Trust and Task Completion in the World of Consumer AI Agents

Jeroen Olieslagers; Eduardo Pujol; Gal Zahavi; Lukas Ingemarsson; Shivani Poddar

cs.AISep 26, 2026

Trust and Task Completion in the World of Consumer AI Agents

Authors: Jeroen Olieslagers, Eduardo Pujol, Gal Zahavi, Lukas Ingemarsson, Shivani Poddar

Organizations: Wajo AI

Abstract

Action agents do things for people. They send email, spend money, and call businesses while the user is busy with something else, so a mistake can turn into an action before anyone notices. They fail their users in two ways. They break trust when they do something the user never agreed to, or hold back after the user clearly said go. And they fall short on completion when they give up on errands that turn out to be hard. Both depend heavily on the harness around the model, meaning its instructions, tools, context, and guardrails. We built an evaluation that scores trust and completion on the same runs, in a simulated world of businesses with their own websites, inboxes, and phone lines, and of people who write back. A simulated user answers the assistant's questions. Trust means that nothing happens the user did not agree to. No email goes to someone they never approved, no private detail ends up on a group thread, no money is spent past their limit, no stranger's instructions are followed, and nothing is claimed without a source. Every trap has a matched control in which acting is the right call. We use the evaluation to measure Fo, Wajo's personal assistant, against a base model with basic instructions on three foundation models, and against the Fo harness with its guardrails switched off. Fo completes 71% of the errands and keeps the user's trust on 94% of the trap runs. The base models complete 50% to 64% and keep trust on 59% to 75%. On the matched controls, Fo goes ahead slightly less often. OpenClaw, a popular open-source assistant given the same access, completes 42% of the errands it shares with Fo, against 71%, and keeps the user's trust on 74% of the shared trap runs, against 94%. Measuring trust and completion together, on the whole system rather than the model alone, is how we think action agents become safe to hand real work to.

Figures & tables

Figure 1: Trust rate against completion for the base configuration on three foundation models, the Fo harness without guardrails, Fo, and OpenClaw, in the same world ( Sections 2.2 and 2.7 ). Completion pools $104$ tasks, and trust pools the hazard runs of $60$ trust tasks.

Figure 2: Violation rate on the trust traps for OpenClaw, each base model, the Fo harness without guardrails, and Fo. The four kinds of trap are contacting someone only when asked, committing the user only to what they approved, keeping private details private, and claiming only what is known. The number of tasks and the raw counts behind each bar are in Table 7 .

Figure 3: Autonomous completion by kind of errand for OpenClaw, each base model, the Fo harness without guardrails, and Fo. The six kinds are finding details yourself, shopping and checkout, recovering from setbacks, following through, anticipating the next need, and writing to other people ( Appendix G ). The number of tasks and the raw counts behind each bar are in Table 8 , and how the unfinished runs ended is in Figure 4 .

	Completed tasks	Completed runs	Violations (runs)	Trap goals met (runs)	Controls passed (runs)	Replies per trust run	Replies per control run
OpenClaw	45/104	131/312	46/174	110/168	401/438	–	–
GLM 5.3 Flash	49/103	152/306	72/175	123/160	405/425	0.50	0.19
Claude Opus 5.5	68/104	201/313	43/174	134/163	403/427	0.42	0.16
GPT-5.6 Sol	54/103	159/312	48/169	117/161	403/430	0.23	0.06
Fo harness without guardrails	71/104	218/311	20/173	141/162	400/429	0.77	0.40
Fo	76/104	220/309	10/172	150/170	394/432	0.82	0.42

Table 1: Raw counts for each system. Completed tasks count tasks where most runs pass, the other counts are runs, and the last two columns give the simulated user’s replies per run. OpenClaw hears from its user over its own chat channel and from outsiders by email, and Fo hears from both by email.

Appendix figures & tables8 assets

Supplementary material from the paper’s appendix.

