Carnegie Mellon researchers introduce AgentPhishing, separating phishing detection from compliance with malicious requests. In their universal-skill evaluation, four of nine additional target agents had detection below 10% and compliance above 45%. The benchmark scores selected actions and drafted replies, not externally executed emails or completed real-world harm.
Why it matters
It shows why classifying conventional phishing correctly does not establish safe delegated email behavior under adapted attacks.
Key facts
As stated in the sources, with where to find them.
- The paper is arXiv version 1, submitted 2026-10-22. Justin Tan, Miao Li and Ding Zhao use synthetic single-message emails, fictional organizations and nonfunctional secrets; no generated email was sent to a real mailbox.Title page; Ethical Considerations
- The headline four-of-nine result concerns the universal generation skill on additional agents not used as optimization targets. The authors do not establish its consistent superiority over target-specific skills.Section 5.3, Universal skill results
- Compliance includes choosing to click a link or provide information, or producing a draft reply judged unsafe. Rule-based scoring, finite samples, fixed model configurations and LLM realism judgments limit generalization.Section 4, Benchmark; Section 6, Limitations
- The evaluated families include GPT-5.4, Claude-Sonnet-5, Gemini-3.5-Flash and Kimi-K2.5. These include optimization targets and comparison agents; the four-of-nine headline concerns additional agents, not a shared failure rate for the linked model families.Sections 5.1–5.2, Experimental setup; Table 1
Findings that cite this record
No tracked finding cites this record yet.
Key questions this bears on
- Can prompt injection against AI agents be reliably defended?Not reliably. Bounding what untrusted input can trigger helps, but trust boundaries must survive delegation and tool execution.
Sources
Related records
Oct 13, 2026
Oct 20, 2026
Oct 4, 2026
Sep 29, 2026
Sep 28, 2026
Sep 26, 2026