SYNTHESIS NOTE
Topics›Assistants Personalization›this note

Do phone agents succeed at all three critical tasks equally?

Explores whether task success, privacy compliance, and preference reuse develop together in phone-use agents, or whether benchmarking one capability tells you nothing about the others.

Synthesis note · 2026-05-18 · sourced from Assistants Personalization

The MyPhoneBench evaluation surfaces a finding with direct deployment consequences: the three properties most relevant for phone-use agent deployment — task success, privacy compliance during completion, and proper use of saved preferences in later sessions — are statistically distinct capabilities. No model dominates all three. Evaluating one of them does not predict the others.

The pattern matters because of how benchmarks have been structured. Most agent benchmarks score task success: did the agent complete the task as instructed? Models that score well on this single metric get ranked as "frontier" and get deployed. But when the same models are scored jointly on success-plus-privacy or success-plus-preference-reuse, the ranking reshuffles. A model that wins on success-only may lose on success-with-privacy, because it completes tasks by overfilling personal entries. A model with mediocre success may have better privacy compliance because it stops at minimal disclosure.

The deeper observation is that "deployment readiness" is not a scalar. It is a vector across the capabilities the deployment actually requires. For phone-use agents, that vector includes at minimum success, privacy compliance, and longitudinal preference handling. For other agent deployments it would include different combinations. Evaluating on the wrong subset of capabilities produces models that score well on the benchmark and fail in production.

For benchmark designers, this argues for joint evaluation as the default rather than as a research add-on. A benchmark that scores only one capability and ranks models on it is producing rankings that will not generalize to deployment. The methodological move is to evaluate the capability vector and present results as multi-dimensional rather than collapsing to a single score.

For agent developers, the immediate consequence: do not assume success-trained models will be privacy-compliant or preference-respecting. These need to be selected and trained for, not assumed.

Inquiring lines that read this note 49

This note is a source for these research framings, grouped by the broader line of inquiry each explores. Scan the bold lines of inquiry; follow any specific question forward.

What drives appropriate trust calibration in personalized AI systems? How do capability benchmark scores systematically misrepresent true model abilities? Why do agents falsely report success on failed tasks? How do pretraining biases affect reward signal effectiveness in RLVR? Why do people disclose to AI systems despite their artificial nature? What prevents conversational agents from taking initiative in dialogue? When should work require human-AI partnership versus full automation? How do neighboring agents influence whether others cooperate or collude? Should agents decouple planning from perception grounding for better performance? What execution architectures enable agents to most effectively use tools? What factors drive AI persuasiveness and how can it be mitigated? When do multi-agent systems outperform single frontier models? Does abstract user knowledge outperform concrete interaction history in personalization? What attack surfaces do reasoning traces and chains introduce? Do reasoning benchmarks predict model performance in long-horizon workflows? How can we detect and prevent harm propagation through multi-agent delegation workflows? Why do standard benchmarks fail to predict agent deployment success? How can reward models capture diverse human preferences without excluding minority populations? What should agent evaluation prioritize to reveal reliable behavior? Can harness architecture and protocols provide agent reliability without model scaling? Can single-point security defenses protect multi-agent systems from multi-step attacks? How do spurious versus genuine rewards shape model reasoning and behavior? What trajectory-level metrics beyond task success best evaluate agent performance? What capability trade-offs arise from domain specialization through fine-tuning? How can oversight detect and prevent conditional compliance when agents know they are watched? How vulnerable are token issuance and authorization policies to coordinated attacks?

Related concepts in this collection 3

This note in its neighbourhood — explore the map, then jump to a related concept in the list below.

Concept map
13 direct connections · 123 in 2-hop network ·dense cluster Open in graph ↗
Do phone agents succeed at all three critical ta… Why do phone-use agents overfill optional personal… Can a two-category privacy boundary actually be au… Do short benchmarks predict how models perform ove…

Click a node to walk · click center to open · click Open in graph to see this note in the full knowledge graph

your link semantically near linked from elsewhere

Related papers in this collection 8

Papers most semantically related to this note, ranked by cosine similarity in the embedding space.

Search by related questions 4

Suggested questions this note speaks to — click to search the collection, or type your own.

Why do completion-oriented models systematically sacrifice privacy compliance?What evaluation structure would capture deployment readiness instead of benchmark scores?How do minimal-disclosure privacy contracts enable multi-dimensional agent evaluation?Does single-capability ranking guarantee agent failure in production deployment?
Original note title

task success privacy compliance and saved-preference reuse are distinct capabilities in phone-use agents — success-only evaluations overestimate deployment readiness