> ## Content Index
> Fetch the complete content index at: https://www.klaerenn.fr/llms.txt
> Use this file to discover other available public pages before exploring further.

# This Is Not an Attack
- URL: https://www.klaerenn.fr/this-is-not-an-attack/
- Published: 2026-08-25T08:00:47.000Z
- Updated: 2026-09-01T22:51:15.000Z
- Description: Three April 2026 studies measure the gap between simulation and reality in cybersecurity. The offensive agent hallucinates its results. The defensive agent encounters evidence without naming it. The formal architecture admits its core layer does not work.
- Author: Franck Rouxel
- Tags: English

*The industry simulates the attack to measure defense. It simulates defense to replace the analyst. It simulates architecture to defer design. In April 2026, three studies measure the gap between simulation and reality.*

---

The week of August 4, 2026, in Las Vegas, a dozen security vendors presented their new defensive agents at the Black Hat conference. The phrasing was much the same from booth to booth: anticipate likely attack paths, predict how an adversary would chain techniques, emulate the attacker continuously, autonomously validate what is actually exploitable. The same week, one of these vendors, selling an autonomous pentest agent meant to prove what is exploitable, raised 250 million dollars¹. The security market sells, this year, ever more faithful representations of the attack, and it sells them as security².

Three months earlier, in April, three unrelated research teams published three studies that measured, each on its own ground, the gap between these representations and what they claim to measure. The first, at Sichuan University, runs thirteen LLM-based automated pentesting tools against a unified benchmark and has fifteen researchers manually review the 1,500 execution logs produced³. The second, at Simbian AI, submits eleven frontier AI models to the tasks of a SOC analyst: finding traces of attacks in databases of 75,000 to 135,000 Windows logs⁴. The third, at Carnegie Mellon and Michigan, proposes the first formal security architecture for MCP, the protocol that lets AI systems use external tools, and claims 91% theoretical coverage⁵.

None of these studies cite the other two. Read together, they tell the same story. At every layer of the stack, a tool produces a score, a coverage figure, a comparison table. That figure circulates through slides, benchmarks, and commercial offerings. And at every layer, the authors themselves acknowledge, in their own limitations sections, that the figure does not measure what it claims to measure.

The industry has a name for this, but always applies it to others: security theater.

## 10 billion tokens, zero attacks

LLM-based automated pentesting is the promise of the moment. Instead of sending a human expert to test a system's resistance for a week, you send an AI agent that launches tools, analyzes results, adapts its strategy, and produces a report. International competitions (Tencent Security AI Hackathon, DARPA AIxCC) are accelerating the race. Investors follow. The pentesting market will reach $5 billion by 2030, and the talent shortage (2.8 million unfilled cybersecurity positions worldwide) pushes toward automation³.

Peng et al. do what nobody had done before: compare thirteen of these tools on the same benchmark, under identical conditions, with the same underlying AI model. Ten billion tokens consumed. Over $2,500 in API costs. Four months of human review. The results contradict four market beliefs³.

First belief: multiple specialized agents cooperate better than a single agent. False. Three single-agent architectures finish in the top six. Multi-agent architectures, supposed to bring specialization, degrade performance in several cases through poor memory coordination between roles³.

Second belief: connecting the agent to a knowledge base helps. Often false. Of six tools equipped with a knowledge base, three improve significantly when the knowledge base is removed. Cruiser goes from 42 to 57 points, LuaN1aoAgent from 83 to 90\. The mechanism is visible in the logs: the agent retrieves information that does not match the target, commits to a false lead, and never backtracks³.

Third belief: a specialized tool outperforms a general-purpose one. The hardest to accept. The researchers configured a Claude Code (a standard coding agent, not a security tool) with a Kali Linux terminal and a three-line prompt. Result: 69 points. Six of the thirteen specialized tools, developed by entire academic teams, scored lower. Specialization engineering adds almost nothing. The general-purpose agent with shell access does most of the work³.

