ThinkingBox Grades AI Agents on Database Outcomes and Repeated Reliability

October 4, 2026 – Microsoft researchers released ThinkingBox on Hugging Face, introducing a new way to evaluate large language model (LLM) agents that interact with external tools. Unlike prior benchmarks that reward a correct natural‑language answer or a syntactically valid tool call, ThinkingBox measures the terminal backend state and side‑effects after an agent has run a business workflow. The benchmark contains 507 distinct, stateful business processes – such as order entry, inventory update, or customer record modification – each executed 20 times in isolated Microsoft Copilot (MCP) tool sessions. By focusing on the actual database outcomes, the suite aims to surface reliability problems that only appear after repeated, real‑world usage.

How ThinkingBox Works

Each of the 507 workflows is encoded as a sequence of tool calls that manipulate a relational database. The benchmark runs a full isolation of the MCP tool environment for every trial, ensuring that no cross‑run contamination can mask errors. After the agent completes a run, ThinkingBox inspects the final database snapshot and compares it against a ground‑truth specification that enumerates expected rows, column values, and side‑effects such as audit logs. The grading rubric does not consider whether the agent produced a fluent textual summary; it only records whether the backend state matches the specification, whether unintended changes occurred, and whether any tool reported an error.

The evaluation covered 12 publicly available LLM agents, ranging from open‑source models to commercial offerings. In total, the experiment generated 121,680 valid trials – the product of 507 workflows, 20 repetitions, and the 12 models. Of these, 79,853 attempts failed the executable‑check stage, meaning the agent either did not issue a required tool call or produced a call that could not be parsed. Notably, 67.24 % of those failed attempts still terminated without a final tool error, having invoked at least one state‑changing tool before stopping. This pattern highlights a disconnect between an agent’s apparent success and the hidden inconsistencies that remain in the database.

Key Findings

When a trial failed the executable check, the benchmark recorded three categories of deviation. Wrong field values appeared in 77.61 % of failed attempts, indicating that agents often wrote incorrect data even when a tool call succeeded. Unintended effects – actions that altered parts of the database not specified by the workflow – were observed in 43.30 % of failures, while missing effects – expected changes that never materialised – occurred in 25.36 % of cases. The percentages overlap because a single run can exhibit multiple error types simultaneously. These numbers demonstrate that a majority of tool‑driven failures still leave the database in an inconsistent or partially correct state.

Performance varied widely across models. Claude Opus 5.5 achieved the highest pass@1 score, succeeding on 67.16 % of the 121,680 trials on its first attempt. Kimi‑K3 displayed a different profile: it solved 93.89 % of tasks at least once across the 20 repetitions, but only 13.41 % of runs succeeded in every single repetition. This contrast underscores the importance of measuring reliability over repeated executions rather than a single best‑case run. The remaining models clustered between these extremes, with many showing pass@1 rates below 50 % and substantial variability across repetitions.

Limitations of the Benchmark

ThinkingBox is deliberately scoped to a curated set of business workflows, and the authors stress that the figures do not represent every production scenario an enterprise might encounter. The benchmark isolates each trial in a fresh MCP session, which removes the influence of long‑term state accumulation, caching, or cross‑workflow dependencies that exist in live systems. Moreover, the evaluation focuses on relational database outcomes; agents that interact with non‑SQL services, file systems, or external APIs are not covered. Finally, the metric treats any deviation from the ground‑truth specification as a failure, even when the deviation might be harmless in a specific business context.

• 79,853 attempts failed executable checks out of 121,680 total trials.
• 67.24 % of failed attempts ended cleanly without a final tool error.
• 77.61 % of failures reported wrong field values in the database.
• 43.30 % of failures produced unintended side‑effects.
• 25.36 % of failures omitted expected effects.
• Claude Opus 5.5 led pass@1 with 67.16 % success.
• Kimi‑K3 solved 93.89 % of tasks at least once but only 13.41 % in all 20 runs.

The practical implications are immediate for developers building AI‑driven automation. By exposing how often agents silently write wrong data or miss required updates, ThinkingBox encourages a shift from “does the tool call succeed?” to “does the database end up correct?” Teams can now use the benchmark to prioritize robustness testing, add compensating transactions, or redesign prompts that better enforce idempotent behavior. The data also give vendors a concrete target: improving repeatability across runs, not just achieving a high single‑shot pass rate. As enterprises adopt LLM agents for critical back‑office tasks, the ability to certify that the underlying data remains trustworthy becomes a competitive differentiator.

Going forward, Microsoft and the broader research community plan to expand ThinkingBox with additional workflow categories, richer side‑effect tracking, and integration with continuous‑integration pipelines. The benchmark is already available on Hugging Face, allowing anyone to run the same 507 workflows against their own agents and compare results against the published baseline. By making outcome‑focused evaluation open and repeatable, ThinkingBox is set to change how the industry measures AI agent reliability, moving the conversation from surface‑level correctness to the deeper question of whether the database – the ultimate source of truth – reflects the intended business outcome.