Language-model agents can plan multiple steps, call tools, browse the web, execute code, and act over many turns. As these systems move from demonstrations into deployment, measuring what can go wrong has become urgent. The relevant literature has grown from a handful of papers into several hundred in roughly three years. It is scattered across benchmark releases, red-teaming studies, frontier-lab capability reports, and governance documents that rarely cite one another. This survey organizes that literature. We assembled and screened a corpus of agentic-risk evaluations from a large paper index. The core covers general capability benchmarks, safety-behavior testbeds, and adversarial or prompt-injection evaluations. It also covers dangerous capabilities, deception and scheming, multiagent risk, runtime control, benchmark validity, and governance-facing testing regimes. Three key findings emerge consistently across the evidence. Direct paired studies show that safety alignment measured on a chat model can transfer poorly to the same model acting as an agent. Refusal rates that look strong in conversation can collapse once the model is given tools and a goal. Benchmark validity is also fragile. Underspecified tasks, weak outcome checking, contamination, and evaluation gaming can distort reported results. Finally, capability has standardized, executiongrounded suites, whereas propensity evidence remains largely scenario-based. We can increasingly say what an agent can do but not reliably what it will do under deployment pressure. We use these findings to propose a taxonomy and compare what the leading benchmarks actually measure. We then identify five open problems: construct validity, held-out difficulty, sandbagging-resistant elicitation, evaluation under adaptive adversaries, and system-level measurement.