APEX-Harm: 공유 업무 환경의 에이전트 보안 취약성 평가
APEX-Harm: Evaluating Agent Safety in Shared Professional Workspaces
- 매체
- Hugging Face
- 게시
- 중요도
- 2/5
- 화제 지수
- 9
한국어 요약
공유 워크스페이스에서 에이전트가 수행하는 금융·컨설팅·법률 작업의 프롬프트·스크립트 인젝션 공격 위험을 평가하는 벤치마크가 제시됐다. 12개 최고 수준 모델을 평가한 결과 과제 성공과 보안이 동시에 달성되기 어려운 트레이드오프가 존재함을 보였다.
원문 발췌 · English
Professional agents increasingly work through command-line interfaces and multiple tools over shared workspaces containing files, messages, and business applications. These environments create safety risks that are difficult to capture with attacks placed at a single, known read location. We introduce APEX-Harm, a benchmark for evaluating prompt and script injection against long-horizon agents performing finance, consulting, and legal tasks in large workspaces. Each task contains 115 to 328 files, together with email, calendar, chat, document, spreadsheet, PDF, and code-execution tools exposed through MCP servers. The benchmark includes six attack categories covering static and dynamic injections, task-specific script replacement, and attacker-provided generic scripts, and evaluates attack success, exposure, and task performance. We evaluate 12 frontier models on 180 task instances per model. Opus 5 and Sonnet 5 have the lowest overall attack success rates (8% and 20%), while task-specific script replacement and attacker-provided generic script attacks remain substantially more effective, averaging 81-84% and 73% attack success, respectively. Gemini 3.8 Flash achieves the highest mean task score (0.877) while still exhibiting a 33% attack success rate. These results show that completing the requested task is not sufficient evidence of safe behavior: an agent can produce a correct deliverable while also performing an unauthorized action in the workspace.