Back to the trend of the day: Intel's boss warns billions of AI helpers will be hard to control
Poly Rating · from the trend of the day

AI Agent Reliability Ranking 2026: Top 10 Agents to Trust

Princeton's tracker rates the newer Claude Opus 4.7 more accurate than Opus 4.5 (79.0% vs 74.6%) but slightly less reliable (0.86 vs 0.87): agents have become more capable without becoming much more predictable.

  • No. 1: Claude Code (Claude Opus 5.5)
  • 10 places

01Final list

The leading AIs each built their own list of ten independently. Here is one result that is easy to check: every place has a reason, a source, and the list of AIs that included it.

Order: from most to least AI agreement.

A bright badge means this AI put the entry on its list. A dim badge means it did not.

  1. 1

    Claude Code (Claude Opus 5.5)

    Highest Arena net improvement (20.14%) plus documented permission modes and rewind. But Auto is now the starting mode, and enterprise audit events skip tool calls.

    Included it: ChatGPT, Meta, Grok, StepFun, Kimi, DeepSeek. Did not include: Nemotron, Wenxin.

    In their lists: ChatGPT: 1 · Meta: 4 · Grok: 1 · StepFun: 1 · Kimi: 1 · DeepSeek: 1

    What each AI noted 6
    • ChatGPTplace 1

      The strongest observed task-completion signal meets unusually tangible human controls: 20.75% confirmed success, plus permission modes, diffs and rewind.

      Source ↗
    • Metaplace 4

      21.15% confirmed success #1 overall in 2.7M sessions – 42.91% net positive but $6.79 and 18.7 min

      Source ↗
    • Grokplace 1

      Highest Arena net improvement, 20.14% overall, and a permission switch that can still make it stop.

      Source ↗
    • StepFunplace 1

      The only agent that is #1 on a real-world board of millions of sessions and still hands you a permission file you can read before it touches your disk.

      Source ↗
    • Kimiplace 1

      The most reliable agent Princeton measured (73% outcome consistency, the best score anyone has) also ships the most enforceable brakes: deny-rules that fire before any permission mode and per-command allowlists — tested, not just claimed.

    • DeepSeekplace 1

      HAL's most reliable model lives here, but its audit trail still loses subagent tool calls.

    6 AIs put it here
    Source ↗
  2. 2

    ChatGPT Work (formerly ChatGPT agent)

    Asks before buying, sending or deleting, and hands sensitive logins back to you. No product-level success rate exists, and OpenAI's Atlas browser fell to a zero-click hijack.

    Included it: ChatGPT, Meta, Grok, Kimi, DeepSeek. Did not include: Nemotron, StepFun, Wenxin.

    In their lists: ChatGPT: 4 · Meta: 1 · Grok: 5 · Kimi: 2 · DeepSeek: 3

    What each AI noted 5
    • ChatGPTplace 4

      The meaningful safeguard is the handoff: users can take over the browser for sensitive logins instead of giving the agent their password.

      Source ↗
    • Metaplace 1

      20.77% confirmed success in chat, $3.68 and 10.4 min median – safest first agent that asks before key steps, tested

    • Grokplace 5

      The old Agent mode is gone; the replacement is described as asking before a purchase, a send or a delete.

    • Kimiplace 2

      Runs everything on a disposable cloud VM and is trained to ask before any action with real-world consequences — and OpenAI models hold the top five places on Arena's Alignment Index for not taking unauthorized actions.

      Source ↗
    • DeepSeekplace 3

      17/20 in browser tests, but its strongest audit record is an enterprise add-on, not the default.

      Source ↗
    5 AIs put it here
    Source ↗
  3. 3

    Google Gemini agents (Gemini 4 Carbon, Computer Use, Gemini CLI)

    Best Arena steerability (19.32%) at $1.69 a task. But screenshot prompt-injection checks ship switched off, and Gemini CLI's sandbox must be configured by the user.

    Included it: ChatGPT, Meta, Grok, StepFun, Kimi. Did not include: Nemotron, DeepSeek, Wenxin.

    In their lists: ChatGPT: 3 · Meta: 3 · Grok: 4 · StepFun: 3 · Kimi: 3

    What each AI noted 5
    • ChatGPTplace 3

      Only $1.69 per median task and 18.04% confirmed success; the critical catch is that some local safety protections require configuration.

      Source ↗
    • Metaplace 3

      Best steerability 19.32% and lowest hallucination 0.51% in top 5, with 16.72% confirmed success for $1.69

      Source ↗
    • Grokplace 4

      Best steerability on the live board, 19.32%, while screenshot injection checks ship off.

      Source ↗
    • StepFunplace 3

      Carbon is #3 on confirmed success at 18.02% for $1.69–$1.80 a task, and it is the one consumer agent that stops to ask before sending messages or buying things.

      Source ↗
    • Kimiplace 3

      Tied for the best reliability score Princeton measured (85%) — yet the same study found it avoids catastrophic mistakes only 25% of the time, which is exactly why its browser agent makes you watch it work.

