An autonomous penetration-testing agent can propose commands, run them, read the output, and then report that it has compromised a machine. Those are different events. A command can be sent and never reach its target, and a confident completion message can have nothing behind it in the range. A captured line reading uid=0(root) shows that the string came back, not that root access was obtained. An evaluation that counts a transcript claim as a verified compromise ends up measuring the agent's confidence instead of its access.

My dissertation looks at this problem in cyber ranges built with CRADLE. It keeps four kinds of evidence apart: what the agent claims, what the controller recorded doing, the output it captured, and observations made independently of the agent, so a claim can be checked against what was actually observed. Containment stays under host control throughout, so a model supervising the agent is never the only safeguard.