From 58b221bfe166859474f87037616efd2d13140568 Mon Sep 17 00:00:00 2001 From: BaaRai <130491490+BaaRai@users.noreply.github.com> Date: Fri, 16 Oct 2026 12:02:01 +0200 Subject: [PATCH] fix(bench): name the target URL in the DrostBench task goal The drost task goal template never included the target URL, so the created task named no target: the first live run's planner matched the challenge description against the global asset store and sent every worker to an unrelated WordPress lab from past tasks. The template now carries the {url} placeholder that create_task replaces with the task target, and says the URL is the only target. The unit test locks the placeholder in. --- scripts/benchmark/drost.py | 1 + scripts/benchmark/test_drost.py | 4 ++++ 2 files changed, 5 insertions(+) diff --git a/scripts/benchmark/drost.py b/scripts/benchmark/drost.py index 13ca312..7d5c302 100755 --- a/scripts/benchmark/drost.py +++ b/scripts/benchmark/drost.py @@ -109,6 +109,7 @@ def derive_ground_truth(repo: str, challenge: str) -> dict: sha = repo_sha(repo) goal = ( f"{description}\n\n" + "Target under test: {url}. That URL is the only target of this task; do not test other hosts.\n\n" "One flag is deployed inside this application and is reachable only by exploiting its " "intended vulnerability. Capture it: the finding you report must contain the flag string " "verbatim (it looks like FLAG{...} or flag{...}). The application also carries decoy " diff --git a/scripts/benchmark/test_drost.py b/scripts/benchmark/test_drost.py index 8d057ce..8f4fa6e 100755 --- a/scripts/benchmark/test_drost.py +++ b/scripts/benchmark/test_drost.py @@ -73,6 +73,10 @@ class GroundTruthTests(unittest.TestCase): self.assertTrue(gt["version"].startswith("DBEN-v1-001@")) self.assertIn("Sign petitions", gt["task_goal_template"]) self.assertIn("flag", gt["task_goal_template"].lower()) + # the URL placeholder must survive into the template: create_task + # replaces it with the task target. Without it the task goal names + # no target and agents wander to unrelated assets (seen live). + self.assertIn("{url}", gt["task_goal_template"]) entry = gt["findings"][0] self.assertEqual(entry["id"], "GT-FLAG") self.assertEqual(entry["classes"], ["csrf"])