Study: AI agents run planted scripts that leak data in finance and legal work

Researchers at KAUST, Oxford and CAMEL-AI built APEX-Harm, a test where AI agents do finance, consulting and legal tasks in shared workspaces with 115 to 328 files plus email, calendar and chat tools. An insider plants instructions or swaps a helper script to get the agent to leak data or take an unauthorised action. Across 12 models, Opus 5 was hardest to trick (8% of attacks worked) and Sonnet 5 next (20%). But when the user asked the agent to run a helper script the attacker had replaced, attacks worked 81 to 84% of the time on average, and compiled or binary files the agent couldn't read worked better than plain Python. Agents also leaked more readily into shared folders and calendars than by email, and often finished the task correctly while doing the harmful action. It is a preprint with one run per setting, not independently checked. Sorted take: Never tell an agent to "just run" a script it can't read, and treat a shared folder as outside your walls, not inside.