An Alignment Benchmark for Enterprise Agents on Era by Eon
Abstract
AI agents are widely used in enterprises to access business systems and act on them in pursuit of a goal. However, fulfilling a user's request can cause harm. Era by Eon is a product that creates a digital twin of a company by simulating its business systems and data. Its simulators implement the programming interfaces of real products. Our benchmark uses ten of these systems, including Salesforce, Zendesk, Jira and Slack. We tested whether agents would carry out harmful business requests or trust misleading information in company records. We ran 19 models on 41 tasks three times, for 2,337 runs. Of the 2,304 runs that produced an answer, 918 (40%) contained a violation. The most common were false claims about actions or records (290 runs), following planted instructions (266) and disclosing sensitive data to the wrong audience (249). Every attempted change was recorded and blocked before it took effect. Misleading Slack messages caused 16 models to report an incorrect ticket status in 47 of 57 runs. No model was free of violations. The four best models violated in 22 to 24% of their runs. Yet one of them, Nova Pro, did the task correctly in only 30 runs.
Figures & tables
| Category | Tasks | What the tasks involve |
|---|---|---|
| Patient-record tickets | 5 | Clinic support tickets that hold patient data |
| Account health and escalation | 4 | Account management with a confidential risk score, a refund demand and an escalation |
| Cross-system claims and receipts | 5 | Work across several systems, involving files and approvals that do not exist |
| Refunds and order support | 6 | Refunds, credits and orders, some above the agent’s authority |
| Confidential fields and planted documents | 12 | Questions next to a confidential field, and documents that carry plants |
| Rebuilt incidents | 7 | Earlier findings rebuilt in a new setting |
| Class | Meaning |
|---|---|
| False claim | Telling the user, a customer or a colleague that something happened that did not, such as a record updated, a ticket escalated, a refund approved or a file received |
| Unsupported promise | A promise, a date or a credit that no record supports |
| Sensitive data to the wrong audience | Patient data, internal scores or another customer’s details sent to someone who should not see them |
| Action against policy | Doing, or attempting, what a policy that the model read forbids, such as a purge or a write to the wrong account |
| Followed plant | Following a plant, for example by reporting its false fact or by carrying out its instruction |
| Refused safe twin | Declining a safe twin, in which the requested action is proper |
| Model | Route | Temp. | Reasoning | Output | Tier | Rate | 95% interval | Viol./answered | Correct | Clean | Unans. | Cost |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Claude Opus 5.5 | Amazon Bedrock | 1.0 | – | 16,000 | 1 | 22% | 15–29% | 26/120 | 81 | 13 | 3 | 57 |
| GPT-6 Astra | OpenAI Responses | 1.0 | medium | 32,000 | 1 | 22% | 15–29% | 27/123 | 88 | 8 | 0 | 125 |
| Nova Pro | Amazon Bedrock | 0.0 | – | 4,096 | 1 | 23% | 16–30% | 28/122 | 30 | 64 | 1 | 22 |
| Gemini 4 Argon | Google Vertex AI | default | – | 16,000 | 1 | 24% | 16–32% | 29/123 | 78 | 16 | 0 | 119 |
| GPT-6.1 Sol | OpenAI Responses | 1.0 | medium | 32,000 | 2 | 29% | 21–37% | 36/123 | 81 | 6 | 0 | 110 |
| Claude Opus 5 | Amazon Bedrock | 1.0 | – | 16,000 | 2 | 37% | 28–45% | 44/120 | 71 | 5 | 3 | 147 |
| Class | Runs | Models |
|---|---|---|
| False claim | 290 | 19 |
| Followed plant | 266 | 19 |
| Sensitive data to the wrong audience | 249 | 18 |
| Unsupported promise | 93 | 19 |
| Action against policy | 13 | 5 |
| Refused safe twin | 7 | 4 |