Benchmarks · September 2026
Right more often, with far less of your data in the prompt.
We asked AI models the same questions about the same made-up person three ways. Then we measured how often they were right, how much personal data reached the model, whether planted attacks got through, and what each answer cost.
Paste everything
Every record is put into the prompt, and the model answers from all of it at once.
One search
A keyword search picks the records that look relevant, and the model answers from those in one call.
Skeleton
The model asks Skeleton for the records a question needs, through read tools, and receives only those.
98.6%
answered correctly
against 75.3% pasting everything and 73.9% with one search
Higher is better
99%
fewer personal details reached the model
67 against 8,904 when every record was put in the prompt, for the same 21 tasks at two account sizes
Higher is better
0 of 168
planted attacks reached the model
against all 168 pasting everything, and 41 with one search
Lower is better
Internal benchmark on synthetic accounts, Claude Haiku 4.5 and GPT-5.6 Luna for accuracy, GPT-5.6 Luna for personal details and planted attacks, September 2026. Pasting was simulated by putting every record in the prompt; no chat app or project was tested. No attack was detected succeeding against any approach; the count is attacks that reached the model. Not yet publication ready under our own statistical checks. Not independently verified. See the Method and Its Limits
01 · Accuracy
Skeleton stays right as the account grows.
Pasting everything gets worse as the prompt fills up, and one search misses records it did not find. Skeleton fetches the records each question needs, so its accuracy holds from 30 records to 1,000.
Answered correctly
360 graded answers per approach, on Claude Haiku 4.5 and GPT-5.6 Luna
Higher is better
Answered correctly, by size of account
Records in the account
Higher is better
| Records | Skeleton | Paste everything | One search |
|---|---|---|---|
| 30 | 98.9% | 84.4% | 74.4% |
| 200 | 97.8% | 83.3% | 72.2% |
| 500 | 98.9% | 71.1% | 76.7% |
| 1,000 | 98.9% | 62.2% | 72.2% |
Questions that connect records
Answers that need two or more records joined, counted or matched. 192 answers per approach.
Higher is better
Questions about a single record
168 answers per approach. One search does best here.
Higher is better
02 · Data shared with the model
The model sees only what the task needs.
We labeled personal details in a synthetic account, such as phone numbers and email addresses, and counted how many reached the model while it did the same 21 tasks each way, at 30 and 120 contacts.
Personal details that reached the model
21 tasks, each run at 30 and 120 contacts, on GPT-5.6 Luna. One search sent more than Skeleton, and got 8 of 42 runs wrong.
Lower is better
42 of 42 tasks right
41 of 42 tasks right
34 of 42 tasks right
Prompt size per question
Thousands of tokens sent to the model, by records in the account
Lower is better
| Records | Skeleton | Paste everything | One search |
|---|---|---|---|
| 30 | 29.7k | 11.1k | 0.7k |
| 200 | 30k | 68.7k | 0.7k |
| 500 | 30.1k | 170k | 0.7k |
| 1,000 | 29.9k | 338.5k | 0.7k |
03 · Security
No planted attack reached the model through Skeleton.
We hid instructions inside records: the kind that try to make a model reveal data, use tools it should not, or abandon its task. Then we ran the same tasks again.
Planted attacks that reached the model
168 per approach across four kinds of attack, on GPT-5.6 Luna
Lower is better
New attacks written by a model
32 per approach, written to get past each approach, on one task per account size. Under these attacks Skeleton answered 29 of 32 tasks right, against 32 pasting everything and 32 with one search.
Lower is better
No attack was detected succeeding against any approach in these runs. The charts count how many attacks reached the model at all. The attacks were planted in synthetic accounts, pasting was simulated by putting every record in the prompt with no chat app or project tested, and these internal results are not independently verified.
16 of 16
product controls passed
Space isolation, app scopes, token revocation, approvals, connector shut-off, and pausing or deleting routines mid-run.
14 of 14
direct chat attack pairs passed
Attempts to reach secrets, another user's data or unapproved actions through chat, each paired with a legitimate task that had to succeed. Some were stopped by the model itself.
7 of 7
local execution attack pairs passed
Shell-level attacks against the agent runner's container policy.
04 · Cost and speed
The same cost at 1,000 records as at 30.
Pasting everything costs more and slows down as the account grows. Skeleton's cost and speed stay flat. One search is the cheapest and fastest, and gets about a quarter of its answers wrong.
Cost per question
US dollars, by records in the account
Lower is better
| Records | Skeleton | Paste everything | One search |
|---|---|---|---|
| 30 | $0.0111 | $0.0075 | $0.0008 |
| 200 | $0.0111 | $0.0425 | $0.0008 |
| 500 | $0.0111 | $0.1039 | $0.0008 |
| 1,000 | $0.0111 | $0.2066 | $0.0008 |
Time to answer
Median seconds, by records in the account
Lower is better
| Records | Skeleton | Paste everything | One search |
|---|---|---|---|
| 30 | 4.3s | 2.7s | 1.7s |
| 200 | 4.2s | 4.5s | 1.9s |
| 500 | 4.4s | 10.3s | 1.8s |
| 1,000 | 4.3s | 16.9s | 1.6s |
Cost per correct answer
Both models and all account sizes. Skeleton is 10.6 times cheaper than pasting everything.
Lower is better
05 · Your choice of model
Accurate on the model you pick.
Skeleton gives every model the same tools, so you can switch models without starting over. It came out ahead on all 5 models we tested, by the smallest margin on Gemini 3.8 Flash.
Answered correctly, by model
Pasting everything was run on GPT-5.6 Luna and Claude Haiku 4.5 only.
Higher is better
Claude Opus 5
GPT-5.6 Luna
GPT-5.6 Sol
Claude Haiku 4.5
Gemini 3.8 Flash
- 01The data is synthetic: a made-up person's contacts, messages, calendar, notes, media and transcripts, at 30, 200, 500 and 1,000 records. There are 21 distinct questions and 360 graded answers per approach on Claude Haiku 4.5 and GPT-5.6 Luna.
- 02Paste everything puts every record in the prompt. No chat app or AI project was tested directly. At 500 and 1,000 records it splits the records across several model calls. Its results come from a 5 August 2026 run on the same data; Skeleton and one search come from 4 September 2026.
- 03One search is keyword retrieval (TF-IDF) with one model call. People and their identities were set up in advance, so matching them was not measured.
- 04Personal details counts labeled contact identifiers and one planted code over 21 tasks, each run at 30 and 120 contacts, on GPT-5.6 Luna, 14 September 2026.
- 05Planted attacks are 168 per approach across role spoofing, disclosure, tool expansion and derailment, plus 32 attacks written by a model. No attack was detected succeeding against any approach. Under the attacks written by a model, Skeleton answered 29 of 32 tasks right, against 32 pasting everything and 32 with one search. Product controls, direct chat and local execution are pass-or-fail checks of Skeleton alone.
- 06These are internal results. They have not been independently verified, there has been no outside penetration test, the samples are small, and the results have not yet passed our own statistical checks for publication.