What a car, a GUI trace and a poisoned screenshot can actually prove

DrivingBench put four general-purpose model and harness combinations behind a narrow interface to a Toyota Corolla on a low-speed cone course. The vehicle could continue moving while the model processed the next camera view. Of the reported runs, only GPT-6 Astra completed the course, on a second attempt. The experiment was conducted with a human safety driver, and no public-road autonomy claim follows from it.

Two other October studies examine superficially similar ideas about agent reliability but measure different objects. GraceBench reads mobile GUI trajectories against reference state graphs and finds deviations or loops in 51.24% of successful runs. MMA-SafetyBench plants visually plausible instructions into screenshots, documents and video contexts and measures how frequently agent outputs are redirected. Its maximum reported attack-success rate is 87.96% in a selected configuration. Treating the three percentages as a single reliability comparison would combine physical course completion, route stability and adversarial target-matching scores with incompatible denominators.

In the car, latency is physical. A command remains active while the world changes, and the safety driver can end a run. The decisive evidence is not only the model's steering request but the resulting vehicle movement and an independent emergency stop. A successful path once does not establish that the controller can handle different obstacles or timing.

A desktop agent presents a different diagnostic problem. It might reach the desired state through an unnecessary detour, or click through an intermediate screen that produces an irreversible effect. GraceBench gives investigators a language for diagnosing those routes. It does not supply the application permissions or ground-truth financial records needed to judge their consequences. A legitimate alternative route also should not be mistaken for an attack just because it differs from one stored transition graph.

Visual injection introduces an adversary who controls part of the observation. The screenshot may depict an authoritative-looking warning, while the actual source is an ordinary page, dialog or document. A model can react to the forged message even if it has no access to external accounts. Here the correct security test must track the handoff from visual interpretation to a permitted operation. Output-level attack success is not the same as files written or money sent.

A concrete implementation defect offers a useful comparison. In Git MCP Server's path-traversal case, an apparently repository-scoped tool delegated staging to GitPython, which could accept paths outside the working tree. The February maintainer fix replaced that behavior with Git CLI staging in version 2026.1.14. The case identifies an actual tool-implementation boundary and a patched release, while carefully separating unauthorized local staging from possible later network exfiltration. That is a different type of evidence from an agent being fooled by a visual prompt.

These studies support a practical distinction rather than a universal score. Observation provenance tells us who controlled the material an agent saw. A trajectory log tells us what the agent attempted or how it recovered. A tool-level or external-system record tells us what changed. An authorization policy determines whether that effect was permitted. Independent checks at each stage can establish an accountable chain; none is reliably inferred from the final answer or a benchmark success percentage alone.