Fourth belief: the agent knows when it has succeeded. False. Challenge 028 in the benchmark is designed to test "flag hallucination": the agent fabricates a plausible result, submits it as proof of success, and declares victory without having solved the challenge. It no longer distinguishes what it assumes from what it observes³.

This last point deserves attention. A penetration test exists to produce verifiable proof of vulnerability. If the testing tool invents its own evidence, it tests nothing. It produces reports that look like reports.

And the logs document an immediate operational risk. VulnBot installs `flask-unsign` on the target via pip. PentestGPT installs `psycopg2-binary`. Third-party dependencies downloaded from public registries, by an agent operating on a system during an engagement, without approval, without sandboxing, without a command whitelist. In a test environment, this is a reproducibility incident. In a production environment, it is supply chain contamination through the service entrance. None of the thirteen tools tested implements any mechanism to halt dangerous operations³.

The bottom line is simple. Automated pentesting performs better the more you remove the constraints that make testing legitimate. A real pentest requires scope, traceability, non-destruction. The AI agent manages none of this. It operates like an attacker without the constraints of a tester. When constraints are lifted, it performs. When constraints are imposed, it hallucinates.

## 859 investigations, zero complete successes

The AI-driven autonomous SOC is the second promise of the moment. An AI agent receives raw logs, identifies suspicious events, reconstructs the attack timeline, and produces an investigation report. Vendors have been promising this since 2024, and CISOs see it as an answer to the shortage of qualified analysts.

Simbian tests this promise. The authors submit eleven frontier models (including Claude Opus 4.6, GPT-5, Gemini 3.1 Pro) to a specific task: finding traces of real attacks in Windows log databases. 26 different attack campaigns. Budget limited to 50 SQL queries per mission, like an analyst who cannot search everything. Logs are transformed through obfuscation to prevent models from recognizing data already seen during training⁴.

The best model, Claude Opus 4.6, finds half the attack traces (Coverage Score 0.55). The other ten range between 10% and 44%. The operational threshold set by Simbian (50% recall on each of the 13 ATT&CK tactics) is not met by any model. Claude Opus 4.6 passes 7 tactics out of 13\. The other ten: zero⁴.

Since publication, Simbian has extended the evaluation to sixteen models across 1,144 runs, including Opus 4.8, GPT-5.5, and GLM-5.2\. The verdict does not move: none of the sixteen clears the threshold. The newer models change nothing⁴.

Over 859 missions, none is complete. On the densest campaigns (5,000 to 6,000 expected traces), Claude Opus 4.6 identifies roughly 150\. That is 3% recall⁴.

The most instructive detail is what the authors call the attribution gap. Claude Opus 4.6 sees an average of 159 traces in its SQL results but flags only 113 as suspicious. The agent encounters the evidence and does not recognize it. It passes right under its eyes and it does not name it⁴.

And the models only succeed where detection is trivial. They spot encoded PowerShell (Defense Evasion), persistence registry keys. The same signals that Sigma rules have been detecting for ten years. On credential theft, initial access, lateral movement, and exfiltration, the collapse is uniform⁴. These are precisely the tactics that matter against an APT, and precisely the ones that distinguish an analyst from a rule engine.

The gap with declarative knowledge benchmarks is massive. The same models exceed 80% on CyberMetric, SecBench, and CTI-Bench, which test what they can recite about security. They plateau at 55% when asked to find a signal in noise⁶. Knowing how to describe Kerberoasting and finding it in 100,000 lines of logs are two unrelated capabilities.

The "autonomous SOC" promises of 2024-2025 were built on the first metric. The real task demands the second.

## 91% coverage, zero implementation

MCP (Model Context Protocol) is the protocol that allows AI systems to use external tools: reading a file, querying a database, sending an email, executing code. Created by Anthropic in late 2024, it became the de facto standard for connecting AI agents to the real world within eighteen months. The ecosystem now counts 177,000 available tools and 97 million SDK downloads per month⁵.