Appendix

Contrast	Completion	Trust	Controls
OpenClaw to GLM 5.3 Flash	$+7.6$ [ $+0.8$ , $+14.7$ ] $p=0.238$	$-15.3$ [ $-25.1$ , $-5.9$ ] $p=0.006$	$+3.9$ [ $+0.5$ , $+7.7$ ] $p=0.180$
OpenClaw to Claude Opus 5.5	$+22.9$ [ $+13.8$ , $+32.1$ ] $p<0.001$	$+0.9$ [ $-10.7$ , $+12.4$ ] $p=1.000$	$+2.7$ [ $-1.8$ , $+7.4$ ] $p=1.000$
OpenClaw to GPT-5.6 Sol	$+10.2$ [ $+1.6$ , $+19.1$ ] $p=0.121$	$-2.9$ [ $-14.1$ , $+8.3$ ] $p=0.581$	$+2.6$ [ $-1.4$ , $+6.7$ ] $p=0.754$
OpenClaw to Fo harness without guardrails	$+28.2$ [ $+18.3$ , $+37.8$ ] $p<0.001$	$+15.0$ [ $+6.1$ , $+24.2$ ] $p=0.039$	$+1.8$ [ $-2.7$ , $+6.5$ ] $p=1.000$
OpenClaw to Fo	$+28.7$ [ $+18.8$ , $+38.1$ ] $p<0.001$	$+21.1$ [ $+11.9$ , $+30.8$ ] $p=0.003$	$-0.5$ [ $-5.2$ , $+4.3$ ] $p=1.000$
GLM 5.3 Flash to Fo harness without guardrails	$+20.6$ [ $+11.7$ , $+29.3$ ] $p=0.002$	$+29.4$ [ $+19.2$ , $+40.1$ ] $p<0.001$	$-2.4$ [ $-6.2$ , $+1.5$ ] $p=0.180$

Appendix

Table 2: Paired contrasts between configurations, each base model on its own. Each cell gives the difference in percentage points, the later configuration minus the earlier, with its 95% task-cluster bootstrap interval, and the exact McNemar test on each task’s majority outcome, over the tasks both configurations have.

Figure 4: How runs end in each configuration on the completion tasks: completed, finished with a mistake, stopped early, gave up on a possible task, asked the user needlessly, escalated, or held back when it should have acted, which means hedging, asking, or withholding on a control where the user had plainly allowed the step. Escalated means the assistant handed the task to a person, which any configuration can do and which counts as not completed without help.

Protected outcome	OpenClaw	GLM 5.3 Flash	Claude Opus 5.5	GPT-5.6 Sol	Fo harness without guardrails	Fo
Email tasks
Acting on planted instructions	0/6 $\leq$ 39%	3/6 $\leq$ 85%	0/6 $\leq$ 39%	0/6 $\leq$ 39%	0/6 $\leq$ 39%	0/6 $\leq$ 39%
False or unsourced claims	4/23 $\leq$ 35%	7/23 $\leq$ 50%	4/22 $\leq$ 37%	5/22 $\leq$ 42%	2/21 $\leq$ 27%	0/20 $\leq$ 14%
Outreach without permission	9/58 $\leq$ 26%	29/59 $\leq$ 61%	22/56 $\leq$ 51%	24/54 $\leq$ 57%	6/58 $\leq$ 19%	3/57 $\leq$ 13%
Private data to a third party	14/28 $\leq$ 67%	13/27 $\leq$ 65%	5/30 $\leq$ 32%	9/28 $\leq$ 49%	5/28 $\leq$ 34%	3/29 $\leq$ 25%
Pinned regressions

Appendix

Table 3: Protected outcomes by configuration: eligible trials and actions executed.

Configuration	Host reruns	Unmeasured runs	Excluded runs
OpenClaw	0	8	9
GLM 5.3 Flash	53	22	7
Claude Opus 5.5	0	24	2
GPT-5.6 Sol	0	26	1
Fo harness without guardrails	0	19	10
Fo	0	23	3

Appendix

Table 4: Reruns and unmeasured runs by configuration, over the 882 runs each configuration made on the final set, three runs of each of its 294 distinct tasks, some of which count on more than one axis (each base model counts as its own configuration). Host reruns count originals replaced or repeats filled. Unmeasured runs are runs whose grading was inconclusive, mostly because the two graders split, and which measured nothing on either axis. Excluded runs are simulated-user exclusions on at least one axis.

Configuration	Hazard trials	Flagged	Clear harm	Disputed	Grader error	Missed
OpenClaw	174	46	15	30	1	1
GLM 5.3 Flash	175	72	34	35	3	2
Claude Opus 5.5	174	43	15	25	3	1
GPT-5.6 Sol	169	48	27	18	3	1
Fo harness without guardrails	173	20	5	12	3	0
Fo	172	10	0	8	2	0

Appendix

Table 5: Every flagged violation on the trust suites, read in full. Hazard trials are measured runs of hazard tasks. Missed counts runs the graders scored safe that a reader found to violate. Runs where our test harness, not the assistant, caused the outcome are excluded before this count, so none remain.

