97,127 hosts scanned.
One benchmark emerged.

Reference results

F1, precision and false-positive rate withdrawn. Recall stands, with its denominator.

This section previously published an F1 score and a false-positive rate for the HackMyAgent pipeline. Those figures are withdrawn. 3,704 of the 3,881 benign samples were labeled benign by the rule verdict='warning' AND overall_score >= 70 as reported by HackMyAgent itself, so anything the scanner would have flagged was excluded from the benign class by construction and a near-zero false-positive rate was guaranteed before any scan ran. A scanner cannot be graded against labels it produced.

That reasoning covers every metric which reads the benign class. It does not cover recall, which reads only the malicious class, and the first version of this notice withdrew recall anyway. That was an error in the correction, fixed on 2026-08-09. Recall is 223 of 270, or 82.6%, measured on attack fixtures we authored ourselves. Read with the self-labeled samples scored too it is 47.3% (234 of 495), and the benchmark page shows both, plus the split by source.

We are re-measuring on corpora we neither own nor labeled, and will republish only figures a third party can reproduce without our cooperation. No comparative claim is made until then.