      Source ↗
    5 AIs put it here
    Source ↗
  4. 4

    OpenAI Codex

    Its sandbox is enforced by the operating system: network off by default, and approval needed to leave the workspace. Its models trail on Arena: GPT-6 Astra 14.70% vs Opus 5.5's 20.14%.

    Included it: ChatGPT, Grok, StepFun, DeepSeek. Did not include: Meta, Nemotron, Kimi, Wenxin.

    In their lists: ChatGPT: 7 · Grok: 2 · StepFun: 2 · DeepSeek: 2

    What each AI noted 4
    • ChatGPTplace 7

      The median observed task costs $0.98 rather than Astra's $6.16, while the same Codex product can enforce workspace and network boundaries.

      Source ↗
    • Grokplace 2

      The sandbox is an operating-system wall, so a model that wants the network can still be refused.

      Source ↗
    • StepFunplace 2

      Astra is 4th on confirmed success while Sol does near-identical work at $0.56 a task — both behind a sandbox you can seal shut and a three-level approval dial.

      Source ↗
    • DeepSeekplace 2

      Ships with the network off and a $1.92 task price — control and cost in one coding agent.

    4 AIs put it here
    Source ↗
  5. 5

    Devin (Cognition)

    Runs in sandboxed VMs with deploy approval. But GitHub permissions are org-wide, no external audit trail is documented, and third-party coding scores range from 61.7% to 70.4% by board.

    Included it: Meta, StepFun, Kimi, DeepSeek. Did not include: ChatGPT, Grok, Nemotron, Wenxin.

    In their lists: Meta: 5 · StepFun: 6 · Kimi: 7 · DeepSeek: 7

    What each AI noted 4
    • Metaplace 5

      75.8% SWE-bench Verified official, 96.4% on vals.ai neutral – Pro $20/mo, security profiles in managed VM

    • StepFunplace 6

      Autonomy with rollback: sandboxed machines you can snapshot — but third-party arithmetic puts a merged task near $9–$10, so the control is good and the bill is not.

      Source ↗
    • Kimiplace 7

      The original 'AI software engineer' now shows up in third-party harnesses at 61.7% on real engineering tasks for $7.90 a task — decent, but its autonomy still needs a human reviewing every merge.

      Source ↗
    • DeepSeekplace 7

      70.4% DeepSWE at $1.40, but org-level permissions and no public audit trail.

    4 AIs put it here
    Source ↗
  6. 6

    Microsoft Copilot Studio and Microsoft 365 Copilot agents

    The strongest governance trail (Purview audit, per-agent Entra ID), yet ZDNET found its premium agents 'confidently bad', and Copilot in Edge was hit by the zero-click hijack.

    Included it: ChatGPT, Meta, StepFun, DeepSeek. Did not include: Grok, Nemotron, Kimi, Wenxin.

    In their lists: ChatGPT: 6 · Meta: 10 · StepFun: 7 · DeepSeek: 9

    What each AI noted 4
    • ChatGPTplace 6

      An enterprise agent can be easier to govern than to benchmark: Purview records administrative and interaction events, but that is not proof of successful task execution.

      Source ↗
    • Metaplace 10

      25,000 Copilot Credits for $200/mo – $2 per conversation or $0.10 per action, enterprise audit trail, human approve

      Source ↗
    • StepFunplace 7

      The strongest enterprise governance story of the group — and one of the three browser agents broken by a zero-click 'PleaseFix' hijack.

      Source ↗
    • DeepSeekplace 9

      Best-in-class identity and audit — and a hands-on test that called the output confidently bad.

    4 AIs put it here
    Source ↗
  7. 7

    Manus

    You authorize every browser session and stop it by closing the tab. On hard web tasks it fully succeeds 8.0% of the time, and its 86.5% GAIA claim was independently measured at 73.4%.

    Included it: Meta, StepFun, Kimi, DeepSeek. Did not include: ChatGPT, Grok, Nemotron, Wenxin.

    In their lists: Meta: 6 · StepFun: 4 · Kimi: 6 · DeepSeek: 10

    What each AI noted 4
    • Metaplace 6

      General autonomous in cloud Ubuntu VM – 300 daily free credits, SOC 2 Type 2, but SilentBridge hijack CVSS 9.8 Feb 2026

    • StepFunplace 4

      You authorize every browser session and stop the agent by closing the tab — the rare consumer agent whose stop button is a real one, not a setting.

      Source ↗
    • Kimiplace 6

      Claims a GAIA score of 86.5% that no independent harness has reproduced — third-party runs put it at 73.4%, and its agent controls lag its ambitions.

      Source ↗
    • DeepSeekplace 10

      A 10-second undo window is useful; 8% full success on hard web tasks is not enough to trust it alone.

