Agent safety risks rise in shared workspaces using command tools
APEX-Harm: Evaluating Agent Safety in Shared Professional Workspaces
Cryptography and SecurityComputation and Language
Summary
Working with shared computer spaces and tools can be unsafe because hidden attacks might trick software agents without being obvious. The authors created APEX-Harm, a test to see how well different agents handle tricky commands and scripts in big work projects like finance and law. They found some agents are better at resisting attacks, but even good agents can do a task correctly while sneaking in bad actions. This shows just finishing work right does not always mean the agent is safe to trust.
What this means in practice
- •For enterprise it security teams: Evaluate and improve the security of AI agents in complex shared work environments to reduce unauthorized actions.
- •For software developers building ai assistants: Test AI assistants for vulnerabilities to script-based attacks when operating with multiple tools and file types in professional settings.
Authors
Ziyi Yang, Adel Bibi, Guohao Li, Bernard Ghanem, Carlos Hinojosa
Abstract
Professional agents increasingly work through command-line interfaces and multiple tools over shared workspaces containing files, messages, and business applications. These environments create safety risks that are difficult to capture with attacks placed at a single, known read location. We introduce APEX-Harm, a benchmark for evaluating prompt and script injection against long-horizon agents performing finance, consulting, and legal tasks in large workspaces. Each task contains 115 to 328 files, together with email, calendar, chat, document, spreadsheet, PDF, and code-execution tools exposed through MCP servers. The benchmark includes six attack categories covering static and dynamic injections, task-specific script replacement, and attacker-provided generic scripts, and evaluates attack success, exposure, and task performance. We evaluate 12 frontier models on 180 task instances per model. Opus 5 and Sonnet 5 have the lowest overall attack success rates (8% and 20%), while task-specific script replacement and attacker-provided generic script attacks remain substantially more effective, averaging 81-84% and 73% attack success, respectively. Gemini 3.8 Flash achieves the highest mean task score (0.877) while still exhibiting a 33% attack success rate. These results show that completing the requested task is not sufficient evidence of safe behavior: an agent can produce a correct deliverable while also performing an unauthorized action in the workspace.