Do phone agents succeed at all three critical tasks equally?
Explores whether task success, privacy compliance, and preference reuse develop together in phone-use agents, or whether benchmarking one capability tells you nothing about the others.
The MyPhoneBench evaluation surfaces a finding with direct deployment consequences: the three properties most relevant for phone-use agent deployment — task success, privacy compliance during completion, and proper use of saved preferences in later sessions — are statistically distinct capabilities. No model dominates all three. Evaluating one of them does not predict the others.
The pattern matters because of how benchmarks have been structured. Most agent benchmarks score task success: did the agent complete the task as instructed? Models that score well on this single metric get ranked as "frontier" and get deployed. But when the same models are scored jointly on success-plus-privacy or success-plus-preference-reuse, the ranking reshuffles. A model that wins on success-only may lose on success-with-privacy, because it completes tasks by overfilling personal entries. A model with mediocre success may have better privacy compliance because it stops at minimal disclosure.
The deeper observation is that "deployment readiness" is not a scalar. It is a vector across the capabilities the deployment actually requires. For phone-use agents, that vector includes at minimum success, privacy compliance, and longitudinal preference handling. For other agent deployments it would include different combinations. Evaluating on the wrong subset of capabilities produces models that score well on the benchmark and fail in production.
For benchmark designers, this argues for joint evaluation as the default rather than as a research add-on. A benchmark that scores only one capability and ranks models on it is producing rankings that will not generalize to deployment. The methodological move is to evaluate the capability vector and present results as multi-dimensional rather than collapsing to a single score.
For agent developers, the immediate consequence: do not assume success-trained models will be privacy-compliant or preference-respecting. These need to be selected and trained for, not assumed.
Inquiring lines that read this note 87
This note is a source for these research framings, grouped by the broader line of inquiry each explores. Scan the bold lines of inquiry; follow any specific question forward.
Does chatbot personalization simultaneously increase both user trust and privacy concerns?- How does understanding persistent journeys intensify both trust and privacy concerns?
- How does personalization create tradeoffs between trust and privacy concerns?
- Why does personalization increase both trust and privacy concerns?
- Does personalization make users trust AI or increase privacy concerns?
- How does personalization affect both user trust and privacy concerns simultaneously?
- How does personalization increase both trust and privacy risk simultaneously?
- How does unnoticed personalization affect user trust and privacy expectations?
- How does personalization simultaneously increase trust while increasing perceived privacy risks?
- Can autonomy design choices decouple the trust and privacy concern trade-off in personalization?
- What makes users willing to relinquish control to an agent?
- Do early Muse users represent genuine demand for personal assistants or platform lock-in?
- Can personal agents accessible via messaging solve adoption barriers?
- What safeguards beyond sign-off do consumers want from autonomous shopping agents?
- Why might users over-trust preference agents despite rational adoption hesitation?
- Can confidence-routed handoff reduce the takeover difficulty problem?
- How do privacy concerns compete with disclosure comfort in human-machine conversation?
- What data types carry the most privacy risk in personalization systems?
- How does direct web access change privacy assumptions built on API limits?
- Can tool access control prevent agents from filling optional personal fields?
- Why do completion-oriented models systematically sacrifice privacy compliance?
- How do minimal-disclosure privacy contracts enable multi-dimensional agent evaluation?
- Can minimal privacy boundaries generalize beyond phone-use contexts?
- How does completion-oriented bias in agents lead to unintended personal data disclosure?
- What breaks first: information secrecy or policy privacy?
- How should platforms test whether disclosure and context-sensitivity actually help?
- Why do people report equal privacy comfort despite removing vastly different amounts of personal information?
- Why does giving users full choice fail to prevent privacy leaks?
- How do privacy concerns translate into catching actual information breaches?
- What share of stated privacy concerns reflect actual platform behavior versus misconceptions?
- Can risk-based autonomy design reduce privacy concerns while maintaining user control?
- How much does interface design shape privacy behavior versus underlying privacy concerns?
- What architectural trade-offs could reduce preference leakage without sacrificing personalization?
- Does giving users more control over AI agents actually improve privacy protection?
