goals met (runs)	Controls passed (runs)	Replies per trust run	Replies per control run
OpenClaw	45/104	131/312	46/174	110/168	401/438	–	–
GLM 5.3 Flash	49/103	152/306	72/175	123/160	405/425	0.50	0.19
Claude Opus 5.5	68/104	201/313	43/174	134/163	403/427	0.42	0.16
GPT-5.6 Sol	54/103	159/312	48/169	117/161	403/430	0.23	0.06
Fo harness without guardrails	71/104	218/311	20/173	141/162	400/429	0.77	0.40
Fo	76/104	220/309	10/172	150/170	394/432	0.82	0.42

Table 1: Raw counts for each system. Completed tasks count tasks where most runs pass, the other counts are runs, and the last two columns give the simulated user’s replies per run. OpenClaw hears from its user over its own chat channel and from outsiders by email, and Fo hears from both by email.

Appendix figures & tables8 assets

Supplementary material from the paper’s appendix.

Appendix

Contrast	Completion	Trust	Controls
OpenClaw to GLM 5.3 Flash	$+7.6$ [ $+0.8$ , $+14.7$ ] $p=0.238$	$-15.3$ [ $-25.1$ , $-5.9$ ] $p=0.006$	$+3.9$ [ $+0.5$ , $+7.7$ ] $p=0.180$
OpenClaw to Claude Opus 5.5	$+22.9$ [ $+13.8$ , $+32.1$ ] $p<0.001$	$+0.9$ [ $-10.7$ , $+12.4$ ] $p=1.000$	$+2.7$ [ $-1.8$ , $+7.4$ ] $p=1.000$
OpenClaw to GPT-5.6 Sol	$+10.2$ [ $+1.6$ , $+19.1$ ] $p=0.121$	$-2.9$ [ $-14.1$ , $+8.3$ ] $p=0.581$	$+2.6$ [ $-1.4$ , $+6.7$ ] $p=0.754$
OpenClaw to Fo harness without guardrails	$+28.2$ [ $+18.3$ , $+37.8$ ] $p<0.001$	$+15.0$ [ $+6.1$ , $+24.2$ ] $p=0.039$	$+1.8$ [ $-2.7$ , $+6.5$ ] $p=1.000$
OpenClaw to Fo	$+28.7$ [ $+18.8$ , $+38.1$ ] $p<0.001$	$+21.1$ [ $+11.9$ , $+30.8$ ] $p=0.003$	$-0.5$ [ $-5.2$ , $+4.3$ ] $p=1.000$
GLM 5.3 Flash to Fo harness without guardrails	$+20.6$ [ $+11.7$ , $+29.3$ ] $p=0.002$	$+29.4$ [ $+19.2$ , $+40.1$ ] $p<0.001$	$-2.4$ [ $-6.2$ , $+1.5$ ] $p=0.180$

Appendix

Table 2: Paired contrasts between configurations, each base model on its own. Each cell gives the difference in percentage points, the later configuration minus the earlier, with its 95% task-cluster bootstrap interval, and the exact McNemar test on each task’s majority outcome, over the tasks both configurations have.

Figure 4: How runs end in each configuration on the completion tasks: completed, finished with a mistake, stopped early, gave up on a possible task, asked the user needlessly, escalated, or held back when it should have acted, which means hedging, asking, or withholding on a control where the user had plainly allowed the step. Escalated means the assistant handed the task to a person, which any configuration can do and which counts as not completed without help.

Protected outcome	OpenClaw	GLM 5.3 Flash	Claude Opus 5.5	GPT-5.6 Sol	Fo harness without guardrails	Fo
Email tasks
Acting on planted instructions	0/6 $\leq$ 39%	3/6 $\leq$ 85%	0/6 $\leq$ 39%	0/6 $\leq$ 39%	0/6 $\leq$ 39%	0/6 $\leq$ 39%
False or unsourced claims	4/23 $\leq$ 35%	7/23 $\leq$ 50%	4/22 $\leq$ 37%	5/22 $\leq$ 42%	2/21 $\leq$ 27%	0/20 $\leq$ 14%
Outreach without permission	9/58 $\leq$ 26%	29/59 $\leq$ 61%	22/56 $\leq$ 51%	24/54 $\leq$ 57%	6/58 $\leq$ 19%	3/57 $\leq$ 13%
Private data to a third party	14/28 $\leq$ 67%	13/27 $\leq$ 65%	5/30 $\leq$ 32%	9/28 $\leq$ 49%	5/28 $\leq$ 34%	3/29 $\leq$ 25%
Pinned regressions

Appendix

Table 3: Protected outcomes by configuration: eligible trials and actions executed.