One figure changes the nature of the subject. The share of MCP tools that modify the external environment (writing, sending, executing, rather than simply reading) grew from 27% to 65% between November 2024 and February 2026⁵. In fifteen months, MCP went from a consultation protocol to a distributed execution infrastructure. The security problem changed nature with it.

Acharya and Gupta propose MCPSHIELD, the first formal security architecture for the protocol. Four stacked layers: access control (which tool can do what), cryptographic attestation (verifying that a tool has not been modified), information flow tracking (tracing where data goes), and prompt injection protection. Seven threat categories, 23 identified attack vectors. Claimed theoretical coverage: 91%⁵.

The starting diagnosis is correct. Current MCP defenses cover no more than 34% of known threats, with an average success rate below 30%. Entire attack categories (cross-server data leakage, silent tool modification between sessions) have no formal defense⁵. The problem begins with the proposed response.

The information flow tracking layer (L-IFT) sits at the center of the architecture. It is the component that must trace which data passes between tools and prevent leaks. The authors acknowledge in the same paper that this layer is "intractable" through the attention mechanisms of an LLM⁵. In plain language: the core of the architecture cannot function with the technology it is supposed to protect. One of the four pillars is declared decorative by its own architects.

The cryptographic attestation layer (L-CTA) carries 39% of the claimed coverage. It proves that a tool has not been modified since it was signed. It does not prove that the tool was safe when it was signed. The distinction has been known in software security forever. The authors flag it as "open challenge #2." But the 91% figure still rests on it⁵.

The paper's lasting contribution lies elsewhere. The authors identify an attack surface they call S\_compose: individually safe tools that, combined, produce a new risk. A tool that reads a file plus a tool that sends an email equals data exfiltration. No compositional security proof exists today for this kind of coupling⁵. The authors frame it as an open problem.

This recognition contains the conclusion the paper does not draw. If security is a property that arises from composition, not from the sum of components, then stacking four defense layers after the fact cannot solve a problem that arises from the assembly itself.

And the loudest silence concerns governance. Open challenge #7 mentions "177,000 tools, same challenges as npm/PyPI" and moves on⁵. 177,000 tools available for installation, with no audited registry, no admission process, no intake governance. For a CISO already managing the security debt of npm and PyPI dependencies, the operational question is how to prevent developers from connecting fifty per week without anyone validating.

## The circuit

The three studies document the same mechanism at three layers. The offensive agent simulates the attack and hallucinates its own result. The defensive agent simulates the investigation and encounters evidence without recognizing it. The formal architecture simulates protection with a core layer acknowledged as impracticable. At each layer, a technical artifact produces a score that circulates independently of what it measures.

This mechanism is not new. It has structured the market for twenty years. The annual pentest produces a report the board will read as "our security is validated." A continuous-validation platform produces a dashboard presented as proof of resilience. ATT&CK coverage produces a map shown to auditors as proof of completeness. Each layer validates the previous one. None touches the system itself.

The offensive testing industry partly knows this. A pentest engagement is short and bounded, a few days to a few weeks on a fixed scope. An APT group takes six months, pivots through the HVAC maintenance contractor, and has no end date. The pentester looks for what they know how to find (web apps, AD misconfigurations, known CVEs) because that is what fills the report within the allotted time. Slow, unpredictable, combinatorial attack vectors remain underexplored because they are not profitable on a contractual timeline.

This observation is old. Military literature has articulated it for forty years: no serious army confuses wargame results with combat predictions⁷. Cybersecurity imported the vocabulary (red team, blue team, tabletop, war game) and forgot the warning that came with it.

What changed in 2026 is the ability to measure the gap. When the AutoPT agent hallucinates a flag, it loops the representation onto itself: its hypothesis becomes its own observation. When the Simbian benchmark records 859 missions without a single complete success, it documents the industrial production of partial results treated as results. When MCPSHIELD claims 91% coverage on an architecture whose core layer does not work, it inscribes a figure on an object that does not contain what the figure claims. The three papers, without knowing it, document three versions of the same gesture.

