Most conversations about how smart an AI model is start with a single number. It scored this percent on that test, so it is this good. New research from the UK's AI Security Institute argues that this habit is quietly misleading, and that the way we read AI agent benchmarks hides more than it reveals. Their finding is blunt: a score is not a fixed property of a model at all. It is a snapshot taken at one budget, and change the budget and the number moves a lot.
- The UK AI Security Institute tested frontier models across seven benchmarks at different compute budgets and found scores rose sharply with more tokens.
- Software engineering success climbed by up to 25 percent when the token budget went from 1 million to 10 million; hard math and science tasks gained about 22 percent.
- A model's useful time horizon stretched from roughly 40 minutes of human-equivalent work to about 4 hours as its budget grew from 2.5 million to 50 million tokens.
- Reading capability as a curve over compute, not a single score, changes how fast progress looks and how much a benchmark can be trusted.
The problem with a single benchmark score
Public leaderboards trained everyone to think of model ability as one figure. A model MMLU score, a SWE-Bench percentage, a rank on some arena. That framing is convenient and it is how most coverage, including a lot of marketing, compares systems. The trouble is that an agent does not answer a hard task in one shot. It works, checks itself, tries again, calls tools, and keeps going until it runs out of room. How much room it is given turns out to matter enormously.
The AI Security Institute, the UK government body that grew out of the AI Safety Institute set up in November 2023 and renamed in early 2025, set out to measure exactly that. As The Decoder reported, the institute ran frontier models across seven benchmarks while varying the compute they were allowed to spend, then watched what happened to the scores. The scores did not sit still. They climbed, sometimes steeply, as the models were given more tokens to think and act with.
That single observation undercuts the way most people read AI agent benchmarks. If a number can jump by a fifth or more just because the evaluator was more generous with compute, then two models tested under different budgets are not really being compared. And when a benchmark reports the low-budget figure, it is not measuring what the model can do. It is measuring what the model could do on a tight allowance.
What the AI Security Institute measured
The design of the study is the interesting part. Rather than run each model once, the institute swept the token budget across a wide range and recorded the success rate at each level. The benchmarks covered the areas people care most about for capable agents: real software engineering, hard academic reasoning, and offensive cybersecurity tasks.
Software engineering
On coding-heavy suites such as TerminalBench 2.0 and SWE-Bench Pro, success rates rose by as much as 25 percent when the token budget climbed from 1 million to 10 million. In plain terms, the same model on the same tasks solved a quarter more of them once it was allowed to spend ten times the compute. Nothing about the model changed. Only the room it was given to work did.
Math and science
On Humanity's Last Exam, a benchmark built from expert-level academic questions, performance improved by roughly 22 percent as budgets grew toward 5 million tokens. This is the domain where people most often quote a fixed score as proof of a model's reasoning ceiling. The institute's data suggests that ceiling is partly an artifact of how much thinking the model was permitted to do before answering.
Cybersecurity
The security results were the most striking, because they showed a long tail. About 8 percent of cyber tasks only started succeeding once the budget passed 10 million tokens, and some required as much as 50 million before the model could complete them at all. A benchmark that stopped at a modest budget would have recorded those tasks as failures and concluded the model simply could not do them. Give it enough room and it could.
This matters for anyone using benchmark numbers to judge risk. A safety evaluation that caps compute to save money may report a model as incapable of a dangerous task when a determined user with a bigger budget would find the opposite. Underestimating capability is not a harmless rounding error when the subject is offensive security.
Capability is a curve, not a fixed number
The institute's central argument follows directly from the data. A model's ability on agentic work is better understood as a curve that rises with compute than as a point on a leaderboard. One line from the write-up captures the whole thesis. "If we keep treating capability as a fixed score rather than a curve over compute, we will keep being surprised by what these systems can do."
The clearest way to see the curve is through what researchers call a time horizon, meaning the length of human work a model can complete autonomously before it goes off the rails. In the study, a current frontier model handled tasks worth about 40 minutes of human effort when limited to 2.5 million tokens. Given 50 million tokens, the same model pushed that horizon out to roughly 4 hours. The model did not get an upgrade. It got a longer leash, and it used it.
The models tested were the 2026 frontier generation, spanning OpenAI's GPT-5 and GPT-5.5 alongside Anthropic's Opus 4.5 and Opus 4.8, with Sonnet 4.5 in the mix as a lighter option. Across that lineup the pattern held. More compute bought more capability, and the effect was large enough that ignoring it produces a systematically low picture of what these agents can do.
The hidden cost curve behind AI agent benchmarks
The study also mapped how token spend relates to human task length, and the relationship is a power law rather than anything linear. Working across 211 software engineering tasks and 78 cyber tasks, the institute found that a task a human finishes in one minute costs an agent thousands of tokens. A one-hour human task costs millions. A task that would take a person a full week costs billions of tokens for the agent to attempt.
That scaling is easy to miss and important to grasp. It means the compute required does not creep up gently as tasks get harder. It explodes. Each step toward longer, more complex work multiplies the bill, which is why the budget an evaluator chooses has such an outsized effect on the reported score. A benchmark that quietly sets a low token ceiling is not being neutral. It is drawing a line across the cost curve and declaring everything beyond it impossible.
For anyone deploying agents in production, this reframes the economics. The question is not only whether a model can do a task but how much compute the task demands, and whether that spend is worth it. A model that can technically solve a week-long task for billions of tokens may be capable and uneconomic at the same time. Reading AI agent benchmarks with the cost curve in mind turns a capability question into a budget question.
