Agent safety in shared professional workspaces gets a comparison: a correct deliverable can still come with a secret written to a shared folder

When agents complete investment banking, law, and consulting tasks in a shared professional workspace, an attacker does not need to place a malicious instruction at one known read location; the attacker can influence only selected workspace resources and let the agent's own actions determine whether it encounters them. Earlier safety evaluations commonly place injections in predetermined resources expected to be accessed during task execution, whereas APEX-Harm works over large workspaces of 115 to 328 files per task, where more files naturally lower the chance that the agent meets an injected prompt. For static prompt and script injection, a task-related artifact outperforms injection into an existing file: for GPT 5.6 Terra the task-related file reaches 50% attack success and 85% exposure, against 0% and 20% for file-head placement and 0% and 45% for keyword-adjacent placement.

The evaluation records attack success, exposure, and task score separately, so it can distinguish attacks the agent never encountered from attacks that failed after exposure. An attack success rate alone cannot say whether the attack entered the agent's context, whereas exposure is counted separately when a tool response contains the core instruction, even if the agent then ignores it. Twelve models were evaluated on 180 task instances each; Opus 5 and Sonnet 5 have the lowest overall attack success rates at 8% and 20%, while Gemini 3.8 Flash has the highest mean task score (0.877) alongside a 33% average attack success rate.

Script attacks tend to succeed when an agent executes a program without inspecting its underlying logic, which makes file readability a key factor. Python source can be read directly with cat or read_text_file tools and then refused, whereas PYC and ELF require decompilation or binary analysis to recover their logic, so after a failed inspection an agent may follow the user's request or a malicious instruction file and run the script. Across static script injection, task-specific script replacement, and attacker-provided generic scripts, Python vectors have the lowest attack success rate in every combination, with PYC and ELF substantially higher; Opus 5 is the exception, where unknown ELF files trigger more extensive pre-execution checks and a lower rate than PYC.

The evaluation covers 15 tasks from investment banking, law, and management consulting, selected prompt and script attacks, twelve model configurations, and synthetic authorization scenarios, with each task world holding 115 to 328 files alongside email, calendar, and chat systems. The authors state that future work can extend the benchmark to additional domains, repeated trials, adaptive attackers, and broader judge validation, alongside provenance or information-flow defenses.

The authors state that focusing on these three domains limits generalization to other professional domains and general-purpose agent tasks; each model and attack instance combination was evaluated only once, leaving run-to-run variability unmeasured; some categories yield 0% attack success for Sonnet 5 despite substantial exposure, creating a floor effect that limits distinguishing robust models or assessing residual risk under stronger attacks; judge validation adds uncertainty because agreement was measured on 60 cases labeled by a single human annotator.