Introducing IronClaw 1.0: The Leader Across PinchBench, ClawBench, and OfficeQA Agent Benchmarks

The best version of an assistant is the one you stop thinking about. It does what you ask, it is there when you switch from your terminal to Slack, and it never makes you redo work it already started. Most agent harnesses fail that test for a structural reason: one model wired directly to everything it can touch. Thinking, acting, holding secrets, reaching the internet, all in the same knot. Every capability added to the knot is another place for work to vanish or a safeguard to slip.

IronClaw 1.0 is built on the separation most harnesses skip: the part that decides is distinct from the part that acts, with a single coordination layer between them we call the guard. Our market research gave insight into what people want from an always-on assistant. IronClaw 1.0 is the architecture to match: one structure instead of ten, one path for every action, persistent state that survives interruption, and stronger security as a byproduct of the same design. We call it 1.0 because the number is earned, and the payoff is measurable: IronClaw sits at the top of three benchmark leaderboards.

Top of the leaderboard on three benchmarks

IronClaw takes the top spot on PinchBench, ClawBench, and OfficeQA, three benchmarks that stress different parts of what an agent actually does. All scores below pair each harness with the same base model, deepseek-v4-flash, so the comparison isolates the harness performance.

PinchBench grades agents on 147 real tasks: scheduling meetings, triaging email, writing code, researching topics, and managing files. Each run pairs a harness with a base model and scores what actually got done, with partial credit for partial completions. With deepseek-v4-flash, IronClaw scores 93.5 percent — roughly 4 points above the next-best model."

ClawBench moves the test onto the live web. Agents work across more than 140 real production websites, not sanitized sandboxes, on write-heavy multi-step tasks like booking flights, applying for jobs, and making purchases, with a browser interception layer that blocks the final submit so nothing irreversible ships. Grading draws on five layers of behavioral data, including session replays, HTTP traffic, and reasoning traces. At 88.6 percent, IronClaw sits about 5 points above the field average (83.3), leading the next-best model by 4.7 points.

OfficeQA tests grounded reasoning over enterprise documents. Built by Databricks, it asks questions that can only be answered by parsing, retrieving, and reasoning across a corpus of U.S. Treasury Bulletins spanning nearly a century, 89,000 pages and over 26 million numerical values, much of it scanned PDFs and dense tables. IronClaw scores 76.4 percent, making roughly 12% fewer errors than Hermes and 15% fewer than OpenClaw.

These scores are the rebuild doing its job. A single checkpoint in front of every action is the kind of design people assume costs capability: more gating, less done. Task execution, live-web operations, and document reasoning are three different failure surfaces, and the same design leads on all three. One path for every action means behavior holds across every task type, and continuous checkpointing means an interruption costs a pause, not the task. The harness with one door earns the most credit on the board.

Why we rebuilt instead of patched

Running the first internal version of IronClaw taught us that the properties an assistant needs most are architectural: logic defined once rather than rebuilt for every surface, safety enforced in one place rather than copied into every path, and state that outlives any single session. Properties like those are not features you add; they are foundations you build on. A public version number should mean something. 1.0 is the release built on all three: one clean structure, one checkpoint, persistent state. Everything below inherits from that.

What's new in IronClaw 1.0

Safer by design

Every action routes through a single checkpoint, so a guarantee made once holds everywhere, including capabilities added later. IronClaw asks for explicit approval on sensitive actions rather than acting first and reporting after. Secrets are single-use by default: passwords and tokens are issued once, then scrubbed from logs, errors, and reports.

You set the goal, it does the work

Tell IronClaw the outcome you want, not the steps to get there. You define the goal; it figures out how to achieve it, breaking the work into actions that each pass through the guard. And it does not lose that work along the way: IronClaw checkpoints continuously, so a pause for permissions or a restart mid-task costs exactly that, a pause. It resumes where it stopped. The failure mode where one interruption erased an entire task is gone.

It works the same way everywhere

CLI, web, Slack, and Telegram run as one assistant: same memory, same safety rules on every channel. New channels inherit every protection automatically, which lets us expand where IronClaw lives without trading safety for speed.

It works ahead of you, and it remembers

IronClaw runs on a schedule you define, a recurring heartbeat or a routine, and pushes what it finds to your preferred channel. It keeps persistent memory across conversations: your preferences, past decisions, the context that makes its work useful instead of generic. When it hits a capability gap, it builds a new sandboxed tool and reuses it later. The IronClaw you use in six months will be more capable than today's.

Built for teams: multi-tenant or fully isolated

In most companies, the biggest tax on an internal tool is rediscovery: every employee figuring out alone what a colleague already solved. IronClaw's multi-tenant deployment removes that tax. Tools and skills built by one person can be shared across the organization, so a workflow solved once is solved for everyone, and a new teammate starts from the org's accumulated capability instead of a blank slate. Administrators govern the deployment without living inside it: individual workspaces are not visible to them by default, with an auditable access mechanism for the cases compliance requires, the same standard enterprises already hold for corporate email. Teams that want the opposite trade can run single-tenant: complete isolation, no external access of any kind.

Availability

New IronClaw 1.0 agents are available to deploy today on the command line, web, Slack, and Telegram. It is already deployed across NEAR Foundation and NEAR AI, where every employee runs their own IronClaw agent: same memory, same channels, same guard in front of every action. The version shipping today is the version we run on ourselves, and the version on the leaderboards. Existing capabilities carry over on upgrade, and the new architecture applies to everything IronClaw does from here, including the tools it builds for itself after launch. Direct upgrades for existing instances are not available yet — we'll notify as soon as they ship.

IronClaw 1.0 is live. Try it at agent.near.ai.