post-compromise

Introduces SecRespond, the first benchmark for evaluating LLM agents on post-compromise incident response tasks using forensic disk snapshots and alerts. Experiments show agents struggle with proactive investigation and comprehensive remediation.