The flaw in Bellare-Rogaway (1995) model on authenticated key exchange
The "protocol interference" attack:

From Fig 2 of http://seclab.cs.ucdavis.edu/papers/Rogaway/3pkd.pdf --

In Flow3A (resp. 3B), before the intended message is delivered, the adversary manages to obtain an encryption under $K_A$ (resp. $K_B$) of a different session key $\sigma'$ (through interacting with $S$ in a higher-level protocol) and sends this "forged" message to $A$ and $B$. This is a successful man-in-the-middle style attack.

Why the security definition should include TEST in the middle of execution:

If the interaction doesn't terminate immediately after TEST, then the forged session breaks security in a very obvious way. Namely, with probability 1/2, the TEST operation hands a key to the adversary; it becomes the "higher-level protocol" we're worried about with constant probability. If the adversary is not forced to immediately halt, then it can use this key to perform the man-in-the-middle attack above (at least in the BR95 scheme).

The security definition given in BR95 is, therefore, too weak as this is a plausible attack (Why would an adversary arbitrarily halt, especially after they've just extracted useful information?). That is, a protocol vulnerable to this attack is (wrongly) proven secure under the given definition.