{
 "license": "CC-BY-4.0",
 "attribution": "Fide AI, Agentic Cyber Explorer",
 "url": "https://agentic-cyber-explorer.pages.dev/events/agentphishing-adaptive-email-agent-benchmark-2026/",
 "asOf": "2026-10-30",
 "id": "agentphishing-adaptive-email-agent-benchmark-2026",
 "date": "2026-10-22",
 "datePrecision": "day",
 "title": "AgentPhishing tests email-agent decisions against adaptive synthetic phishing",
 "lane": "defense",
 "kind": "benchmark",
 "summary": "Carnegie Mellon researchers introduce AgentPhishing, separating phishing detection from compliance with malicious requests. In their universal-skill evaluation, four of nine additional target agents had detection below 10% and compliance above 45%. The benchmark scores selected actions and drafted replies, not externally executed emails or completed real-world harm.",
 "whyItMatters": "It shows why classifying conventional phishing correctly does not establish safe delegated email behavior under adapted attacks.",
 "actors": [
  "carnegie-mellon-university"
 ],
 "topics": [
  "fraud-and-social-engineering",
  "capability-evaluation",
  "eval-validity"
 ],
 "atlas": [
  "untrusted-content",
  "tools"
 ],
 "artifacts": [
  "gpt-5-family",
  "claude-sonnet",
  "gemini",
  "kimi"
 ],
 "sources": [
  {
   "url": "https://arxiv.org/abs/2610.31404",
   "publisher": "Carnegie Mellon University (arXiv)",
   "title": "AgentPhishing: A Benchmark of LLM Email Agents Under Adaptive Attack",
   "date": "2026-10-22",
   "type": "primary",
   "accessed": "2026-10-24"
  }
 ],
 "keyFacts": [
  {
   "fact": "The paper is arXiv version 1, submitted 2026-10-22. Justin Tan, Miao Li and Ding Zhao use synthetic single-message emails, fictional organizations and nonfunctional secrets; no generated email was sent to a real mailbox.",
   "locator": "Title page; Ethical Considerations"
  },
  {
   "fact": "The headline four-of-nine result concerns the universal generation skill on additional agents not used as optimization targets. The authors do not establish its consistent superiority over target-specific skills.",
   "locator": "Section 5.3, Universal skill results"
  },
  {
   "fact": "Compliance includes choosing to click a link or provide information, or producing a draft reply judged unsafe. Rule-based scoring, finite samples, fixed model configurations and LLM realism judgments limit generalization.",
   "locator": "Section 4, Benchmark; Section 6, Limitations"
  },
  {
   "fact": "The evaluated families include GPT-5.4, Claude-Sonnet-5, Gemini-3.5-Flash and Kimi-K2.5. These include optimization targets and comparison agents; the four-of-nine headline concerns additional agents, not a shared failure rate for the linked model families.",
   "locator": "Sections 5.1–5.2, Experimental setup; Table 1"
  }
 ],
 "significance": 3,
 "fideQuestions": [
  "FID-075"
 ],
 "methods": [
  "adaptive-red-teaming"
 ],
 "review": "assistant-drafted",
 "addedOn": "2026-10-24",
 "revisions": []
}