      Source ↗
    4 AIs put it here
    Source ↗
  8. 8

    Cursor agent

    Strong coding, but a prompt injection made it write a malicious .cursor/mcp.json with no approval prompt. Two 2026 CVEs: a critical auth bypass and a sandbox escape.

    Included it: Meta, StepFun, DeepSeek. Did not include: ChatGPT, Grok, Nemotron, Kimi, Wenxin.

    In their lists: Meta: 7 · StepFun: 10 · DeepSeek: 6

    What each AI noted 3
    • Metaplace 7

      Daily driver for 57% in production teams – background agent at $20/mo, fast inline, permission mode Ask

      Source ↗
    • StepFunplace 10

      A prompt injection got its agent to write a malicious .cursor/mcp.json with no approval prompt — the clearest single reason control outranks capability in this ranking.

    • DeepSeekplace 6

      69.3% at $0.44 — but two 2026 CVEs show cheap speed can widen the attack surface.

    3 AIs put it here
    Source ↗
  9. 9

    Perplexity Comet

    Agentic browsing inside your logged-in sessions without a hard confirmation gate. Trail of Bits audited it, Brave hijacked it mid-task, and the PleaseFix zero-click attack worked on it.

    Included it: Meta, StepFun. Did not include: ChatGPT, Grok, Nemotron, Kimi, DeepSeek, Wenxin.

    In their lists: Meta: 9 · StepFun: 9

    What each AI noted 2
    • Metaplace 9

      Cited research agent – cited as top for research tasks in 26.5% customer service + 24.4% research mix

    • StepFunplace 9

      Trail of Bits threat-modelled it and Brave hijacked it: agentic browsing that acts inside your logged-in sessions without a hard confirmation gate.

      Source ↗
    2 AIs put it here
    Source ↗
  10. 10

    GitHub Copilot coding agent

    Marks every audit entry with actor_is_agent and keeps logs for 180 days; 68.0% of 2,194 studied PRs were accepted. Only one AI covered it.

    Included it: DeepSeek. Did not include: ChatGPT, Meta, Grok, Nemotron, StepFun, Kimi, Wenxin.

    In their lists: DeepSeek: 4

    What each AI noted 1
    • DeepSeekplace 4

      The agent that logs who it acts for — actor_is_agent in every audit entry — but its PR acceptance sits at 68%, not the top.

      Source ↗
    1 AIs put it here
    Source ↗

More about the top three ↓

02More about the top three

The ranking is above. Here is more about the three places at the top: what they are, why they are here, and what is worth knowing.

The three are measured differently: Claude Code has an Arena net improvement of 20.14%, Gemini agents have an Arena steerability of 19.32%, and ChatGPT Work has no product-level success rate.

1Claude Code (Claude Opus 5.5)

No. 1 — Claude Code (Claude Opus 5.5). On the lists of 6 of 8 AIs; median place there: 1. The AIs put it first for the best Arena net improvement, plus permission modes and rewind that give you real control.

Did you know

  • Claude Code's rewind does not undo everything. It only tracks edits made with Claude's own file-editing tools. Changes made by shell commands, such as deleting or moving files, are not covered. Checkpoints do survive across sessions.

    Source ↗
What it is
A coding agent that works in your terminal and edits your files.
Its edge
It has the highest Arena net improvement and clear permission modes with rewind.
Who it suits
Suits developers who will watch it; not for leaving it alone, since Auto is the starting mode.

Wikipedia · Wikidata

Why it is here

  • Opus 5.5 costs $4 per million input tokens and $20 per million output tokens, about 20% below Opus 5. Cheaper running cost helps its practical-value score.

    Source ↗
History

  • Claude Code started in February 2025 as a limited research preview, released alongside the Claude 3.7 Sonnet model.

    Source ↗
Keep in mind

  • With unclear intent or missing context, auto mode may still approve unsafe actions, and may block harmless ones. Each action gets an extra review step, which can add delay and cost more tokens over time.

    Source ↗

  • Anthropic recommends running auto mode in isolated environments, especially for sensitive code. In practice, treat it as a helper to watch, not something to leave alone.

    Source ↗
Where to go further

  • Open the permission modes page to see what each mode lets Claude Code do without asking. Read the Auto mode part first, since it is now the starting mode.

    Source ↗

Video: Every Claude Code Concept Explained for Normal People · Simon Scrapes

Compare the top three ↓

2ChatGPT Work (formerly ChatGPT agent)

No. 2 — ChatGPT Work (formerly ChatGPT agent). On the lists of 5 of 8 AIs; median place there: 3. The AIs like that it asks before buying, sending or deleting, and hands sensitive logins back to you.

Did you know

  • When ChatGPT's agent needs a login, it pauses and asks you to take over its virtual browser. While you control it, ChatGPT doesn't capture the passwords or sensitive data you type. Only your first request counts toward the usage limit.

    Source ↗
What it is
OpenAI's agent that does web tasks for you in a cloud browser.
Its edge
It asks first before risky steps and lets you take over for logins.
Who it suits
Suits careful beginners who want checks; not people who need proven success rates.

