ContainmentBench: Trace-Based Evaluation of Post-Injection Containment in Tool-Using LLM Agents
Results show that a terminal policy label is not a sufficient statistic for operational post-exposure containment; evaluations should report endpoint, stage-stratified trajectory, and utility evidence separately, and should promote recovery evidence to comparative claims only where the corresponding controls are valid.