SXT: Your Model Risk Framework Doesn't Cover Your Agents