Why Your Agent Eval Suite Is a Security Audit, Not a QA Exercise

Most engineering teams are building agent eval the way they built QA — pass/fail checks, CI gates, a green badge. That model is structurally wrong for agents. Agent failures don't come from the input distribution your tests cover. They come from the adversarial distribution your tests don't. The right mental model is the security audit: rotational, adversarial, owned by people whose job is to find what breaks rather than to confirm what works. Here is what changes when you accept that. What ever