FUURAA AI Knowledge Library · Evaluation guide

How to evaluate AI agents that use the web

Use six evidence gates to turn “completed a web task” into a reproducible starting state, observation surface, action authority, independent outcome, side-effect record, recovery test and transfer boundary. Apply the guide in benchmark reading, research design, engineering review and pre-release verification.

Published22 August 2026Evidence statusMethod synthesis grounded in primary web and computer-agent evaluation research; no product assessedScopeBrowser agents, web-task benchmarks, research reports and system reviews

Turn task success back into a state transition

A web agent is not merely a model that answers questions; it is an action system that may change real state.

An interpretable web-agent claim must connect user intent, starting state, actual observation, authorised action, independently verified final state, and every residual or side effect. If one link is missing, a success rate may count seeded state, hidden assistance, wrong targets or duplicate effects as capability.

Applicability boundaryThis is a public research method, not a FUURAA product-capability claim or an assessment of any specific agent, model, provider or benchmark. It is not procurement advice, a performance warranty, security certification, audit opinion, or legal or compliance conclusion.

Six rejectable evidence gates

Each gate must answer a decision question, produce minimum evidence and stop transfer when material unknowns remain.

01

Freeze the task and starting state

Decision question
What exact user intent, account, permissions, website state, software version and evaluation time define the task?
Minimum evidence
Task specification, starting URL and state snapshot, account role, seeded records, locale, browser and site versions, timestamp and reset procedure.
Stop condition
Stop when cached sessions, pre-existing records or an unreproducible live state could make the task appear solved before the agent acts.
02

Declare the observation surface

Decision question
What can the agent actually perceive: screenshot, pixels, accessibility tree, DOM, text extraction, network response or hidden metadata?
Minimum evidence
Observation channels, capture timing, viewport and zoom, accessibility settings, parser or OCR versions, omitted regions and evidence available to human evaluators.
Stop condition
Stop when the agent receives privileged structure unavailable in the claimed setting, or task-critical visual evidence is absent from its observation.
03

Bound actions, authority and assistance

Decision question
Which clicks, typing, scripts, APIs, external tools, retries and human interventions are allowed, and which consequences are prohibited?
Minimum evidence
Action schema, account and domain boundaries, credential handling, tool allowlist, retry and time budget, human-help log, confirmation gates and prohibited effects.
Stop condition
Stop when hidden help, unequal budgets or authority outside the stated user and site boundary changes what success means.
04

Verify outcome and side effects independently

Decision question
Did the intended state change occur, remain durable and avoid unintended changes—not merely produce a plausible click trace or success message?
Minimum evidence
Execution-based evaluator, authoritative before-and-after records, independent page or API check, side-effect inventory, delayed-state check and evaluator version.
Stop condition
Stop when a trace, model judge or visible toast is the only proof, or the evaluator cannot distinguish partial, duplicate and wrong-target effects.
05

Exercise interruption, recovery and unsafe paths

Decision question
What happens after timeouts, stale pages, authentication changes, partial writes, duplicate submissions, navigation traps or requests to cross a boundary?
Minimum evidence
Fault-injection cases, stop and escalation behaviour, idempotency keys where relevant, recovery record, residual effects, human takeover and closure criteria.
Stop condition
Stop when the agent repeats an irreversible action, conceals uncertainty, bypasses confirmation or resumes from stale authority.
06

Measure transfer and set expiry

Decision question
Does performance persist across unseen sites, layouts, languages, accessibility modes, content changes and current authentication flows?
Minimum evidence
Held-out sites and templates, per-task results, repeated runs and uncertainty, language and accessibility slices, change log, expiry date and revalidation trigger.
Stop condition
Stop when success on a static benchmark is presented as durable capability on a changing open web without current transfer evidence.

Minimum failure matrix

Introduce these conditions deliberately to learn whether success comes from capability, an environmental shortcut or an evaluator blind spot.

  • 01
    A cached login or seeded record makes the goal true before the run

    Record the affected task, actual-versus-expected state, authority boundary, whether the evaluator detected it, the narrowest conclusion that remains, and the scope that must be rerun after repair.

  • 02
    The action trace looks correct but the authoritative state never changes

    Record the affected task, actual-versus-expected state, authority boundary, whether the evaluator detected it, the narrowest conclusion that remains, and the scope that must be rerun after repair.

  • 03
    The target state is reached while another record is changed or duplicated

    Record the affected task, actual-versus-expected state, authority boundary, whether the evaluator detected it, the narrowest conclusion that remains, and the scope that must be rerun after repair.

  • 04
    The screenshot and DOM expose materially different task evidence

    Record the affected task, actual-versus-expected state, authority boundary, whether the evaluator detected it, the narrowest conclusion that remains, and the scope that must be rerun after repair.

  • 05
    Human help, hidden retries or external tools are omitted from the score

    Record the affected task, actual-versus-expected state, authority boundary, whether the evaluator detected it, the narrowest conclusion that remains, and the scope that must be rerun after repair.