- Does the choice of scenario influence which privacy oversight pattern someone follows?
- What makes complex UI navigation and social interaction harder than task completion?
- When should agents accommodate user preferences over their own goals?
- Can agents balance goal-driven proactivity with user preference alignment?
- Do contained assistant sessions without web steps indicate user satisfaction?
- What creates the tension between users wanting convenience and resisting loss of control?
- Can worker preference serve as a legitimate axis for delegation design?
- What task characteristics determine whether delegation can succeed?
- Can perceived task meaninglessness reliably predict which automation requests will succeed?
- How does asymmetric information between users and agents relate to proactivity?
- Can partial plan summaries or confidence scores help users judge agent reliability better?
- What ecosystem conditions make agent attention markets viable?
- What specific bookkeeping tasks can environments maintain more reliably than policies?
- How do protocol control and action control differ as sources of routine responsiveness?
- Why do identical task success rates mask deployment readiness differences?
- What agent evaluation dimensions beyond task success does a single number hide?
- Do success-only evaluations systematically overestimate real-world deployment readiness?
- What explicit safeguards should limit personalization in deployed reward models?
- Does base model strength determine adapter usefulness across users?
- Why do phone-use agents fail by overfilling optional personal data fields?
- Can the same tool call be both authorized and unauthorized depending on intent?
- Which of the six proxy forms works best for different agent tasks?
- How do agent privacy compliance and task success differ in evaluation?
- Do trajectory quality metrics predict agent safety and user trust?
- What trajectory-level metrics replace one-shot task success measurement?
- What task characteristics determine whether delegation is safe for users?
- What access and controls do consumer agent protocols give end users?
- What privacy-preserving alternatives exist for delegated agent authentication?
- How does shopping task delegation differ from routine administrative delegation?
- Does capability advantage in negotiations persist across different product categories and deal types?
- What operationalizes decision satisfaction when consumers use voice assistants?
- Does the efficiency-autonomy trade-off apply beyond utilitarian shopping tasks?
Related concepts in this collection 3
This note in its neighbourhood — explore the map, then jump to a related concept in the list below.
Click a node to walk · click center to open · click Open in graph to see this note in the full knowledge graph
-
Why do phone-use agents overfill optional personal data fields?
Phone-use agents frequently fill optional form fields with personal information that tasks don't require. Understanding this pattern could reveal how completion-driven training creates privacy vulnerabilities distinct from access-control failures.
same paper, the specific failure mode that produces the capability divergence
-
Can a two-category privacy boundary actually be auditable?
Most privacy frameworks are either too vague or too complex for agent deployment. Can a minimal binary split—LOW versus HIGH data categories—provide enough clarity for both users and automated compliance auditing?
same paper, the contract that makes joint evaluation possible
-
Do short benchmarks predict how models perform over long workflows?
Standard LLM benchmarks measure single-turn performance, but real workflows involve sustained delegation across many turns. The question explores whether top benchmark performers maintain accuracy through longer interaction chains.
adjacent: benchmarks-overstate-deployment-readiness pattern at a different scale axis
Related papers in this collection 8
Papers most semantically related to this note, ranked by cosine similarity in the embedding space.
- Do Phone-Use Agents Respect Your Privacy?
- Autonomy Reshapes How Personalization Affects Privacy Concerns and Trust in LLM Agents
- Privacy Leakage Overshadowed by Views of AI: A Study on Human Oversight of Privacy in Language Model Agent
- A Framework for Studying AI Agent Behavior: Evidence from Consumer Choice Experiments
- CRMArena-Pro: Holistic Assessment of LLM Agents Across Diverse Business Scenarios and Interactions
- Agentic Abstention: Do Agents Know When to Stop Instead of Act?
- Assistant or Actor? Student Trust, Control, and Delegation Regret When Using a General-Purpose AI Agent
- Understanding Users' Security and Privacy Concerns and Attitudes Towards Conversational AI Platforms
Original note title
task success privacy compliance and saved-preference reuse are distinct capabilities in phone-use agents — success-only evaluations overestimate deployment readiness