I built a 200-line tool that catches an AI agent exfiltrating data — while your test says PASS

Here's a failure your agent test suite probably can't see. An AI agent with a send_email / http_post...