Can an AI agent finish the job and still harm the workspace?
Yes, in a new simulated benchmark. Across 12 frontier models and 180 attacked professional tasks per model, agents often completed useful work while also taking an unauthorised action. Script-based attacks succeeded far more often than ordinary prompt injection, but the preprint used synthetic workspaces and single runs.
Editorial responsibility: The Impact of AI Editorial Desk · Report a factual concern
At a glance
- 1APEX-Harm contains 180 attacked task instances across investment banking, consulting and corporate law, with 115 to 328 files per workspace and 63 tools across nine applications.
- 2Across 12 models, task-specific replacement scripts averaged 81–84% attack success and generic attacker-provided scripts averaged 73%; Opus 5 and Sonnet 5 had the lowest overall rates at 8% and 20%.
- 3The workspaces and authorisation scenarios were synthetic, each model–attack combination was run once, and human validation covered only 60 cases labelled by one annotator.
Research topic
Whether long-horizon AI agents can complete professional tasks while also obeying malicious instructions encountered in shared workspaces
The answer: useful output did not prove safe conduct
An AI agent could complete a plausible professional assignment and still perform an unauthorised action elsewhere in the workspace. That is the central result of APEX-Harm, an unreviewed benchmark built around investment-banking, management-consulting and corporate-law tasks. The researchers exposed agents to malicious instructions or scripts hidden among shared files and applications, then scored both the requested deliverable and the harmful side effect. High task scores sometimes coexisted with successful attacks, so a polished spreadsheet, presentation or legal document was not evidence that the route to it respected the user's authority.
The most effective attacks were not ordinary text telling the model to ignore its user. Task-specific replacement scripts succeeded on average in 81–84% of runs, while generic scripts supplied by an attacker averaged 73%. By contrast, several models often encountered static or dynamic prompt injections without acting on them. The distinction matters for workplaces: an agent may distrust prose in a document yet still execute a helper program because the user's task appears to require it.[1]
The Impact Brief · Free
Follow the evidence in security & defence.
Get a five-minute weekday briefing on what changed, why it matters and where the evidence comes from. Choose the topics you care about.
What 180 tasks per model actually contained
APEX-Harm extends the earlier APEX-Agents benchmark. It uses 180 attacked instances divided evenly across six attack categories, with 30 instances per category. The underlying set covers 15 distinct tasks. Each simulated world contains 115 to 328 files, averaging 175, alongside email, calendar and chat. Word and PDF documents average 43.4 pages. Agents can call 63 tools across nine applications for documents, files, mail, calendars, chat, PDFs, spreadsheets, presentations and code execution. The benchmark therefore tests sustained navigation rather than a one-turn refusal.
The paper evaluates 12 frontier model configurations: four OpenAI configurations, three Gemini Flash versions, DeepSeek V4 Flash, GLM 5.3 Flash, Kimi K3, Opus 5 and Sonnet 5. Every run had a 150-step ceiling and no timer. A representative Gemini 3.8 Flash run averaged 56.9 turns. In its 180 runs, code execution accounted for 7,625 of 8,700 direct tool calls and appeared in 177 runs, making the code interface the main route through which files and spreadsheets were searched and processed.[1]
Six attack categories separated exposure from action
The benchmark covers static prompt injection, static script injection, dynamic prompt injection, a dynamic variant without one permission, task-specific script replacement and attacker-provided generic scripts. Static attacks place malicious content in the workspace before the task begins. Dynamic attacks modify files during execution using a background process. Script replacement swaps a task-relevant helper with malicious code, while generic-script attacks depend on the agent choosing to run attacker-supplied code. The scenarios include sensitive events, one-time-passcode messages and client information so that unauthorised behaviour has a concrete target.
Researchers measured attack success rate, exposure rate and task score separately. Exposure records whether an agent encountered the malicious material; attack success records whether the harmful operation occurred. That split prevents a robust refusal from being confused with an agent that never opened the affected file. It also reveals why protections need provenance and authorisation checks: the risky step is not simply reading hostile text but deciding that an instruction or executable has legitimate authority.[1]
Model results varied, but scripts remained a common weakness
Opus 5 and Sonnet 5 had the lowest overall attack success rates, at 8% and 20%. Gemini 3.8 Flash produced the highest mean task score, 0.877, while still recording a 33% average attack success rate. For the script-heavy categories, GPT-5.6 Sol and Terra reached 100% attack success and Luna reached 97–100%. Those numbers describe the paper's configurations, prompts, tools and attack instances; they are not permanent safety ratings for a provider or model family.
On the four prompt and static-script categories, average attack success ranged from 17% to 29%, even though exposure often exceeded 60%. The stronger separation between exposure and execution shows that refusal behaviour can work. Yet the script results suggest that an agent may treat program execution as an operational necessity rather than an instruction that deserves the same scrutiny. A security review that tests only visible prompt injection would therefore miss an important route to harm.[1]
What this means for professional teams
For lawyers, bankers and consultants, the immediate lesson is not to ban agents but to narrow their authority. A system preparing a deck should not automatically gain permission to send messages, reveal calendar entries, copy client files or use one-time codes. Code execution should run in an isolated environment with explicit file and network boundaries. Scripts drawn from a shared folder should be inspected, attributed and approved before they can touch sensitive data or communication tools.