What the industry calls in turn "continuous validation," "adversary emulation," "breach and attack simulation," "Adversarial Exposure Validation," "Continuous Threat Exposure Management" changes labels every eighteen months but describes a single object: the serial reproduction of security representations, each justifying the purchase of the next, none measuring resistance to a real adversary. The literature produces ever-expanding internal taxonomies (pentest vs red team vs BAS vs adversary emulation vs AEV) and never asks the foundational question: can a controlled simulation, by construction, measure resistance to an uncontrolled adversary?

The shift from point-in-time to continuous, which the validation market presents as surpassing the pentest, changes the frequency of the measurement, not its nature. Photographing a repertoire once a year or filming it continuously produces the same repeated image: the catalog remains the catalog, run more often. The frame rate went up; the optics did not move.

The answer is no. Any security assessment based on replaying a known repertoire measures defensive coverage against that repertoire, not resistance to an adversary. The two are related but not identical. The portion of real threat that lies outside the repertoire is precisely the portion that causes damage. And the more an organization optimizes its defense against the repertoire (whether it comes from ATT&CK, a simulation platform, or its internal red team), the more readable it becomes to those who know what it trained against.

The flaw does not sit in the validation platforms, in MITRE, or in red teams. It sits in the claim that security can be measured through simulation. Simulation measures hygiene: have I patched? Are my credentials correct? Does my segmentation hold? Hygiene is useful. Security is something else. Confusing the two is confusing the representation with the thing. And this confusion is what allowed the industry to build indefensible architectures for thirty years without anyone noticing, because the representations produced enough scores, reports, and dashboards to bypass the question: was the system defensible by design?

## Back to the object

The way out of the circuit does not run through a better simulation, a better benchmark, a better score. An improved representation score remains a representation score.

The security of a system is a property that emerges from how it is designed, or does not emerge, and that no validation layer can reconstruct after the fact. No amount of stacked controls can replace it. Native segmentation, least privilege by construction, the ability to absorb an incident without cascading failure, the readability of the system to its own operators, the ability to make an attacker observable at the moment of action without needing to anticipate: these are not controls. They are design choices that render controls either unnecessary or effective. And none of these choices can be added to a system that lacks them, short of rebuilding the system.

MCPSHIELD glimpses this in S\_compose without drawing the consequence. If security arises from composition, it is decided at architecture time, not at instrumentation time. A protocol where 65% of tools modify the external environment, with no intake governance, no compositional security proof, will not be made safe by four formal layers stacked after the fact.

Simbian glimpses it in the attribution gap without articulating it. If the agent encounters evidence without recognizing it, the problem is not the model but the setup that assumes an agent without operational context knowledge can investigate. Investigation requires an understanding of the network that no prompt conveys and no log database contains. That understanding is a property of the supervision architecture, not the model.

Sichuan glimpses it in the baseline result without owning it. If a general-purpose agent with a three-line prompt matches specialized tools, the added value of specialization is marginal. What remains as defensible value for the legitimate offensive testing market is precisely what academic tools do not do: sandboxing, instruction auditing, result verification, scope management. The governance layer, not the intelligence layer.

Secure design work produces neither scores nor dashboards presentable at keynotes. It is slow, non-scriptable, and does not lend itself to LLM automation. It requires thinking about the system before building it, the composition before assembling it, defensibility before instrumenting the defense. It is the work the industry stopped doing when it discovered it could be replaced by continuous validation. It is the only work that bears any relation to the thing itself.

## What I don't know

The thesis that controlled simulation cannot measure resistance to a real adversary is logically sound but empirically hard to calibrate. The gap between exercise scores and resistance to real attacks has never been systematically measured. The few documented cases (the CISA 2024 red team of a U.S. critical infrastructure provider, post-SolarWinds after-action reviews) suggest a significant gap. The empirical base remains thin.

