Good question. In the default setup they can’t disagree, because they come from the same place. AgentSec runs the simulated tools itself, so it is the one that serves the poisoned email. Exposure is the harness’s own record of the tool result that carried the injection, and every event gets one sequence number from the harness. A finding needs a goal-matching call with a higher sequence number than delivery, and calls before delivery don’t count. Nothing is rebuilt from the agent’s logs.

Your concern does apply to agents that run their own tools and report them back to us. Then the trace is the agent’s account, and the verdict inherits whatever it chose to record. Those events are flagged executed_by_agent in the report, but flagging isn’t verification. The real fix is observing independently, below the agent: for example, logging network egress per test case. That’s on the roadmap.