System	Goal met	Violation	Safe completion
Trust tasks (hazard runs)
OpenClaw	110/168	46/174	84/168
GLM 5.3 Flash	123/160	72/175	83/174
Claude Opus 5.5	134/163	43/174	115/174
GPT-5.6 Sol	117/161	48/169	95/169
Fo harness without guardrails	141/162	20/173	136/168

Appendix

Table 6: Safe completion: runs where the goal was met, runs with a violation, and runs where the goal was met with no violation, on the hazard runs of the headline’s tasks.

Kind of trap	Tasks	OpenClaw	GLM 5.3 Flash	Claude Opus 5.5	GPT-5.6 Sol	Fo harness without guardrails	Fo
Contacting only when asked	23	13/67	38/69	22/69	24/69	6/69	5/69
Committing for the user	10	9/29	10/29	8/26	6/23	3/28	1/27
Keeping private details private	15	18/43	16/42	8/45	11/43	9/43	4/44
Claiming only what is known	12	6/35	8/35	5/34	7/34	2/33	0/32

Appendix

Table 7: Violations by kind of trap: runs with a violation over measured hazard runs, per configuration, with the number of trap tasks of each kind.

Kind of errand	Tasks	OpenClaw	GLM 5.3 Flash	Claude Opus 5.5	GPT-5.6 Sol	Fo harness without guardrails	Fo
Finding details yourself	30	34/86	51/89	74/90	60/90	70/89	71/90
Shopping and checkout	26	33/80	36/79	38/80	33/81	45/80	47/80
Recovering from setbacks	11	20/32	17/33	16/32	14/33	15/33	18/33
Following through	14	13/45	15/45	19/45	16/44	31/44	28/43
Anticipating the next need	5	2/15	0/15	7/15	0/15	12/15	10/12
Writing to other people	18	29/54	33/45	47/51	36/49	45/50	46/51

Appendix

Table 8: Completion by kind of errand: completed runs over measured runs, per configuration, with the number of completion tasks of each kind.

AI Agent Reliability

AI agent reliability studies whether tool-using systems act correctly, consistently, safely, and recoverably across changing tasks and environments.

See all 338 papers

DelegationBench: Measuring When AI Agents Should Ask Before Acting
Oct 4, 2026Shiva PochampallyLLM Agent Evaluation AI Agent Benchmarks
AgentAudit: An Open, Extensible Framework for Full-Lifecycle Trust Evaluation of AI Agents
Sep 9, 2026Shrey Nag, Sachita, Abhishek Kumar Singh +2AI Agent Reliability AI Agent Auditing
TIET · IGDTUW · GTBIT +1
TrustMI: Causally controlling how assistants trust their users
Oct 5, 2026Théo Lasnier, Romain Froger, Maxence Lasbordes +1LLM Safety Trust in AI
Inria Paris · Sorbonne Université · Meta SuperIntelligence Labs +1

Oct 4, 2026J/K move · Enter open · S save

DelegationBench: Measuring When AI Agents Should Ask Before Acting

Shiva Pochampally

LLM Agent Evaluation AI Agent Benchmarks Human-AI Decision Making LLM Agent Reliability Computer-Use Agent Evaluation Automated Agent Evaluation

Open paper AskPDF arXiv

AI agents that send emails, edit files, and make purchases must decide when to act on their own and when to check with the user first. This decision is usually evaluated by showing a model a proposed action, asking whether it should proceed, and scoring agreement with human labels. We introduce DelegationBench to test whether such scores can be trusted. It has 156 scenarios with four possible responses (act, ask for permission, ask for missing information, refuse), and most scenarios come in matched pairs that change a single feature: whether the action was requested, what is at stake, whether it can be undone, or who will see it. Across ten models from five families, agreement scores mislead in three ways. A simple keyword rule, which we wrote after seeing the benchmark, agrees with our annotators more often than eight of the models, yet its decision changes in only 9 of 48 matched pairs. Equivalent ways of asking the same question change how often a model acts by up to 52.5 percentage points. And every model stops to ask the user less often when it must carry out the task with tools than when it judges a proposed action. When rules are stated explicitly, the same models follow them almost perfectly, so the gaps are not explained by a general inability to follow rules. We release the benchmark and evaluation tools and recommend reporting these properties separately rather than as one score.

Abstract

AI Agent Reliability

Explore similar work

DelegationBench: Measuring When AI Agents Should Ask Before Acting

AgentAudit: An Open, Extensible Framework for Full-Lifecycle Trust Evaluation of AI Agents

TrustMI: Causally controlling how assistants trust their users