the best-defended model today, Meta-SecAlign, still approaches 100% attack success under adaptive injections, partly because DPO anchors it to an insecure reference model. SecPO approximates an injection-invariant oracle reference and trains on strong synthesized attacks (best@240); its Qwen3.6-27B build posts 8.8% vs. Meta-SecAlign's 78.8% attack success on AgentDojo under the AttackerMovesSecond attack, with no noticeable benign-utility loss across nine benchmarks. Code, training data, and the defended model are released.