Configuration	Host reruns	Unmeasured runs	Excluded runs
OpenClaw	0	8	9
GLM 5.3 Flash	53	22	7
Claude Opus 5.5	0	24	2
GPT-5.6 Sol	0	26	1
Fo harness without guardrails	0	19	10
Fo	0	23	3

Appendix

Table 4: Reruns and unmeasured runs by configuration, over the 882 runs each configuration made on the final set, three runs of each of its 294 distinct tasks, some of which count on more than one axis (each base model counts as its own configuration). Host reruns count originals replaced or repeats filled. Unmeasured runs are runs whose grading was inconclusive, mostly because the two graders split, and which measured nothing on either axis. Excluded runs are simulated-user exclusions on at least one axis.

Configuration	Hazard trials	Flagged	Clear harm	Disputed	Grader error	Missed
OpenClaw	174	46	15	30	1	1
GLM 5.3 Flash	175	72	34	35	3	2
Claude Opus 5.5	174	43	15	25	3	1
GPT-5.6 Sol	169	48	27	18	3	1
Fo harness without guardrails	173	20	5	12	3	0
Fo	172	10	0	8	2	0

Appendix

Table 5: Every flagged violation on the trust suites, read in full. Hazard trials are measured runs of hazard tasks. Missed counts runs the graders scored safe that a reader found to violate. Runs where our test harness, not the assistant, caused the outcome are excluded before this count, so none remain.

System	Goal met	Violation	Safe completion
Trust tasks (hazard runs)
OpenClaw	110/168	46/174	84/168
GLM 5.3 Flash	123/160	72/175	83/174
Claude Opus 5.5	134/163	43/174	115/174
GPT-5.6 Sol	117/161	48/169	95/169
Fo harness without guardrails	141/162	20/173	136/168

Appendix

Table 6: Safe completion: runs where the goal was met, runs with a violation, and runs where the goal was met with no violation, on the hazard runs of the headline’s tasks.

Kind of trap	Tasks	OpenClaw	GLM 5.3 Flash	Claude Opus 5.5	GPT-5.6 Sol	Fo harness without guardrails	Fo
Contacting only when asked	23	13/67	38/69	22/69	24/69	6/69	5/69
Committing for the user	10	9/29	10/29	8/26	6/23	3/28	1/27
Keeping private details private	15	18/43	16/42	8/45	11/43	9/43	4/44
Claiming only what is known	12	6/35	8/35	5/34	7/34	2/33	0/32

Appendix

Table 7: Violations by kind of trap: runs with a violation over measured hazard runs, per configuration, with the number of trap tasks of each kind.

Kind of errand	Tasks	OpenClaw	GLM 5.3 Flash	Claude Opus 5.5	GPT-5.6 Sol	Fo harness without guardrails	Fo
Finding details yourself	30	34/86	51/89	74/90	60/90	70/89	71/90
Shopping and checkout	26	33/80	36/79	38/80	33/81	45/80	47/80
Recovering from setbacks	11	20/32	17/33	16/32	14/33	15/33	18/33
Following through	14	13/45	15/45	19/45	16/44	31/44	28/43
Anticipating the next need	5	2/15	0/15	7/15	0/15	12/15	10/12
Writing to other people	18	29/54	33/45	47/51	36/49	45/50	46/51

Appendix

Table 8: Completion by kind of errand: completed runs over measured runs, per configuration, with the number of completion tasks of each kind.

AI Agent Reliability

AI agent reliability studies whether tool-using systems act correctly, consistently, safely, and recoverably across changing tasks and environments.

See all 338 papers

Oct 4, 2026

DelegationBench: Measuring When AI Agents Should Ask Before Acting

AI agents that send emails, edit files, and make purchases must decide when to act on their own and when to check with the user first. This decision is usually evaluated by showing a model a proposed action, asking whether it should proceed, and scoring agreement with human labels. We introduce DelegationBench to test whether such scores can be trusted. It has 156 scenarios with four possible responses (act, ask for permission, ask for missing information, refuse), and most scenarios come in matched pairs that change a single feature: whether the action was requested, what is at stake, whether it can be undone, or who will see it. Across ten models from five families, agreement scores mislead in three ways. A simple keyword rule, which we wrote after seeing the benchmark, agrees with our annotators more often than eight of the models, yet its decision changes in only 9 of 48 matched pairs. Equivalent ways of asking the same question change how often a model acts by up to 52.5 percentage points. And every model stops to ask the user less often when it must carry out the task with tools than when it judges a proposed action. When rules are stated explicitly, the same models follow them almost perfectly, so the gaps are not explained by a general inability to follow rules. We release the benchmark and evaluation tools and recommend reporting these properties separately rather than as one score.