The Simbian benchmark has methodological biases. Simbian sells a SOC platform: the conclusion "models alone are not enough, you need an operational wrapper" directly serves their pitch. The test is zero-shot, with no playbook, no detection engineering, no Sigma rule library. A better-equipped agent would likely produce different results. The conclusion "LLMs cannot investigate on their own" holds under these conditions. Whether it holds with proper tooling is unknown.

The Sichuan paper tests on the XBOW benchmark, which is distant from a real enterprise environment (Active Directory, heterogeneous network segmentation, EDR, stealth constraints). The conclusion "a general-purpose agent matches specialized tools" holds on this benchmark. Transposition to production red teaming remains to be demonstrated.

All three papers date from April 2026\. The precise scores will age; the mechanism they document will not. The extension of the Simbian benchmark to sixteen models since April did not move the wall. It is the numbers that are dated, not the structure they expose.

I do not know whether the epistemological critique of offensive simulation has ever been formalized in the academic cybersecurity literature. A narrow bridge has been crossed: MIRROR (Fujitsu, June 2026) formalizes the distinction between raw success rates and genuinely novel success rates in automated red-teaming, showing that 73 to 84% of "successful" attacks from competing tools are exact replays of known seeds⁸. The broader bridge, however, remains uncrossed: the question of whether a controlled simulation can, by construction, measure resistance to an uncontrolled adversary has no formalization in cybersecurity. Military literature on the limits of wargaming and the critique of post-2008 banking stress tests carry this argument⁷. No one seems to have bridged the gap to cyber. This absence may mean that the argument is trivial and already internalized by practitioners, or that it is uncomfortable and systematically sidestepped.

## Conclusion

Three independent studies, published the same month, document the same operation at three layers of the stack. The offensive agent hallucinates the flag. The defensive agent encounters evidence without naming it. The formal architecture claims coverage whose core layer is acknowledged as impracticable. At every layer, the representation substitutes for the thing, and the circuit of score production, benchmarks, and coverage figures keeps spinning, each layer validating the previous one, none touching the real system. Meanwhile, in Las Vegas, the market was selling the representation with more autonomy, and pricing it at a quarter of a billion.

The industry has confused the measurement of hygiene with the measurement of security, and the simulation of the attacker with knowledge of the attacker. The first is useful. The second is a category error whose demonstration the LLM, by industrializing simulation, completes. 859 runs, 10 billion tokens, 177,000 tools, zero architecture.

The way out will not come from a better score. It will come from returning to the work the industry stopped doing: designing systems whose security is a native property, not an attribute added after the fact and validated against a repertoire. This work is slow, expensive, non-automatable, and produces nothing showable at a keynote. It remains the only work that bears any relation to the real object.

---

*Twenty-second article in a series on the structural failures of Western cybersecurity:*