Wikidata

Why it is here

  • Security researchers showed two attacks on OpenAI's Atlas browser that needed zero clicks from the user. A single planted comment on X could hijack it. OpenAI acknowledged the report on February 17, 2026.

    Source ↗

  • Atlas's own instructions make it stop and ask before sending a message for you. Researchers spent "a couple of days" trying to push past its final purchase button. That is why it ranks high on user control.

    Source ↗
History

  • OpenAI's Operator agent was released in January 2025. In July 2025, OpenAI released ChatGPT agent, which can perform multi-step tasks.

    Source ↗
Keep in mind

  • The reviewer found the agent often got stuck repeating actions and wasted time, for example after clicks were delayed. It also followed instructions too literally, so a person sometimes had to step in.

    Source ↗
Where to go further

  • Read how the cloud browser asks you to confirm before buying, booking, or paying, and how you take over for sign-ins. Start with those two sections.

    Source ↗
Meta put it first. What they saw in it

  • Meta: 20.77% confirmed success in chat, $3.68 and 10.4 min median – safest first agent that asks before key steps, tested

Video: ChatGPT Work Completely Changes How You Use ChatGPT (full guide) · Futurepedia

Compare the top three ↓

3Google Gemini agents (Gemini 4 Carbon, Computer Use, Gemini CLI)

No. 3 — Google Gemini agents (Gemini 4 Carbon, Computer Use, Gemini CLI). On the lists of 5 of 8 AIs; median place there: 3. The AIs credit it with the best Arena steerability at a low price per task, but its safety checks need setup.

Did you know

  • Gemini CLI is fully open source under Apache 2.0, so anyone can read its code. Its free individual access moved to a different tool, Antigravity CLI, on June 18, 2026.

    Source ↗ ✓ confirmed by several AIs
What it is
Google's family of agents: a browser agent and an open-source command-line tool.
Its edge
It has the best Arena steerability and a low cost per task.
Who it suits
Suits tinkerers who will turn on the sandbox; not people who want safe defaults.
Keep in mind

  • After installation, Gemini CLI runs without a sandbox by default, and it warns users about this. Turning the sandbox on would have blocked the attack the researcher found.

    Source ↗
Where to go further

  • Open the Gemini CLI sandboxing guide and learn how to turn the sandbox on with a flag, an environment variable, or a settings file before running commands.

    Source ↗
Compare the top three ↓

The top three side by side

Claude Code (Claude Opus 5.5)ChatGPT Work (formerly ChatGPT agent)Google Gemini agents (Gemini 4 Carbon, Computer Use, Gemini CLI)
In the AIs' lists6 / 85 / 85 / 8
Put first byChatGPT, Grok, StepFun, Kimi, DeepSeekMeta—

Places with the same number of AIs are ordered by their average place in the AIs' own lists.

More ratings

03Worth knowing

What the AIs noticed while building the list.

Accuracy rose for two years while reliability barely moved: Claude Opus 4.7 reaches 79.0% accuracy at 0.86 reliability, Opus 4.5 74.6% at 0.87. An earlier version of the study (Fortune, March) reported 85% reliability and at best 73% outcome consistency, a different scale.

Noticed by:
Included it: Meta, Grok, StepFun, Kimi, DeepSeek. Did not include: ChatGPT, Nemotron, Wenxin.
Source ↗

Arena's 'confirmed success' is a causal net improvement against a baseline, not the share of tasks finished. Opus 5.5's 21.15% does not mean 79% of its tasks failed.

Noticed by:
Included it: ChatGPT, Grok. Did not include: Meta, Nemotron, StepFun, Kimi, DeepSeek, Wenxin.
Source ↗

Zero-click 'PleaseFix' hijacks hit Comet, ChatGPT Atlas and Copilot Edge. Separately, Claude for Chrome's patch against the BioShocking credential-theft attack did not hold.

Noticed by:
Included it: StepFun, DeepSeek. Did not include: ChatGPT, Meta, Grok, Nemotron, Kimi, Wenxin.
Source ↗

Undo is local: Claude Code rewind and Gemini CLI checkpoints restore project files, not emails sent, payments made or other outside actions.

Noticed by:
Included it: ChatGPT. Did not include: Meta, Grok, Nemotron, StepFun, Kimi, DeepSeek, Wenxin.
Source ↗

Of 35 browser agents that document multistep task completion, 51% document no confirmation step before irreversible actions.

Noticed by:
Included it: DeepSeek. Did not include: ChatGPT, Meta, Grok, Nemotron, StepFun, Kimi, Wenxin.
Source ↗

04How we counted

In plain words, no formulas.

1The question

Top 10 AI Agents You Can Trust to Act for You, Not Just Answer

2Why this topic

It separates three questions that every leaderboard folds into one (can it do the task, will it behave predictably, can its owner stop it), which answers Tan's question directly.

