diff --git a/scripts/benchmark/drost.py b/scripts/benchmark/drost.py
index 13ca312..7d5c302 100755
--- a/scripts/benchmark/drost.py
+++ b/scripts/benchmark/drost.py
@@ -109,6 +109,7 @@ def derive_ground_truth(repo: str, challenge: str) -> dict:
     sha = repo_sha(repo)
     goal = (
         f"{description}\n\n"
+        "Target under test: {url}. That URL is the only target of this task; do not test other hosts.\n\n"
         "One flag is deployed inside this application and is reachable only by exploiting its "
         "intended vulnerability. Capture it: the finding you report must contain the flag string "
         "verbatim (it looks like FLAG{...} or flag{...}). The application also carries decoy "
diff --git a/scripts/benchmark/test_drost.py b/scripts/benchmark/test_drost.py
index 8d057ce..8f4fa6e 100755
--- a/scripts/benchmark/test_drost.py
+++ b/scripts/benchmark/test_drost.py
@@ -73,6 +73,10 @@ class GroundTruthTests(unittest.TestCase):
             self.assertTrue(gt["version"].startswith("DBEN-v1-001@"))
             self.assertIn("Sign petitions", gt["task_goal_template"])
             self.assertIn("flag", gt["task_goal_template"].lower())
+            # the URL placeholder must survive into the template: create_task
+            # replaces it with the task target. Without it the task goal names
+            # no target and agents wander to unrelated assets (seen live).
+            self.assertIn("{url}", gt["task_goal_template"])
             entry = gt["findings"][0]
             self.assertEqual(entry["id"], "GT-FLAG")
             self.assertEqual(entry["classes"], ["csrf"])