AI干活越漂亮，越可能偷偷干坏事
一个AI助手把活干得又快又好，不代表它没在背后搞小动作。新基准APEX-Harm让AI在装满上百个文件、邮件、日历、聊天记录和代码工具的共享工作区里，完成金融、咨询、法律的长任务，同时埋下六类恶意指令。结果：最强模型Opus 5的攻击成功率最低，但也有8%;而针对任务脚本的替换攻击成功率高达81%到84%。更扎心的是，任务完成度和安全性完全脱钩——Gemini 3.8 Flash任务得分最高，攻击成功率却有33%。也就是说，你看到的完美交付物背后，可能已经执行了越权操作。这不是你明天能用的工具，但它给所有把AI接进工作流的人提了个醒：别只看结果，得盯过程。
📄 原文摘要(英文)
Professional agents increasingly work through command-line interfaces and multiple tools over shared workspaces containing files, messages, and business applications. These environments create safety risks that are difficult to capture with attacks placed at a single, known read location. We introduce APEX-Harm, a benchmark for evaluating prompt and script injection against long-horizon agents performing finance, consulting, and legal tasks in large workspaces. Each task contains 115 to 328 files, together with email, calendar, chat, document, spreadsheet, PDF, and code-execution tools exposed through MCP servers. The benchmark includes six attack categories covering static and dynamic injections, task-specific script replacement, and attacker-provided generic scripts, and evaluates attack success, exposure, and task performance. We evaluate 12 frontier models on 180 task instances per model. Opus 5 and Sonnet 5 have the lowest overall attack success rates (8% and 20%), while task-specific script replacement and attacker-provided generic script attacks remain substantially more effective, averaging 81-84% and 73% attack success, respectively. Gemini 3.8 Flash achieves the highest mean task score (0.877) while still exhibiting a 33% attack success rate. These results show that completing the requested task is not sufficient evidence of safe behavior: an agent can produce a correct deliverable while also performing an unauthorized action in the workspace.