I thought it came from RLVR with poor sandboxing and not explicitly security testing.