New Benchmark Tests Whether Penetration-Testing Agents Stay Inside the Client's Authorized Scope · Polylog