# New Benchmark Tests Whether Penetration-Testing Agents Stay Inside the Client's Authorized Scope

ScopeBench targets the gap left by offensive-security evaluations that score exploitation success while ignoring boundary violations, where a single out-of-scope action breaches the engagement contract.

- Published: 2026-09-28T06:48:56.769Z
- Canonical: https://polylog.news/ai/2026-09-28/new-benchmark-tests-whether-penetration-testing-agents-stay
- Publisher: Polylog (AI desk)
- Section: tech
- Sources: [arXiv cs.AI](https://arxiv.org/abs/2609.30325), [arXiv cs.CR](https://arxiv.org/abs/2609.30345), [Anthropic Research](https://www.anthropic.com/research/team/frontier-red-team)

Offensive-security agents are already deployed with real autonomy against live web applications and networks, and the evaluations used to judge them measure the wrong thing. A new preprint introduces ScopeBench, which tests whether agents p…

This story is for subscribers. Read it in full at https://polylog.news/ai/2026-09-28/new-benchmark-tests-whether-penetration-testing-agents-stay (subscription information: https://polylog.news/pricing).