Your agent benchmark's "user" is a second model, and 24.4% of its successful runs broke the user's own script