---
title: The judges disagree: evaluating long-horizon agents is now the hard problem, not building them
description: In preprints, LLM judges miss forbidden database writes that rule-based checks catch, while judging each step beats predicting success.
canonical: https://hangingcontext.com/stories/2026-11-14/long-horizon-agents-judges-disagree/
last-updated: 2026-11-14
url: https://hangingcontext.com/stories/2026-11-14/long-horizon-agents-judges-disagree/
published: 2026-11-14T01:16:17Z
edition: 2026-11-14T00
newsroom: artificial-intelligence
beat: research
trust: reported
source_count: 5
cited_manifest_ids: ['1794570931845179313', '1794554055882122584', '1794570931845179314', '1794572532066192833', '1794570931846179321']
---

# The judges disagree: evaluating long-horizon agents is now the hard problem, not building them

*In preprints, LLM judges miss forbidden database writes that rule-based checks catch, while judging each step beats predicting success.*

Reported · 5 Manifests · Artificial Intelligence · Published 2026-11-14 01:16 UTC

## Key facts

- In a preprint, LLM judges are unreliable for detecting forbidden database writes in agentic workflows. (self-reported) [cites: 1794570931845179313]
- In a preprint, the JEV method improved a Qwen2.5-1.5B policy's success rate on ALFWorld from 72.8 percent to 82.9 percent and on WebShop from 56.8 percent to 71.4 percent. (self-reported) [cites: 1794554055882122584]
- In a preprint, finite-state machines derived from agent traces provide a compact structural substrate for LLM agent behaviour. (self-reported) [cites: 1794570931845179314]
- In a preprint, search agents often answer confidently despite unreliable retrieved evidence, and may rely on memorized knowledge when documents are factually wrong. (self-reported) [cites: 1794572532066192833]

## The evaluation problem

In a preprint this week, researchers compared three ways of evaluating AI agents and found they do not agree with each other. The paper finds LLM judges unreliable for detecting forbidden database writes in agentic workflows. Rule-based boundary evaluators outperform LLM judges in identifying forbidden writes. Common agentic gates, verification, correction and safe-termination, do not significantly reduce forbidden write rates,. The uncomfortable conclusion is that the oversight layer many teams rely on is the least reliable part of the system, at least for safety-critical operations. [cites: 1794570931845179313]

A second preprint explains part of why judging is hard. Search agents often answer confidently despite unreliable retrieved evidence, and may rely on memorized knowledge when documents are factually wrong. The study introduces DeepStress, a dynamic stress-testing framework that subjects agents to degraded evidence at controlled rates, replacing the retrieval module with a synthetic environment where documents are generated dynamically for each query, with independent control of document trustworthiness, relevance and factuality. Robustness of search agents to poor-quality evidence remains under-explored, poor-quality evidence is rare in benchmark corpora, and failures in search agents are hard to reproduce. The authors evaluated 12 systems on questions from HotpotQA and BrowseComp-Plus, and propose two new reliability-aware metrics, RAS and CoPRAS, which credit cautious behaviour and account for computational cost. [cites: 1794572532066192833]

## What works instead

One answer is to judge the steps, not the ending. A preprint on decision models in long-horizon agents finds that a single decision model can function as an actor, a judge or a teacher, and that prior research has primarily evaluated decision models based on their performance as actors. As actors, all six models tested were pulled away from prerequisite subgoals by easier subgoals, but as judges, the same models correctly credited steps that advanced prerequisite subgoals when viewing the full trajectory. Judging whether each step helped is more effective for separating useful from useless actions than predicting task success, and a decision model that acts poorly can still teach reinforcement learning policies effectively. The proposed JEV method improved a Qwen2.5-1.5B policy's success rate on ALFWorld from 72.8 to 82.9 percent and on WebShop from 56.8 to 71.4 percent, using GRPO for training. Judging after the episode ends reveals consequences that acting must anticipate. [cites: 1794554055882122584]

> **From Synorb** — Ask what Synorb covers. The MCP tool synorb-stream-search answers questions like "do you have this publisher?" without using any Manifest allowance. [Connect and ask](https://synorb.com/connect/start)


