Measuring Security Without Fooling Ourselves: Why Benchmarking Agents Is Hard | Hacker News Reader