Attack success rate is reported as a point estimate in 65% of agent-security papers.

A full-text meta-analysis of 259 agentic-security arXiv papers from February 2025 to September 2026, arXiv 2609.25173, found 65.3% report no variance or repeated runs for their headline ASR, only 30.9% disclose enough decoding detail to tell whether the eval was stochastic, and 29.7% of LLM-judge papers check agreement with humans. On a 100-instance benchmark the minimum detectable ASR difference at conventional power is 18.2 points. Most published defense rankings with small gaps are noise, including several I've cited.