ClawsBench: Evaluating Capability and Safety of LLM Productivity Agents

High-fidelity simulated workspaces for rigorous agent evaluation — Gmail, Calendar, Docs, Drive and Slack.

5Mock services
44Tasks
6Models
4Harnesses
7,224Trials

Overview

LLM agents are increasingly deployed to automate productivity work — email triage, meeting scheduling, document management — but evaluating them on live services is risky because the changes are often irreversible. Existing benchmarks rely on simplified environments and fail to capture realistic, stateful, multi-service workflows.

ClawsBench answers that with five high-fidelity mock services replicating real Google Workspace and Slack APIs, with full state management and deterministic snapshot/restore. Our 44 structured tasks cover single-service, cross-service and safety-critical scenarios — measuring both what agents can do and what they should not do.

High-fidelity mock environments

Each environment implements a full REST API backed by SQLite, with realistic seed data including needles, edge cases and safety traps. Agents interact exclusively over HTTP.

claw-gmail

Realistic seeded mailboxes with needles, threads and edge cases.

62 endpoints
claw-gcal

Full Calendar mock with recurring events and timezone handling.

38 endpoints
claw-gdocs

Document CRUD with collaborative editing semantics.

29 endpoints
claw-gdrive

File management with sharing permissions and access control.

34 endpoints
claw-slack

Channels, threads, reactions and DMs.

45 endpoints

Agent performance

All models evaluated on OpenClaw with full scaffolding (skills + meta prompt). TSR = task success rate, UAR = unsafe action rate. 95% cluster bootstrap CIs.

ModelTSRUAR (lower is better)
Opus 4.862.8%4.1%
GPT-5.560.6%9.2%
Gemini 3.1 Pro57.9%7.0%
Sonnet 4.655.3%3.3%
GLM 5.153.4%13.1%
Gemini 3 Flash-Lite33.7%15.4%

Figure 2. TSR (left) and UAR (right) for six models on OpenClaw with full scaffolding. The top five cluster at 53–63% TSR; only Flash-Lite trails. Capability and safety rankings diverge — the strongest task-completer is not the safest agent.

Findings

Finding 01

Skills and meta prompt are separable levers

Domain skills lift single-service accuracy; the meta prompt lifts cross-service coordination. Adding both is not additive — the meta prompt captures most of the joint gain.

Finding 02

Safety does not track capability

Unsafe action rate varies by 4× across models within a 10-point TSR band. Ranking by success alone hides the risk profile entirely.

Finding 03

Irreversible actions cluster in Drive

68% of unsafe actions were permission changes or deletions in claw-gdrive, not messages sent in Gmail or Slack.

Finding 04

Harness choice moves TSR more than model choice

The same model across four harnesses spans 19 TSR points — wider than the spread between adjacent frontier models on a fixed harness.