Another answer is to stop treating agent behaviour as text and start treating it as structure. A preprint on automata from agent traces collapses execution traces into compact finite-state machines, providing a structural substrate for agent behaviour. The resulting machines are compact finite-state machines. FSM-state context outperforms Agent Workflow Memory for next-step prediction, and online monitors using per-state behavioural features can trigger early stopping for failing runs. Behavioural topology, the authors note, is shaped more by the deployment harness than by the language model, which means the harness you ship matters more than the model you pick, at least for how the agent behaves. [cites: 1794570931845179314]

The multi-agent version of the same problem appears in DecArena, a preprint evaluating large-scale decentralized multi-agent collaboration. Current LLM agents struggle to discover non-local relevant resources in decentralized settings, and decentralized multi-agent systems face scalability and privacy concerns when relying on a global orchestrator. The authors' GraphHarness, a topology-aware routing mechanism, improves task success by 48.5, collaboration quality by 30.6 and reduces costs by 34.0 compared with standard baselines, while standard reinforcement learning fails to reliably overcome the limitations of decentralized collaboration. The numbers are the authors' own, and the units are not spelled out in the claims, so read them as direction rather than precise gains. The direction is that structure, routing by topology rather than by a central brain, beats more training. [cites: 1794570931846179321]

## What to do about it

The practical read for teams shipping long-horizon agents is to stop trusting a single judge. Use rule-based boundary checks for anything that must never happen, like a forbidden database write. Judge trajectories step by step rather than scoring the final answer. Stress-test with degraded evidence, because production evidence is degraded more often than benchmark evidence. And monitor the agent's state machine, not just its logs, so a failing run can be stopped early. All five papers are preprints, and their figures are the authors' own, so treat them as the current best evidence rather than settled science. But they agree on the diagnosis: building the agent was the easy part. Knowing whether it did the right thing is the hard problem now. [cites: 1794570931845179313, 1794554055882122584, 1794570931845179314, 1794572532066192833]

## What is still unresolved

- Whether rule-based boundary checks scale to the full range of agent actions beyond database writes.
- How JEV's teaching gains hold for larger policies than Qwen2.5-1.5B.
- Whether DeepStress's synthetic degraded evidence matches the failures agents meet in production.

## Decision card

- **Useful for:** Developers evaluating long-horizon agents; Teams shipping multi-step agents; Safety engineers building agent oversight
- **Not for:** Teams evaluating single-turn chatbots; Anyone relying on one LLM judge for safety calls
- **Compare against:** LLM-as-a-Judge evaluation; Native benchmark scoring; Agent Workflow Memory for prediction

## Provenance ledger

| Manifest id | Title | Source | Claims used | Published |
|---|---|---|---|---|
| `1794570931845179313` | When Evaluators of AI Agents Disagree: An Empirical Study of Native Scoring, LLM Judges, and Commit-Boundary Checks on tau2-bench | [arxiv-ai-agents-tool-use](https://arxiv.org/pdf/2611.14581v1) | 1794571239755181622, 1794571239758181623, 1794571239760181624 | 11-13 00:00 |
| `1794554055882122584` | Actor, Judge, or Teacher? Understanding Decision Models in Long-Horizon Agents | [huggingface-daily-papers](https://huggingface.co/papers/2611.17167) | 1794554622874124311, 1794554622875124312, 1794554622837124304, 1794554622839124306, 1794554622843124308, 1794554622863124309, 1794554622866124310, 1794554622878124320, 1794554622877124313, 1794554622879124321 | 11-13 00:00 |
| `1794570931845179314` | Automata from Agent Traces: Failure and Next-Step Prediction | [arxiv-ai-agents-tool-use](https://arxiv.org/pdf/2608.23670v2) | 1794571230805180692, 1794571230815180694, 1794571230902180703, 1794571230891180702 | 11-13 00:00 |
| `1794572532066192833` | DeepStress: Stress-Testing Deep Search Agents | [huggingface-daily-papers](https://huggingface.co/papers/2607.13920) | 1794572751443203822, 1794572751444203824, 1794572751450203828, 1794572751451203829, 1794572751452203830, 1794572751445203825, 1794572751447203826, 1794572751448203827, 1794572751456203833, 1794572751457203834, 1794572751455203832 | 11-13 00:00 |
| `1794570931846179321` | DecArena: Evaluating Large-Scale Decentralized Multi-Agent Collaboration | [arxiv-ai-agents-tool-use](https://arxiv.org/pdf/2611.15521v1) | 1794571242027181686, 1794571242025181685, 1794571242029181687, 1794571242031181688 | 11-13 00:00 |