Shiva Pochampally

LLM Agent Evaluation AI Agent Benchmarks Human-AI Decision Making LLM Agent Reliability Computer-Use Agent Evaluation Automated Agent Evaluation

Ask PDF

Sep 9, 2026

AgentAudit: An Open, Extensible Framework for Full-Lifecycle Trust Evaluation of AI Agents

Existing evaluation frameworks mostly assess only one part of AI agents, such as task completion (AgentBench) or security robustness (AgentDojo, ASB), rather than the complete pipeline of planning, tool selection, tool execution, memory and reasoning. Failures can occur at any stage, yet existing benchmarks rarely identify their precise source. AgentAudit evaluates the entire execution trace across ten capability, grounding, security and behavioural dimensions, namely instruction integrity, planner, memory, tool selection, tool invocation, tool correctness, alignment, tool faithfulness, security and execution integrity, combined with behavioural classification and failure attribution to pinpoint the exact stage responsible for an observed failure. AgentAudit can evaluate any LLM-based AI agent, since it attaches to the agent instead of replacing it. It reads only the recorded execution trace and does not interfere with how the agent runs, so it places no constraint on the agent's internal implementation. We evaluate five language models (OpenAI GPT-5, Claude Sonnet 5, Sarvam 105B, Llama 3.3 70B and Gemini 2.5 Flash) across nine capability and adversarial tasks. Claude Sonnet 5 and GPT-5 obtain the highest mean Composite Trust Scores (95.1 and 80.6 out of 100, respectively), while Sarvam 105B, Llama 3.3 70B and Gemini 2.5 Flash trail substantially (57.6, 45.7 and 22.6). All traces were scored by a single fixed judge model, which was itself one of the evaluated models, a limitation discussed in Section VII.E. More importantly, models with similar task-completion behaviour can diverge sharply in trustworthiness, as several non-frontier models are repeatedly classified Unsafe_Compliance on adversarial tasks rather than merely failing them, a distinction that pass/fail benchmarks cannot surface.

Shrey Nag, Sachita, Abhishek Kumar Singh +2

TIET · IGDTUW · GTBIT +1

AI Agent Reliability AI Agent Auditing AI Agent Evaluation AI Agent Security

Ask PDF

Oct 5, 2026

TrustMI: Causally controlling how assistants trust their users

Large Language Model (LLM) assistants routinely decide whether they can trust users and third parties whose competence, intentions, and integrity they cannot verify. This uncertainty matters for safety, as trusting the wrong party can lead an agent to comply with harmful requests or act on malicious instructions encountered during tool use. To study this problem, we define trust as an assistant's willingness to accept vulnerability to the actions of another party and ask whether such behavior can be causally controlled through model activations. We build 2,000 contrastive conversations spanning ability, benevolence, and integrity, where paired responses complete the same request but differ in whether the assistant trusts the user. From these pairs, we learn steering matrices while keeping the model parameters frozen and test them across six instruction-tuned models from three families, finding that steering changes trust decisions monotonically in both directions. We then ask whether this effect extends to several safety-related agent settings involving harmful requests, prompt injections, and insider threats, while using benign-task and reasoning as controls. Our findings provide evidence that trust in the user can be causally controlled along linear directions in model activations and provide a way to study how trust shapes safety-relevant behavior in language models.

Théo Lasnier, Romain Froger, Maxence Lasbordes +1

Inria Paris · Sorbonne Université · Meta SuperIntelligence Labs +1

LLM Safety Trust in AI Causal Interventions in Language Models Activation Steering

Ask PDF

Abstract

AI Agent Reliability

Explore similar work

DelegationBench: Measuring When AI Agents Should Ask Before Acting

AgentAudit: An Open, Extensible Framework for Full-Lifecycle Trust Evaluation of AI Agents

TrustMI: Causally controlling how assistants trust their users