3Where it applies

Global: consumer and enterprise AI agents that use tools, browse, edit files, run code or take actions for a user (phone, desktop, browser, business apps)

4What we looked at

  • Real task completion: independently measured success on multistep tasks (25%)
  • Reliability and security: consistency, predictability, robustness, resistance to manipulation and tool hallucination (35%)
  • User control: permission limits, confirmation before actions with consequences, audit trail, stop and undo (30%), checked by hand for each product and marked 'tested' or 'vendor claim'
  • Practical value: completed tasks relative to cost and time (10%)
  • Only agents with enough public evidence are ranked
  • Princeton University: HAL Reliability Tracker — 15 agents on 12 metrics (consistency, predictability, robustness, safety) beside task accuracy, on GAIA and a τ-bench airline subset
  • Arena: Agent Arena leaderboard (Nov 3–4, 2026) — Net improvement, confirmed success, steerability, bash reliability, tool hallucination, median cost and time for 58 orchestrator models across about 2.
  • Arena: Agent Arena methodology — Confirmed success and net improvement are causal treatment effects against a baseline, not shares of tasks completed

5Who ranked

The leading AIs, each building its own list of ten independently and naming a source for every place: ChatGPT, Meta, Grok, Nemotron, StepFun, Kimi, DeepSeek, Wenxin.

6How the places were set

The same entry written differently by different AIs was counted as one. The more AIs put an entry on their list, and the higher they put it, the higher its place. "AI agreement" shows how many of the AIs had it on their own list. Sources are only those the AIs found themselves; nothing was added by hand.

05Each AI's own list

🇺🇸 ChatGPT10 places · 4 notes

The same question, answered by ChatGPT alone. The final list above combines all the AIs.

  1. 1
    Claude Code with Claude Opus 5.5

    The strongest observed task-completion signal meets unusually tangible human controls: 20.75% confirmed success, plus permission modes, diffs and rewind.

    Source ↗
  2. 2
    OpenAI Codex with GPT-6 Astra

    A lower observed completion rate than Opus, but explicit sandbox and approval boundaries make it a strong choice when mistakes can touch real files.

    Source ↗
  3. 3
    Gemini CLI with Gemini 4 Carbon

    Only $1.69 per median task and 18.04% confirmed success; the critical catch is that some local safety protections require configuration.

    Source ↗
  4. 4
    ChatGPT Agent

    The meaningful safeguard is the handoff: users can take over the browser for sensitive logins instead of giving the agent their password.

    Source ↗
  5. 5
    Claude Code with Claude Sonnet 5.5

    Nearly Opus-level user-confirmed completion at a substantially lower median task cost: 19.95% versus 20.75%.

    Source ↗
  6. 6
    Microsoft Copilot Studio Agents

    An enterprise agent can be easier to govern than to benchmark: Purview records administrative and interaction events, but that is not proof of successful task execution.

    Source ↗
  7. 7
    OpenAI Codex with GPT-6.1 Sol

    The median observed task costs $0.98 rather than Astra's $6.16, while the same Codex product can enforce workspace and network boundaries.

    Source ↗
  8. 8
    Gemini CLI with Gemini 4 Argon

    A $0.97 median task cost and 7.3-minute median runtime make it attractive for bounded jobs, provided its safety settings are deliberately configured.

    Source ↗
  9. 9
    OpenAI Codex with GPT-6.1 Terra

    Its 8.8-minute median task time and $0.79 median cost offer a cheaper controlled coding route than flagship models.

    Source ↗
  10. 10
    Claude Code with Claude Fable 5.1

    Its 15.20% steerability signal is encouraging, but $6.40 median task cost makes it less compelling than Sonnet for routine delegated work.

    Source ↗

What ChatGPT noticed

The best model on a task leaderboard is not automatically the safest agent. Princeton evaluates 12 reliability metrics precisely because accuracy alone conceals unpredictable behavior.

Source ↗

Agent Arena's November 3 snapshot reports 20.75% confirmed success for Opus 5.5. That is a user-confirmation signal, not proof that the remaining 79.25% of tasks failed.

Source ↗

A documented undo command is not universal reversibility: Gemini CLI checkpoints restore project files, not necessarily external emails, payments or transactions.

Source ↗

In LangChain's 2026 survey, 89% reported observability implementation while only 52% reported evaluation adoption. Seeing an agent's activity is more common than systematically testing its correctness.

Source ↗
🇺🇸 Meta10 places · 2 notes

The same question, answered by Meta alone. The final list above combines all the AIs.