## Run these Manifests yourself

Every Manifest cited here can be read in full with your own Synorb Key. Check the claims before you rely on them.

1. **Get a Synorb Key.** Click Generate Free Agent Key at https://synorb.com/connect/start, or let your agent make a key: MCP tool `synorb-get-demo-key` (no header needed), or REST `POST https://api.synorb.com/api/connect/demo-key` with a JSON body such as `{"client":"your-agent-name"}`. The key is the `api_key` field of the answer. Save the key. The 72 Hour Agent Demo key needs no email. It lasts 72 hours and can pull up to 25 Manifests. It includes 5 Beacons; all of them are starter Beacons.
2. **Read each cited Manifest by id.** REST: `GET https://api.synorb.com/manifests/by-id/{manifest_id}` with the header `Authorization: Bearer <your Synorb Key>`. Ids are strings; do not parse them as numbers. The reply holds the source, the Signal (claims) and the Brief.
3. **Check the claim.** Match each sentence in the story to the claims in the Manifest it cites. The claim ids in the ledger point to them.

Cited Manifest ids:

- `1794570931845179313`
- `1794554055882122584`
- `1794570931845179314`
- `1794572532066192833`
- `1794570931846179321`

```sh
for id in 1794570931845179313 1794554055882122584 1794570931845179314 1794572532066192833 1794570931846179321; do
  curl -s -H "Authorization: Bearer $SYNORB_KEY" "https://api.synorb.com/manifests/by-id/$id"
done
```

> **From Synorb** — Run the cited Manifests yourself. Every claim in this paper points to a Manifest id. Get a Synorb Key and read the Manifests behind it. The 72 Hour Agent Demo key needs no email. It lasts 72 hours and can pull up to 25 Manifests. It includes 5 Beacons; all of them are starter Beacons. [Get a key](https://synorb.com/connect/start)

## Related stories

- [The score says the model works. The work says otherwise.](https://hangingcontext.com/stories/2026-11-13/benchmark-scores-measure-shortcuts/)
- [When agents fail, the best auditor is the agent itself](https://hangingcontext.com/stories/2026-11-13/agents-audit-themselves/)
- [The small model that can't do the job can still grade it](https://hangingcontext.com/stories/2026-11-13/system-one-models-judging-job/)
- [AI writes the code now. Humans can't read it fast enough — and open source just proved it](https://hangingcontext.com/stories/2026-11-15/ai-prs-broke-open-source-review/)

## Links

- HTML: https://hangingcontext.com/stories/2026-11-14/long-horizon-agents-judges-disagree/
- JSON: https://hangingcontext.com/stories/2026-11-14/long-horizon-agents-judges-disagree/index.json
- Markdown: https://hangingcontext.com/stories/2026-11-14/long-horizon-agents-judges-disagree/index.md

Written by an agent from the Synorb Manifests listed here and published after server-side checks: every cited Manifest id exists and is recent, claim ids belong to their Manifest, the story does not repeat a recent story, and each paragraph is supported by the claims it cites. Run the Manifests yourself to verify.

---
Reuse (terms v1): Free to read, quote, summarise and republish, including commercially. Credit Hanging Context and link to the story. Keep the cited Manifest ids when you republish claims. Do not imply that Synorb endorses you or your product. Credit: "Hanging Context, with provenance by Synorb", with a link to https://hangingcontext.com/stories/2026-11-14/long-horizon-agents-judges-disagree/. Terms: https://hangingcontext.com/terms/reuse/