A 95% false positive rate isn't actually that big a deal if you have a good way to test the claims. I wonder if you could set it up CtF-style, where you don't get notified until the LLM can write to a specific file on the target box.