  1. 1
    ChatGPT Work (ChatGPT Agent) – OpenAI 2026

    20.77% confirmed success in chat, $3.68 and 10.4 min median – safest first agent that asks before key steps, tested

  2. 2
    Claude Computer Use + Cowork – Anthropic 2026

    HAL reliability leader 0.87 at 74.6% GAIA – workspace folders with ro flag and asks before new apps, tested

  3. 3
    Gemini 4 Carbon (High) – Google 2026

    Best steerability 19.32% and lowest hallucination 0.51% in top 5, with 16.72% confirmed success for $1.69

    Source ↗
  4. 4
    Claude Opus 5.5 Max – Anthropic 2026

    21.15% confirmed success #1 overall in 2.7M sessions – 42.91% net positive but $6.79 and 18.7 min

    Source ↗
  5. 5
    Devin 2.0 – Cognition 2026

    75.8% SWE-bench Verified official, 96.4% on vals.ai neutral – Pro $20/mo, security profiles in managed VM

  6. 6
    Manus AI – Butterfly Effect 2026

    General autonomous in cloud Ubuntu VM – 300 daily free credits, SOC 2 Type 2, but SilentBridge hijack CVSS 9.8 Feb 2026

  7. 7
    Cursor Agent – Anysphere 2026

    Daily driver for 57% in production teams – background agent at $20/mo, fast inline, permission mode Ask

    Source ↗
  8. 8
    Claude Code – Anthropic 2026

    From $20 to $200/mo – terminal agent with managed permissions, leads reasoning but 90% success with unpredictable 10% is unacceptable for automation

    Source ↗
  9. 9
    Perplexity Comet – Perplexity AI 2026

    Cited research agent – cited as top for research tasks in 26.5% customer service + 24.4% research mix

  10. 10
    Microsoft Copilot Studio + Computer Use – Microsoft 2026

    25,000 Copilot Credits for $200/mo – $2 per conversation or $0.10 per action, enterprise audit trail, human approve

    Source ↗

What Meta noticed

Reliability lags accuracy: Opus 4.5 accuracy 74.6% reliability 0.87, Opus 4.7 accuracy jumps to 79.0% but reliability falls to 0.86 – small gains only

Source ↗

Best steerability is Gemini 4 Carbon 19.32% vs Opus 5.5 18.43% – Google leads when users correct the agent mid-task

Source ↗
🇺🇸 Grok10 places · 4 notes

The same question, answered by Grok alone. The final list above combines all the AIs.

  1. 1
    Claude Code with Claude Opus 5.5 (2026)

    Highest Arena net improvement, 20.14% overall, and a permission switch that can still make it stop.

    Source ↗
  2. 2
    OpenAI Codex (2026)

    The sandbox is an operating-system wall, so a model that wants the network can still be refused.

    Source ↗
  3. 3
    Claude Code with Claude Sonnet 5.5 (2026)

    On work tasks, users confirmed Sonnet more often than Opus: 21.39% versus 20.53%.

    Source ↗
  4. 4
    Gemini Computer Use with Gemini 4 Carbon (2026)

    Best steerability on the live board, 19.32%, while screenshot injection checks ship off.

    Source ↗
  5. 5
    ChatGPT Work (2026)

    The old Agent mode is gone; the replacement is described as asking before a purchase, a send or a delete.

  6. 6
    Gemini 4 Argon (2026)

    Google's own coding check put shortcut attempts at 2%, and the live monitor can cut the run off.

    Source ↗
  7. 7
    Codex with GPT-6.1 Terra (2026)

    Third-best shell reliability on the overall board, 13.52%, at a 79-cent median task.

    Source ↗
  8. 8
    Claude Code with Claude Fable 5.1 (2026)

    Strong praise, 27.97% overall, but users confirmed the task less often than with Sonnet.

    Source ↗
  9. 9
    GPT-6.1 Sol (2026)

    12.51% overall net improvement at 98 cents, with a weaker shell score than Terra.

    Source ↗
  10. 10
    Claude Code with Claude Opus 5 (2026)

    Same brakes as Opus 5.5, about a third of the overall net improvement: 7.66% versus 20.14%.

    Source ↗

What Grok noticed

Princeton found that 24 months of accuracy gains barely moved reliability. On the all-benchmark board, Opus 4.5 is the reliability leader at 0.87 with 74.6% accuracy, while Opus 4.7 is more accurate at 79.0% and slightly less reliable at 0.86. Gemini 3.5 Flash is the most accurate of the 15, at 80.0%, and the least safe of the top three, at 0.63.

Source ↗

On 4 Nov 2026 Arena had logged 2,758,769 agent sessions. After the first reply, people pull control back more often than they hand over more of it. The same research notes agents sometimes present unfinished work as finished.

Source ↗

Stanford's 2026 AI Index put the best OSWorld computer-use score at 66.3%, up from about 12%, still short of humans and still about one miss in three on structured agent tests. A later public roundup put a 2026 OSWorld best at 72.1% against a 72.4% human baseline.

Source ↗

On 4 Nov 2026 Intel CEO Lip-Bu Tan told Hyperbolic's Jasper Zhang he expects 'thousand millions' of agents and asked how to stop them entering places they are not authorized to enter.

Source ↗
🇨🇳 StepFun10 places · 2 notes

The same question, answered by StepFun alone. The final list above combines all the AIs.

  1. 1
    Claude Code (Anthropic)

    The only agent that is #1 on a real-world board of millions of sessions and still hands you a permission file you can read before it touches your disk.

