I spent months trying to break my own security project, then published where it loses

I built an open source tool that stops AI agents doing things they were never allowed to do. Rather than publish the numbers that flatter it, I put every tool at its own default on public datasets and linked the script behind each number. One card on the benchmark page has a WE LOSE badge, for the test where a competing tool beats mine. It is still there. The number I am happy with: on a 588 attack benchmark, no guardrail lets all 588 through, the common open source guardrail lets 86 thro