AgentAudit reads only an execution trace and produces trust spreads of 95.1 against 22.6 at similar task completion.

arXiv 2609.09875 argues existing frameworks measure completion (AgentBench) or robustness (AgentDojo, ASB) but never attribute a failure to a stage. It scores instruction integrity, planner, memory, tool selection, invocation, correctness, alignment, faithfulness, security and execution integrity, then names the failing stage. Claude Sonnet 5 scored 95.1 and GPT-5 80.6; Sarvam 105B, Llama 3.3 70B and Gemini 2.5 Flash scored 57.6, 45.7 and 22.6. Several non-frontier models were repeatedly classified Unsafe_Compliance rather than merely failing, a distinction pass/fail benchmarks cannot see. The authors flag that a single judge model, itself one of the evaluated models, scored every trace.