APEX-Harm：评估共享专业工作空间中智能体的安全性
APEX-Harm: Evaluating Agent Safety in Shared Professional Workspaces
AI总结：
该研究推出APEX-Harm基准，评估12个前沿智能体模型在大型共享专业工作空间中应对6类注入攻击的安全性，发现部分模型任务得分高但仍存在较高攻击成功率，完成任务不足以证明智能体安全。
摘要：
专业智能体越来越多地通过命令行界面和多个工具，在包含文件、消息及业务应用的共享工作空间中开展工作。这些环境会产生难以通过针对单个已知读取位置的攻击捕捉到的安全风险。我们推出APEX-Harm，这是一个用于评估针对在大型工作空间中执行金融、咨询和法律任务的长程智能体的提示注入与脚本注入的基准。每个任务包含115至328个文件，以及通过MCP服务器提供的电子邮件、日历、聊天、文档、电子表格、PDF和代码执行工具。该基准涵盖6类攻击，包括静态和动态注入、任务特定脚本替换以及攻击者提供的通用脚本，并评估攻击成功率、暴露程度和任务性能。我们针对每个模型在180个任务实例上评估了12个前沿模型。Opus 5和Sonnet 5的整体攻击成功率最低，分别为8%和20%，而任务特定脚本替换和攻击者提供的通用脚本攻击仍然显著更有效，平均攻击成功率分别为81-84%和73%。Gemini 3.8 Flash的平均任务得分最高，为0.877，但其攻击成功率仍为33%。这些结果表明，完成请求的任务并非安全行为的充分证据：智能体可以生成正确的交付成果，同时在工作空间中执行未授权的操作。
英文摘要：
Professional agents increasingly work through command-line interfaces and multiple tools over shared workspaces containing files, messages, and business applications. These environments create safety risks that are difficult to capture with attacks placed at a single, known read location. We introduce APEX-Harm, a benchmark for evaluating prompt and script injection against long-horizon agents performing finance, consulting, and legal tasks in large workspaces. Each task contains 115 to 328 files, together with email, calendar, chat, document, spreadsheet, PDF, and code-execution tools exposed through MCP servers. The benchmark includes six attack categories covering static and dynamic injections, task-specific script replacement, and attacker-provided generic scripts, and evaluates attack success, exposure, and task performance. We evaluate 12 frontier models on 180 task instances per model. Opus 5 and Sonnet 5 have the lowest overall attack success rates (8% and 20%), while task-specific script replacement and attacker-provided generic script attacks remain substantially more effective, averaging 81-84% and 73% attack success, respectively. Gemini 3.8 Flash achieves the highest mean task score (0.877) while still exhibiting a 33% attack success rate. These results show that completing the requested task is not sufficient evidence of safe behavior: an agent can produce a correct deliverable while also performing an unauthorized action in the workspace.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
