Results, scored on 790 labeled agent traces
Every number reproduces from a clean clone — offline, deterministic, no API key.
tool-definition-drift
AUC 1.000
The one precise, shipped detector — measured on a synthetic corpus.
tool-output-injection
AUC 0.817
Reproduces the known over-defense failure; the retrained model is gated.
untrusted-data-egress
AUC 0.603
A risk annotation, not an alert — the lethal trifecta is ordinary agent work.