When Singapore and Korea's AI Safety Institutes ran 660 agent trajectories across customer service, enterprise productivity, and personal assistant tasks in January 2026, the best-performing model met roughly 85% of correctness criteria and 84% of safety criteria on average. Sounds comparable. But only 40% of its trajectories were fully correct and fully safe. For the weakest model, that number was 0%.
The gap matters because partial safety isn't a thing you can average your way out of. An agent that handles nine fields correctly and leaks the tenth has still leaked the tenth.
Agents leaked sensitive data even when given explicit handling guidelines in the system prompt. They invented policies when they couldn't find the real ones, assumed steps had completed when they hadn't. The pattern across all three models was the same: confident execution, no verification, applied to data where getting it mostly right is the same as getting it wrong.
Study scope: 3 models, 11 scenarios each, 10 runs per scenario, per institute. Three data-leakage risk types tested: lack of data awareness, lack of audience awareness, lack of policy compliance.
Fully correct + fully safe trajectories (SG AISI): Model A: 40% · Model B: 14% · Model C: 2%
Same metric, KR AISI: Model A: 8% · Model B: 3% · Model C: 0%
Fully safe only (SG AISI): Model A: 57% · Model B: 36% · Model C: 14%
Why scores differed across institutes: Different execution environments and agent scaffolding, not different models. Same inputs, different operational context, materially different outcomes.
Guidelines didn't help: Agents leaked data despite explicit data-handling instructions. Common causes: following their own interpretation of what the task required, or failing to recognize certain information as sensitive.
Judge reliability note: Human-LLM disagreement on safety scoring was 18% at both institutes, roughly 3× the disagreement rate on correctness.