EVALUATION CONTAINMENT STACK
A benchmark with offensive capability should resemble a malware lab
AGENT EXECUTION ENVIRONMENT
Independent egress deny
ephemeral credentials · signed artifacts · strict least privilege
trajectory monitor · kill switch · audit log
Safeguards must not share one failure domain.