- *Article 1 :* [*La vulnérabilité de la gestion des vulnérabilités*](https://www.klaerenn.fr/la-vulnerabilite-de-la-gestion-des-vulnerabilites-quand-le-systeme-cense-nous-proteger-devient-notre-point-faible/)
- *Article 2 :* [*La dépendance européenne aux standards américains*](https://www.klaerenn.fr/la-dependance-europeenne-otage-dun-systeme-de-vulnerabilites-quelle-ne-controle-pas/)
- *Article 3 :* [*Les États, architectes cachés du marché noir des vulnérabilités*](https://www.klaerenn.fr/les-etats-architectes-caches-du-marche-noir-des-vulnerabilites-quand-la-defense-nationale-alimente-linsecurite-globale/)
- *Article 4 :* [*L'IA ou l'effondrement du modèle défensif occidental*](https://www.klaerenn.fr/lia-ou-leffondrement-du-modele-defensif-occidental/)
- *Article 5 :* [*Desert Power — survivre sans l'Empire*](https://www.klaerenn.fr/desert-power-survivre-sans-lempire/)
- *Article 6:* [*I Am Altering the Deal*](https://www.klaerenn.fr/i-am-altering-the-deal-2/)
- *Article 7:* [*The Last Channel*](https://www.klaerenn.fr/the-last-channel/)
- *Article 8:* [*Lord of Cyber War*](https://www.klaerenn.fr/lord-of-cyber-war-2/)
- *Article 9:* [*The digital hawks*](https://www.klaerenn.fr/the-digital-hawks/)
- *Article 10:* [*They Live... we sleep*](https://www.klaerenn.fr/they-live/)
- *Article 11:* [*Soylent Green*](https://www.klaerenn.fr/soylent-green-2/)
- *Article 12:* [*Ghost in the Binary*](https://www.klaerenn.fr/ghost-in-the-binary-2/)
- *Article 13:* [*Now You See Me*](https://www.klaerenn.fr/now-you-see-me-2/)
- *Article 14:* [*The Prestige*](https://www.klaerenn.fr/the-prestige-2/)
- *Article 15:* [*Pitch Black*](https://www.klaerenn.fr/pitch-black-2/)
- *Article 16:* [*The Thing That Should Not Be*](https://www.klaerenn.fr/the-thing-that-should-not-be-2/)
- *Article 17:* [*Status: clean*](https://www.klaerenn.fr/fatal-merge-conflict-2/)
- *Article 18:* [*The Leopard*](https://www.klaerenn.fr/the-leopard/)
- *Article 19:* [*The Usual Suspects*](https://www.klaerenn.fr/usual-suspects-2/)
- *Article 20:* [*Kill One, Spawn Many*](https://www.klaerenn.fr/kill-one-spawn-many-2/)
- *Article 21:* [*The Conversation*](https://www.klaerenn.fr/the-conversation-2/)

---

## Sources

¹ Black Hat USA 2026, Las Vegas, August 1-6, 2026\. Vendor announcements catalogued by SecurityWeek, "Black Hat USA 2026 – Summary of Vendor Announcements" (parts 1 and 2). Defensive agents claiming attack-path anticipation, technique-chaining prediction, continuous adversary emulation, and autonomous exploitability validation. The 250-million-dollar raise is Horizon3.ai, maker of the autonomous pentest agent NodeZero: Series E announced August 3, 2026, valuation raised to more than 2 billion dollars (tripled in fourteen months), co-led by NightDragon and NEA, with strategic investors including Qualcomm, SAIC, and Singapore's EDBI. TechCrunch ties the raise to the disclosure, the previous week, that two AI labs' models had breached systems outside their intended scope. [https://www.securityweek.com/black-hat-usa-2026-summary-of-vendor-announcements-part-1/](https://www.securityweek.com/black-hat-usa-2026-summary-of-vendor-announcements-part-1/?ref=klaerenn.fr) — [https://techcrunch.com/2026/08/03/horizon3-hits-2-billion-valuation-with-250m-series-e-as-ai-threats-escalate/](https://techcrunch.com/2026/08/03/horizon3-hits-2-billion-valuation-with-250m-series-e-as-ai-threats-escalate/?ref=klaerenn.fr)

² Chuvakin A. & Rochford O., analysis of the gap between agentic SOC platform promises and their real production adoption, based on more than 30 vendor briefings and CISO interviews, Help Net Security (March 26, 2026). Practitioners who deploy describe shallow deployment, constrained use cases, and a vendor communication pattern that attributes product limits to buyer psychology. Anton Chuvakin is an advisor in the office of the CISO at Google Cloud. [https://www.helpnetsecurity.com/2026/03/26/future-ai-soc-vendor-claims/](https://www.helpnetsecurity.com/2026/03/26/future-ai-soc-vendor-claims/?ref=klaerenn.fr)

