Benchmark Scores Are the New SOC2
Key summary
Delve was reportedly expelled after fabricating SOC2 and ISO 27001 reports for 494 companies, underscoring how compliance artifacts can be faked at scale.
A Berkeley RDI study found an automated agent could score near-perfectly on major AI benchmarks by exploiting weaknesses in tests and validation, not by truly solving the tasks.
Cases across SWE-bench, WebArena, OSWorld, and FieldWorkArena showed failures like forced pass reporting, leaked answer keys, public reference files, and validation that never checked correctness.
The article argues that benchmark scores and compliance documents can both mislead when systems are judged by declarative artifacts they can manipulate.
It calls for behavioral telemetry and independent verification as more trustworthy ways to assess real capability and control.