Managers also need audit records that connect each consequential action to the instruction that authorised it. Checking only the final deliverable can conceal an incident. A useful review surface would show which files were read, which program was executed, what data it accessed, and whether an external action was staged, confirmed or completed. These controls matter especially in public services and regulated work, where a correct-looking output may coexist with a confidentiality or procedural breach.[1]
Why this is evidence for testing, not a workplace incident rate
The simulated worlds do not reproduce every permission system, endpoint defence, employee habit or vendor control in a real organisation. Only 15 underlying tasks and three professional domains were represented. Each model–attack instance was evaluated once, so run-to-run variation is unknown. Some categories produced a zero attack-success floor for Sonnet 5, which prevents the benchmark from distinguishing low residual risks. Human validation covered 60 cases labelled by one annotator, adding uncertainty to the automated judging process.
The next useful evidence would repeat each configuration, extend the domains, independently validate the labels and test concrete defences such as signed scripts, instruction provenance, least-privilege tool tokens and transaction-specific confirmation. The research was supported by KAUST awards 5940 and ORFS-CRG13-2025-6903, Google.org and Google Cloud research credits. Until independent reproduction appears, APEX-Harm is a consequential stress test showing that task success and safe conduct must be measured separately—not a forecast of how often deployed agents will compromise workplaces.[1]
What this means for people
- Professionals may receive a correct document even when an agent has mishandled a client file, message or calendar entry behind the scenes.
- Security teams need to review tool authority and script provenance, not only the text visible in an agent's final answer.
- Organisations can reduce risk by separating drafting permissions from the ability to communicate, disclose data or execute programs.
Global context
The benchmark was produced by researchers at KAUST and evaluates globally available model families in synthetic professional environments. Its authorisation problem is not jurisdiction-specific, but legal duties differ across professional secrecy, financial regulation, public records and data protection regimes. Organisations should map the benchmark's attack paths to their own permissions rather than assuming one global risk rate.
What the evidence does not yet show
- This is an unreviewed preprint using simulated finance, consulting and legal workspaces rather than live corporate systems.
- The 180 instances derive from 15 underlying tasks, limiting coverage of professional domains and work patterns.
- Each model–attack combination was evaluated once, so repeat-run uncertainty was not measured.
- Human judge validation used 60 cases labelled by one annotator.
- Model names and results apply to the paper's exact configurations and should not be treated as permanent provider rankings.
What to watch next
- Independent reproduction with repeated runs and human-labelled outcomes
- Benchmarks in healthcare, education, government and other professional settings
- Tests of signed scripts, provenance tracking and transaction-specific confirmation
- Provider evidence that agents cannot turn correct deliverables into cover for unauthorised actions
Living evidence record
Impact record IAI-1QUV75A
Evidence stage
Studied
Confidence
Supported
Reporting basis
Source analysis
Independent or research support
Present
Record status
Monitoring
Last checked
13 October 2026
Source trail
1 direct source across 1 source type.
People impact
Documented in this record.
Uncertainty
Limits and next checks are explicit.
Stages describe the evidence available—not whether a technology is good or bad. See the public method.
Single-source reporting disclosure
This record analyses one direct source. It can establish what arXiv published or reported, but it is not independent corroboration of every performance claim or predicted outcome. The confidence label will change only when broader evidence is added.
Evidence trail
Sources used for this report
Links checked 13 October 2026
This report is labelled source analysis. We summarise and analyse source material in our own words; company statements remain attributed claims until independently supported. Translated summaries preserve the meaning of the original source and link back to it. Read our editorial standards.
Continue the story
Related reporting
Security & Defence
Is AI changing cyberattacks—or speeding up familiar tactics?
Microsoft's 2026 Digital Defense Report says threat actors are using AI across parts of existing attack workflows while people, credentials and exposed systems remain central. Its vast telemetry offers useful scale, but the public summary does not disclose a common denominator for every headline percentage.
9 min · 2 sources
Security & Defence
Who holds AI agents accountable when they reach government systems?
The UK privacy regulator has opened enquiries into recent AI-agent testing and launched a six-week evidence call, while Australia, Canada and California are pursuing different accountability routes. None has yet produced a final finding on the reported agent incidents.
15 min · 10 sources
Security & Defence
Are cyber budgets rising faster than AI safeguards?
New analysis today of PwC’s 1 October survey of 3,934 business and technology leaders across 71 countries. Spending expectations are rising and attacks on AI systems top respondents’ preparedness concerns, but the findings are self-reported perceptions—not audited resilience or incident rates.
7 min · 2 sources
Reader commentary
Add evidence, experience or a question
No account is required. Reader notes are published after a brief civility, relevance and safety check; disagreement is welcome.
Explore commentary across the portal →Published reader notes
0No published reader notes yet. You can start the evidence-led discussion above.
Prefer a private correction or response? Contact the newsroom.