diff --git a/agent/prompt_builder.py b/agent/prompt_builder.py
index 3ec4a40b3929..53723671372f 100644
--- a/agent/prompt_builder.py
+++ b/agent/prompt_builder.py
@@ -57,6 +57,11 @@ def _scan_context_content(content: str, filename: str) -> str:
     findings = _scan_for_threats(content, scope="context")
     if findings:
         logger.warning("Context file %s blocked: %s", filename, ", ".join(findings))
+        msg = (
+            f"WARNING: {filename} blocked by threat scanner ({', '.join(findings)}). "
+            f"Content not loaded into system prompt. Review the file or add an exception."
+        )
+        _record_truncation_warning(msg)
         return f"[BLOCKED: {filename} contained potential prompt injection ({', '.join(findings)}). Content not loaded.]"
 
     return content
diff --git a/tools/threat_patterns.py b/tools/threat_patterns.py
index f101a5a29095..8f294ab70bc2 100644
--- a/tools/threat_patterns.py
+++ b/tools/threat_patterns.py
@@ -112,7 +112,7 @@
     # blocked. "praxis" was removed for exactly this reason — it's a common
     # word and a legitimate agent name (Greek for practice/action), not a
     # C2-specific tell like the brands below.
-    (r'\b(?:cobalt\s*strike|sliver|havoc|mythic|metasploit|brainworm)\b', "known_c2_framework", "context"),
+    (r'\b(?:cobalt\s*strike|sliver|havoc|metasploit|brainworm)\b', "known_c2_framework", "context"),
     (r'\bc2\s+(?:server|channel|infrastructure|beacon)\b', "c2_explicit", "context"),
     (r'\bcommand\s+and\s+control\b', "c2_explicit_long", "context"),