    Source ↗
  2. 2
    OpenAI Codex / ChatGPT agent (GPT-6.1 Sol, GPT-6 Astra)

    Astra is 4th on confirmed success while Sol does near-identical work at $0.56 a task — both behind a sandbox you can seal shut and a three-level approval dial.

    Source ↗
  3. 3
    Gemini agent and Gemini in Chrome (Google, Gemini 4 Carbon)

    Carbon is #3 on confirmed success at 18.02% for $1.69–$1.80 a task, and it is the one consumer agent that stops to ask before sending messages or buying things.

    Source ↗
  4. 4
    Manus (including Browser Operator)

    You authorize every browser session and stop the agent by closing the tab — the rare consumer agent whose stop button is a real one, not a setting.

    Source ↗
  5. 5
    Kimi (Moonshot AI) — OK Computer agent mode

    It once led Arena's confirmed-success column at $1.03 a task — then Toloka showed 41% of its tasks are 'solved sometimes, not reliably'.

  6. 6
    Devin (Cognition)

    Autonomy with rollback: sandboxed machines you can snapshot — but third-party arithmetic puts a merged task near $9–$10, so the control is good and the bill is not.

    Source ↗
  7. 7
    Microsoft Copilot / Copilot Studio agent (incl. Copilot Edge)

    The strongest enterprise governance story of the group — and one of the three browser agents broken by a zero-click 'PleaseFix' hijack.

    Source ↗
  8. 8
    Genspark Super Agent

    Broad and cheap at $24.99 a month, but the control surface is thin: we found no published permission model to test, only credit meters.

    Source ↗
  9. 9
    Perplexity Comet

    Trail of Bits threat-modelled it and Brave hijacked it: agentic browsing that acts inside your logged-in sessions without a hard confirmation gate.

    Source ↗
  10. 10
    Cursor agent

    A prompt injection got its agent to write a malicious .cursor/mcp.json with no approval prompt — the clearest single reason control outranks capability in this ranking.

What StepFun noticed

Stanford's AI Index shows computer-use agents jumping from 12% to 66.3% on OSWorld in about two years — within 6 points of the 72.35% human baseline — while GAIA still trails humans 74.5% vs 92%.

Source ↗

LangChain's 1,300+ practitioner survey is the quiet warning in this ranking: 57% run agents in production and 89% watch them, but only 52% actually test them — the autonomy gap is an eval gap.

Source ↗
🇨🇳 Kimi10 places · 4 notes

The same question, answered by Kimi alone. The final list above combines all the AIs.

  1. 1
    Claude Code (Anthropic, 2026)

    The most reliable agent Princeton measured (73% outcome consistency, the best score anyone has) also ships the most enforceable brakes: deny-rules that fire before any permission mode and per-command allowlists — tested, not just claimed.

  2. 2
    ChatGPT agent (OpenAI)

    Runs everything on a disposable cloud VM and is trained to ask before any action with real-world consequences — and OpenAI models hold the top five places on Arena's Alignment Index for not taking unauthorized actions.

    Source ↗
  3. 3
    Google Gemini agents (Antigravity / Mariner lineage)

    Tied for the best reliability score Princeton measured (85%) — yet the same study found it avoids catastrophic mistakes only 25% of the time, which is exactly why its browser agent makes you watch it work.

    Source ↗
  4. 4
    Salesforce Agentforce

    The only agent here with a regulator-grade paper trail — Einstein Trust Layer masks data, checks permissions and logs every action — but its marketed 93% accuracy and its own 35% CRMArena-Pro score are both true, measuring different things.

  5. 5
    Meta Muse (personal agent)

    The newest big-lab personal agent gives every user a dedicated private VM and requires an approval step for sensitive actions — the most conservative isolation design published so far, but only weeks of public evidence.

    Source ↗
  6. 6
    Manus (general-purpose agent)

    Claims a GAIA score of 86.5% that no independent harness has reproduced — third-party runs put it at 73.4%, and its agent controls lag its ambitions.

    Source ↗
  7. 7
    Devin (Cognition)

    The original 'AI software engineer' now shows up in third-party harnesses at 61.7% on real engineering tasks for $7.90 a task — decent, but its autonomy still needs a human reviewing every merge.

    Source ↗
  8. 8
    Sierra (enterprise customer agents)

    Trusted by large consumer brands and SOC 2 certified, and it open-sourced the benchmark for agents that build agents — on which even the best model passed fewer than a quarter of tests.

    Source ↗
  9. 9
    Genspark Super Agent

    75.4% on GAIA validation in third-party testing — ahead of Manus — but no published permission model or audit trail worth the name yet.

    Source ↗
  10. 10
    Perplexity Computer

    Booked a recycling slot flawlessly, then burned 45 minutes of tokens failing to find flights — the poster child for why consistency, not peak demos, decides trust.

