Nine of fifteen security-testing confirmation mechanisms were forgeable, and mixing rules with judges made it worse.

Forgeability was predicted entirely by whether the decision reads attacker-controlled data, a prediction fixed in advance that separated sixteen held-out mechanisms exactly and scored 99.9% across 12,203 public scanner templates. The counterintuitive finding: deterministic rules failed at 2% of attacker-controlled response content against a median of 50% for eight open-weight LLM judges, but routing between a rule and a judge raised forgery to 99%. Moving the decisive evidence to a channel the attacker cannot write dropped attack success from 97% to 0%. (arXiv 2609.24200)