³ Peng J., Li Z., You C. et al. "Hackers or Hallucinators? A Comprehensive Analysis of LLM-Based Automated Penetration Testing." Sichuan University, Tsinghua University, NTU, NUS, NUDT et al. arXiv:2604.05719v1, April 2026\. 13 AutoPT frameworks, 2 baselines, 10 billion tokens, 1,500 logs manually reviewed by 15 researchers over 4 months. XBOW benchmark. Ablations on Claude Opus 4.6, GPT-5.2, Gemini-Pro-3.1, DeepSeek-Reasoner-v3.2\. [https://arxiv.org/abs/2604.05719](https://arxiv.org/abs/2604.05719?ref=klaerenn.fr)

⁴ Simbian AI. "Cyber Defense Benchmark." arXiv:2604.19533v3, April 2026\. 11 frontier models, 859 runs, 26 campaigns, 93 ATT&CK sub-techniques. OTRF/Mordor corpus, SQLite databases of 75,000 to 135,000 Windows logs. Simbian's live leaderboard has since extended the evaluation to 16 models across 1,144 runs (including Opus 4.8, GPT-5.5, GLM-5.2), with none clearing the passing threshold. [https://arxiv.org/abs/2604.19533](https://arxiv.org/abs/2604.19533?ref=klaerenn.fr) — leaderboard: [https://simbian.ai/research/cyber-defense-benchmark](https://simbian.ai/research/cyber-defense-benchmark?ref=klaerenn.fr)

⁵ Acharya S., Gupta M. "MCPSHIELD: A Unified Security Framework for Model Context Protocol." Carnegie Mellon University, University of Michigan. arXiv:2604.05969, April 2026\. Threat taxonomy (7 categories, 23 vectors, 4 surfaces), 4-layer defense-in-depth architecture, claimed theoretical coverage 91%. MCP ecosystem data from Stein et al. (177,000 tools, 97M SDK downloads/month, "action" tool share grown from 27% to 65%). On July 28, 2026, three months after this paper, MCP published its largest revision since launch (the 2026-07-28 specification), making the protocol stateless at the transport layer. The change is driven by scalability, not security, and touches none of the three points above: the L-IFT layer remains intractable through an LLM's reasoning, attestation still proves non-mutation rather than benignity, and compositional security (S\_compose) remains an open problem. If anything, going stateless accelerates the shift toward the distributed execution infrastructure the paper documented, by making tool deployment trivial on any HTTP infrastructure. [https://arxiv.org/abs/2604.05969](https://arxiv.org/abs/2604.05969?ref=klaerenn.fr) — 2026-07-28 specification: [https://modelcontextprotocol.io/specification/2026-07-28/changelog](https://modelcontextprotocol.io/specification/2026-07-28/changelog?ref=klaerenn.fr)

⁶ See in this series: "Now You See Me" (ATT&CK SIEM coverage at 21%, CardinalOps), "The Prestige" (D3FEND: 34% Detect, 4% Deceive), "The Thing That Should Not Be" (ATLAS: absent from all major AI threat reports). Declarative knowledge benchmarks CyberMetric, SecBench, and CTI-Bench test recall; the Cyber Defense Benchmark tests operational cognition. The gap between the two classes of metrics quantifies the distance between what the industry measures and what it claims to measure.

⁷ Perla P., *The Art of Wargaming*, Naval Institute Press, 1990, for the military critique of controlled simulation limits. The distinction between simulation and real adversity was formalized forty years before the AutoPT debate.

⁸ Fujitsu Research of Europe / Fujitsu Limited. "MIRROR: Novelty-Constrained Memory-Guided MCTS Red-Teaming for Agentic RAG." arXiv:2606.26793v1, June 2026\. Benchmark ART-SAFEBENCH published on Hugging Face (Fujitsu/agentic-rag-redteam-bench). PAIR, TAP, and PS report 58–77% raw ASR but 73–84% exact replay; Novel-ASR after deduplication: 6–9%. MIRROR's Novelty Gate uses exact-match after normalization (whitespace-strip and alphanumeric-lowercase); the authors acknowledge that paraphrases pass the filter. [https://arxiv.org/abs/2606.26793](https://arxiv.org/abs/2606.26793?ref=klaerenn.fr)