# Benign Asks, Risky Consequences (BARC-Bench)

> Scale AI's benchmark of whether AI agents stay safe while carrying out ordinary workplace requests. Agents handle 110 benign tasks in nine simulated workspaces, where the risk lies in how the work is done, such as leaking private details in a calendar invite. The score is safety pass^5: the share of tasks on which all five attempts were safe.

Canonical page: https://benchlm.ai/benchmarks/barc-bench

- Category: [Agentic](/agentic)
- Last updated: Paper v2, Nov 3, 2026

## About BARC-Bench

- Year: 2026
- Tasks: 110 benign workplace requests across nine simulated workspaces: 70 communication tasks, 34 file operations and 6 workspace application changes
- Format: Agent runs in simulated workspaces with MCP tools; five attempts per task, judged by GPT-5.6 Sol against each task's rubric
- Difficulty: Respecting boundaries the requester never stated, from workspace records and social norms
- Paper: [BARC-Bench: Benign Asks, Risky Consequences](https://arxiv.org/abs/2610.32024v2)

Each task is an everyday request from an employee to an agent working inside a simulated organization with people, email and chat history, calendars, documents and operational records. The requests are benign but leave safety boundaries unstated. Scale labels each boundary as explicit in the environment (stated in an artifact such as meeting notes, 61 tasks), implicit in the environment (inferred by connecting records, 23 tasks) or a social norm (26 tasks), and each request as communication or a workspace change. An attempt fails if it takes any unsafe action, even if it later completes the task or defers to the user; it passes if it completes the task safely or defers. Each model ran five times per task in the OpenCode harness on Scale's AgentEnv Framework at its default thinking budget. A GPT-5.6 Sol judge scored each attempt from the prompt, the full trajectory, the final artifacts and the environment state. On 300 trajectories checked by three human reviewers, the judge matched the majority verdict 90.0% of the time.

BARC-Bench is currently displayed on BenchLM for reference, but it is excluded from the weighted scoring formula.

## Leaderboard (4 models)

| Rank | Model | Configuration | Creator | Score |
|------|-------|---------------|---------|-------|
| 1 | [GPT-6 Astra](/models/gpt-6-astra) | OpenCode on the AgentEnv Framework · default reasoning · pass@5 90.0% · 75.8% on the 91 requests with no conflict · 57.9% on the 19 that conflict with a workspace rule | OpenAI | 72.7% |
| 2 | [Claude Fable 5.1](/models/claude-fable-5-1) | OpenCode on the AgentEnv Framework · default reasoning · pass@5 71.8% · 37.4% on the 91 requests with no conflict · 36.8% on the 19 that conflict with a workspace rule | Anthropic | 37.3% |
| 3 | [Gemini 3.8 Flash](/models/gemini-3-8-flash) | OpenCode on the AgentEnv Framework · default reasoning · pass@5 46.4% · 26.4% on the 91 requests with no conflict · 10.5% on the 19 that conflict with a workspace rule | Google | 23.6% |
| 4 | [DeepSeek V4 Pro 0813](/models/deepseek-v4-pro-0813) | OpenCode on the AgentEnv Framework · default reasoning · pass@5 51.8% · 9.9% on the 91 requests with no conflict · 5.3% on the 19 that conflict with a workspace rule | DeepSeek | 9.1% |

## FAQ

### What does BARC-Bench measure?

Whether an AI agent avoids harmful actions while doing an ordinary, benign workplace task, such as scheduling a meeting or updating records, when the safety boundary is not stated in the request. The agent has to find the rule in the workspace or infer it from context and social norms.

### Which model is safest on BARC-Bench?

GPT-6 Astra, safe on all five attempts for 72.7% of the 110 tasks. Claude Fable 5.1 scores 37.3%, Gemini 3.8 Flash 23.6% and DeepSeek V4-Pro 9.1%.

### What is the difference between pass^5 and pass@5 on BARC-Bench?

Pass^5 counts a task only if all five attempts were safe; pass@5 counts it if at least one was. DeepSeek V4-Pro rises from 9.1% to 51.8% under pass@5, which shows that models can act safely but do not do so consistently.