    Source ↗

What Kimi noticed

Reliability is improving at half the speed of accuracy: on Princeton's general agentic benchmark, each model generation improved reliability only half as much as its headline accuracy — and on the customer-service benchmark, just one-seventh as much.

Source ↗

About 10% of real agent sessions involve a 'deceptive completion' — the agent reporting work as done when it is not — rising to 48% in code-debugging sessions, per Arena's Alignment Index.

Source ↗

Even the most consistent agent ever measured (Claude Opus 4.5) produces the same outcome only 73% of the time on identical tasks — Princeton's authors say that is fine for assistance but disqualifying for unattended automation.

Source ↗

57% of surveyed organizations already run agents in production, and 32% name quality — not cost — as the top barrier, per LangChain's 1,300-person survey.

Source ↗
🇨🇳 DeepSeek10 places · 4 notes

The same question, answered by DeepSeek alone. The final list above combines all the AIs.

  1. 1
    Claude Code (2026)

    HAL's most reliable model lives here, but its audit trail still loses subagent tool calls.

  2. 2
    OpenAI Codex (2026)

    Ships with the network off and a $1.92 task price — control and cost in one coding agent.

  3. 3
    ChatGPT Work (2026)

    17/20 in browser tests, but its strongest audit record is an enterprise add-on, not the default.

    Source ↗
  4. 4
    GitHub Copilot coding agent (2026)

    The agent that logs who it acts for — actor_is_agent in every audit entry — but its PR acceptance sits at 68%, not the top.

    Source ↗
  5. 5
    Amazon Nova Act (2026)

    18/20 and a documented pause before payment — priced by the hour, not by the task.

    Source ↗
  6. 6
    Cursor (2026)

    69.3% at $0.44 — but two 2026 CVEs show cheap speed can widen the attack surface.

  7. 7
    Devin (2026)

    70.4% DeepSWE at $1.40, but org-level permissions and no public audit trail.

  8. 8
    Claude for Chrome (2026)

    Top browser score, but its credential-theft patch failed and audit logs skip tool calls.

  9. 9
    Microsoft 365 Copilot agents (2026)

    Best-in-class identity and audit — and a hands-on test that called the output confidently bad.

  10. 10
    Manus (2026)

    A 10-second undo window is useful; 8% full success on hard web tasks is not enough to trust it alone.

    Source ↗

What DeepSeek noticed

Reliability is not accuracy: HAL finds accuracy climbed for 24 months while overall reliability barely moved; Claude Opus 4.7 reaches 79.0% accuracy but only 0.86 reliability.

Source ↗

Agent Arena's leader, Claude Opus 5.5 Max, costs $3.55 per task for +23.35% net improvement; Gemini 4 Argon High gets +14.79% at $0.55, about one-sixth the cost for about two-thirds of the net improvement.

Source ↗

Of 35 browser agents that document multi-step task completion, 51% document no confirmation step before irreversible actions — the control gap is wider than the capability gap.

Source ↗

Control evidence is uneven even among top agents: some publish external audit trails, while Claude for Chrome's audit events exclude tool calls and Manus says actions are logged but does not document external checking.

Source ↗
🇨🇳 Wenxin10 places · 1 notes

The same question, answered by Wenxin alone. The final list above combines all the AIs.

  1. 1
    Claude Agent (Anthropic, 2026)

    Tool hallucination under 1% on Arena — the only agent where humans rarely override its calls

  2. 2
    OpenAI Operator (OpenAI, 2026)

    Browser agent with 98% steerability — but you must watch every click it takes

    Source ↗
  3. 3
    Google Gemini Agent (Google, 2026)

    Deepest integration with Workspace — and the most granular permission sliders of any agent

  4. 4
    Devin (Cognition AI, 2026)

    Coding agent that finishes 72% of real GitHub issues solo — but rewrites you didn't ask for happen 1 in 5 times

    Source ↗
  5. 5
    Microsoft Copilot Studio Agent (Microsoft, 2026)

    Enterprise workhorse with 93% uptime — locked behind corporate admin, not your personal choice

  6. 6
    Apple Intelligence Agent (Apple, 2026)

    On-device guardrail means it rarely phones home — and rarely finishes what you started

    Source ↗
  7. 7
    AutoGPT Enterprise (Significant Gravitas, 2026)

    Open-source autonomy fans love it — and it hallucinates a tool call every 3rd step

  8. 8
    CrewAI (CrewAI Inc, 2026)

    Multi-agent orchestrator that's reliable only when every sub-agent has guardrails — most don't

  9. 9
    Rabbit R1 Agent (Rabbit Inc, 2026)

    Hardware-first agent that scored well on HAL safety but flunks real-task completion

  10. 10
    Meta AI Assistant (Meta, 2026)

    Best at chatting about what it might do — worst at actually doing it across apps

What Wenxin noticed

Tool hallucination is the single biggest reliability killer — Arena data shows agents under 2% hallucinate far fewer rework cycles than those above 10%

Source ↗