Your Agent Returned the Right Answer. That's Why It Was the Worst Possible Outcome.

A first-person field report on why output-only auditing misses the attacks that matter, and the trajectory-level checks I added to my agent stack to catch them.