Why progress looks faster at higher budgets
The compute lens also reshapes how quickly the field appears to be advancing. Pick a fixed budget of 2.5 million tokens and measure how often capability doubles, and the institute found a doubling roughly every 4.7 months. Raise the fixed budget to 50 million tokens and the doubling accelerates to every 40 to 50 days, a progression about 60 percent steeper.
Read that carefully, because it means the pace of AI progress is itself budget-dependent. Commentators who track improvement at a modest, cheap budget will see a fast but manageable curve. Those measuring at the frontier of compute will see something closer to a sprint. Both are looking at the same models. They disagree only on how much compute to hand them before taking the measurement, and that single choice changes the story about how fast things are moving.
The AI Security Institute's broader work has repeatedly documented capable agents completing tasks that were considered out of reach, including software engineering jobs that take human programmers hours and cyber tasks at a level of expert professionals. The compute-curve finding explains part of why those results kept surprising observers. The surprise was baked into the measurement method, not just the model.
It also suggests the surprises are not random. They arrive in a consistent direction, with real capability sitting above whatever the last headline number reported. A field that keeps being caught off guard in the same direction has a measurement bias, not a run of bad luck, and the compute curve names that bias precisely. Once you know a benchmark tends to read low, you can stop treating each new capability jump as a shock and start treating it as the curve doing what curves do.
Scaffolding is the other variable nobody prints
Compute budget is not the only thing that moves a score. The institute's wider Frontier AI Trends Report, summarized by techUK, points to scaffolding as a second driver that leaderboards rarely disclose. Scaffolding is the software wrapped around a model that lets it plan, call tools, keep notes, and retry. The same raw model can look mediocre or excellent depending on how good that wrapper is.
The report is direct about the effect. Giving a model tool access through scaffolding "consistently improves performance on cyber evaluations," and scaffolded agents are becoming useful enough to assist with or even automate parts of complex scientific work. That means a benchmark number reflects a package of model plus scaffold plus budget, not a model alone. Swap in a better harness and the figure moves again. Anyone comparing two published scores is often comparing two different engineering setups while pretending they are comparing two models.
This is why the same base model can top one evaluation and lag on another run by a different team. The disagreement is not always about the model. It is frequently about the scaffold and the compute each team chose. Once you accept that both variables are in play, the idea of a single authoritative benchmark score for agentic ability starts to look like a category error.
What a compute budget actually buys
It helps to be concrete about where all those tokens go. A modern agent does not spend its budget printing a final answer. It spends most of it thinking and acting in between. Reasoning steps, self-checks, tool calls, reading files, and rewriting its own plan all consume tokens, and each retry after a dead end consumes more. A generous budget lets the agent explore several approaches and recover from mistakes. A tight budget forces it to commit early and gives it no room to backtrack.
That is why the curve exists at all. Extra compute does not make the model smarter in any fixed sense. It buys persistence. The agent gets more attempts, longer chains of reasoning, and more chances to notice it went wrong and correct course. On a hard cybersecurity task that only succeeds above tens of millions of tokens, the model was not incapable at a lower budget. It simply ran out of room before it found the path. This is the same insight behind the broader move toward spending more compute at inference time, where letting a model deliberate longer reliably lifts performance on hard problems.
Understanding this changes how you plan a deployment. If a workflow needs the agent to handle multi-hour tasks reliably, the budget is not a detail to tune later. It is part of the capability you are buying, and skimping on it can turn a capable model into an unreliable one that looks like a worse model on your own internal benchmark.
The safety stakes of underestimating agents
The compute-curve problem is sharpest where the risks are highest. The institute has spent two years, since its founding in November 2023, evaluating more than 30 frontier systems, and its findings on safeguards are not comforting. It reports that improvements in guardrails are uneven across developers, that more capable models do not necessarily come with better safeguards, and that it has found universal jailbreaks for every system it has tested.
Put that next to the finding that benchmarks understate capability and the concern is clear. If a safety evaluation caps compute to control costs, it will record a model as unable to complete a dangerous task that a motivated actor with a larger budget could in fact accomplish. The 8 percent of cyber tasks that only succeeded above 10 million tokens are exactly the cases a thrifty evaluation would miss. For dual-use domains such as offensive security and biological design, measuring at the wrong point on the curve is not a statistical nuance. It is the difference between judging a system safe and discovering later that it was not.
There is a reassuring note in the same body of work. The institute says it found no evidence of harmful autonomous behavior in the systems it studied, and that the gap between open and closed models has narrowed to somewhere between 4 and 8 months. Neither of those findings cancels the core warning. They simply place it in context: capability is rising fast on every axis, and the tools used to measure it have been reading low.
How to read a benchmark number now
The practical lesson is not that benchmarks are useless. It is that a benchmark number without its compute budget is close to meaningless for agentic work, the way a car top speed means little without knowing the road and the fuel. When you next see a headline score, the useful questions are how many tokens the agent was allowed, whether every model in the comparison got the same allowance, and where on the cost curve the test was pitched.
This is a good habit for buyers as much as researchers. A vendor quoting a strong benchmark result may have run the test at a lavish budget no production deployment would ever pay for, which makes the number real but unrepresentative. A safety reviewer quoting a reassuring low score may have capped compute in a way that flatters the model's limits. Neither is lying. Both are reporting one point on a curve and calling it the whole shape. If you care about owning and running these systems economically, a theme we return to often on the MaShop blog, the budget behind the number is where the truth sits.
The deeper takeaway from the AI Security Institute is a shift in mindset. Capability in the agent era is not a fact you can print on a leaderboard. It is a relationship between a model and the resources it is given, and it keeps climbing as those resources grow. Treat it as a single score and the surprises will keep coming, always in the direction of these systems doing more than the last number suggested. Treat it as a curve and the surprises get smaller, because you were already looking at the slope instead of a single, comforting point.