  • 06
    A layout, content, authentication or accessibility change invalidates the result

    Record the affected task, actual-versus-expected state, authority boundary, whether the evaluator detected it, the narrowest conclusion that remains, and the scope that must be rerun after repair.

  • 07
    The agent crosses an account, domain, role or permission boundary

    Record the affected task, actual-versus-expected state, authority boundary, whether the evaluator detected it, the narrowest conclusion that remains, and the scope that must be rerun after repair.

  • 08
    The evaluator misses a partial, delayed, repeated or irreversible effect

    Record the affected task, actual-versus-expected state, authority boundary, whether the evaluator detected it, the narrowest conclusion that remains, and the scope that must be rerun after repair.

Minimum web-agent evaluation record

Let the next reviewer reconstruct what the agent saw, what it was allowed to do and what it actually changed.

  1. 01claim, publisher, publication date and evidence status
  2. 02agent, model, browser, tools and evaluation date
  3. 03task, user intent, initial state, site and software versions
  4. 04account, role, permissions, credentials and domain boundary
  5. 05observation channels, viewport, parser, OCR and omitted evidence
  6. 06action schema, confirmation gates, prohibited effects and assistance
  7. 07prompt, retries, time, token, compute and human-help budget
  8. 08evaluator, end-state checks, side-effect checks and delayed verification
  9. 09failures, interruptions, recovery, residual effects and closure
  10. 10run count, uncertainty, per-task transfer, expiry and revalidation

Common evidence states

Do not compress success on named pages at one time into general autonomy on the open web.

Supported

The exact task, state, observation, authority, action budget and independently verified outcome are reconstructable, including side effects and repeated runs.

Conditional

The result is credible only for named sites, versions, accounts, observation channels, permissions, tasks or evaluation windows.

Mixed

Task completion, side effects, languages, sites, runs or recovery tests point in different directions.

Insufficient

Initial state, observation, authority, assistance, evaluator or outcome evidence is missing; a success trace alone is not evidence.

FUURAA analysisThe evidence most easily lost in web-agent evaluation is not one click but the chain from intent to consequence. FUURAA recommends preserving every capability claim as task and starting state × observation surface × authority and budget × independent outcome × date, with side effects, human assistance, recovery and expiry inside the conclusion. Task completion rate can describe an outcome; only this chain can show whether it came from authorised, reviewable and transferable action.

Primary sources and non-transfer boundaries

These studies inform evaluation design; they do not replace rechecking the current system, website and consequences.

Sources rechecked 22 August 2026. Each retains its publication timing, role in this method and non-transfer boundary.

25 July 2023WebArena — A Realistic Web Environment for Building Autonomous Agents

Introduces reproducible, functional websites and evaluates agents by end-to-end task correctness rather than isolated action prediction.

BoundaryIts tasks, websites and reported model results are a dated research snapshot; they do not establish current performance on arbitrary public websites.

Open primary source ↗
24 January 2024VisualWebArena — Evaluating Multimodal Agents on Realistic Visual Web Tasks

Extends realistic web evaluation to visually grounded tasks and shows why text or DOM-only observation can miss task-critical evidence.

BoundaryVisual grounding results are conditional on the benchmark sites, observation setup, models and evaluators used in the paper.

Open primary source ↗
11 April 2024OSWorld — Benchmarking Multimodal Agents for Open-Ended Tasks in Real Computer Environments

Uses real computer environments and execution-based evaluators to test whether final application state—not merely a plausible trace—satisfies a task.

BoundaryDesktop-task coverage and historical results do not prove safety, reliability or suitability for another operating system, application or workflow.

Open primary source ↗
8 February 2024WebLINX — Real-World Website Navigation with Multi-Turn Dialogue

Contributes large-scale expert demonstrations across real websites and exposes the difficulty of generalising navigation to unseen sites.

BoundaryDemonstration data measures named navigation settings; it does not verify live transaction outcomes or authorise action on third-party services.

Open primary source ↗
12 March 2024WorkArena — How Capable Are Web Agents at Solving Common Knowledge Work Tasks?

Frames browser-agent evaluation around reproducible knowledge-work tasks and the policies, pages and workflows of a functional enterprise platform.

BoundaryResults for the benchmark platform and task set cannot be transferred directly to every enterprise system, role or permission model.

Open primary source ↗
7 July 2024WorkArena++ — Towards Compositional Planning and Reasoning-based Common Knowledge Work Tasks

Adds realistic compositional tasks that require multiple application steps, planning and reasoning rather than a single page interaction.

BoundaryCompositional difficulty is benchmark-specific; it does not by itself measure authority control, side effects, recovery or production readiness.

Open primary source ↗

Continue checking

Carry web-task results into general agent evaluation, execution assurance and evidence records.

Evaluate an AI agentOpen the execution assurance pathBuild an evaluation recordEnter AI Evidence Atlas