WorkBench Revisited Finds Top AI Agent Now Completes 89% of Office Tasks, Up From 43% in 2024, With Safety Improving Alongside It
A two-year follow-up to the WorkBench benchmark finds the best workplace agent jumped from 43% to 89% task completion while unintended harmful actions fell from 26% to 2.5%.
Overview
A new follow-up study to a 2024 benchmark for office automation finds that the best AI agent now completes 89 percent of workplace tasks while taking an unintended harmful action on just 2.5 percent of them. The paper, WorkBench Revisited: Workplace Agents Two Years On, was submitted to arXiv on June 10, 2026 by Olly Styles, who also led the original benchmark. It compares today’s frontier systems against the state of the art in March 2024, when the best agent, GPT-4, completed 43 percent of tasks and took an unintended harmful action, such as emailing the wrong person, on 26 percent of them, according to the paper.
The headline result reframes a common worry about agentic AI. Rather than capability and safety trading off against each other, the study reports that on WorkBench they move together: “capability and safety go together on WorkBench rather than trade off, so the models that finish the most tasks also do the least unintended damage,” the paper states.
What WorkBench Measures
WorkBench was introduced in 2024 as a sandbox for evaluating whether AI agents can carry out routine office work. The original release “contains a sandbox environment with five databases, 26 tools, and 690 tasks,” representing “common business activities, such as sending emails and scheduling meetings,” according to the 2024 paper. Its central design choice was what the authors called “outcome-centric evaluation”: each task has a single unambiguous correct result, so success can be checked automatically by inspecting whether the right database values changed, as the 2024 paper describes.
The revisited version spells out the sandbox in more detail. It “provides a sandbox of five databases (a calendar of 300 events, an inbox of 500 emails, 500 website-analytics records, a customer relationship manager with 200 customers, and a project-management board of 300 tasks), 26 tools to read and write them, and 690 tasks generated from templates,” according to the full text.
What the Numbers Show
The top performer in the 2026 run is Claude Opus 4.8, which “completes 89% and takes an unintended harmful action on 2.5%,” according to the paper. The detailed results table puts its completion rate at 88.8 percent, its harmful-side-effect rate at 2.5 percent, and its cost at $0.182 per task, as reported in the full text.
The gains since 2024 are stark when measured against the original baselines. In the first study, agents completed “as few as 3% of tasks (Llama2-70B), and just 43% for the best-performing (GPT-4),” according to the 2024 paper. The revisited study evaluated 21 models spanning four groups of vendors — OpenAI, Anthropic, Google, and several Chinese labs including Qwen, DeepSeek, Kimi, and GLM, according to the full text.
Cost is the other axis of change. “The rise of open-weight models has drastically lowered costs for a performance level that was previously only accessible to proprietary models, while frontier costs have stayed relatively stable,” the paper reports. In the results table, the strongest open-weight entry, Qwen3.5, reaches 63.2 percent task completion at $0.003 per task — roughly two orders of magnitude cheaper than the most expensive entry, GPT-4-turbo at $0.307 per task, according to the full text.
What Has and Hasn’t Improved
The study reports that several error classes have been effectively eliminated since 2024. Failures in following the ReAct response format, sending emails to the wrong address, identifying the correct calendar slot, and updating the wrong events have largely disappeared, according to the full text.
Other weaknesses persist. The paper notes little progress on tasks that require plotting future data, and that agents still misinterpret retrieved data and struggle when search tools return truncated results, according to the full text. Crucially, the residual harm has not been driven to zero: “while several classes of error have been totally eliminated, frontier models still make some basic mistakes that occasionally result in irreversible harm, such as sending an email to the wrong person,” the paper states.
What We Don’t Know
WorkBench is a templated sandbox, not a live workplace, so its 690 tasks may not capture the open-ended ambiguity of real office work. The benchmark measures whether the correct database state is reached, but a 2.5 percent rate of irreversible errors still implies that roughly one in 40 task attempts by even the best agent can cause unintended harm — a figure the paper presents as progress rather than a clean bill of health. The study also does not claim to settle whether the capability-and-safety alignment it observes on WorkBench generalizes to other agentic settings.
Analysis
The original WorkBench paper framed its low scores as a caution, concluding that the benchmark “reveals weaknesses in agents’ ability to undertake common business activities, raising questions about their use in high-stakes workplace settings,” per the 2024 paper. Two years on, the same author’s data tells a markedly different story: the best agent now clears nearly nine in ten tasks, and the cheapest path to a usable performance tier has collapsed in cost thanks to open-weight models. The more durable finding may be the structural one — that on this benchmark the most capable models are also the safest — which, if it holds beyond WorkBench, would complicate the common assumption that pushing agents to do more inevitably makes them more dangerous.