APEX-Harm: Evaluating Agent Safety in Shared Professional Workspaces

APEX-Harm. Evaluating Agent Safety in Shared Professional Workspaces. By Ziyi Yang and four others, from King Abdullah University of Science and Technology, the University of Oxford, and two other institutions. Published on the ninth of October. Its code repository is public but slight: one source file.

Professional agents increasingly work through command-line interfaces and many tools at once, over shared workspaces full of files, messages and business applications. Those environments create safety risks that are hard to capture with the usual setup, where an attack is planted at a single location the agent is known to read. In a large shared workspace, the malicious content could be in any of hundreds of places, and the agent may reach it at any point in a long task.

APEX-Harm evaluates two kinds of attack, prompt injection and script injection, against long-horizon agents doing finance, consulting and legal work. It scores three things: whether the attack succeeds, how exposed the agent was, and how well the agent performs the actual task. Keeping task performance in the picture is what lets the benchmark separate doing the job from doing it safely.

Each task comes with a large workspace: as few as one hundred and fifteen files, and as many as three hundred and twenty-eight. The agent also gets tools for email, calendar, chat, documents, spreadsheets, PDF files and code execution, all exposed through MCP servers.

There are six attack categories. They cover static and dynamic injections, replacement of a task-specific script, and generic scripts supplied by the attacker. Twelve frontier models are evaluated, each on one hundred and eighty task instances.

Opus 5 and Sonnet 5 have the lowest overall attack success rates: eight percent for the first, twenty percent for the second. Two kinds of attack stay much more effective. Replacing a task-specific script averages between eighty-one and eighty-four percent success. Generic scripts provided by the attacker average seventy-three percent.

Gemini 3.8 Flash achieves the highest mean task score, zero point eight seven seven. It still shows an attack success rate of thirty-three percent. The model best at the work is not the one best at resisting attack.

That last pairing is the benchmark's point in miniature. Finishing the requested task is not sufficient evidence of safe behaviour. An agent can hand back a correct deliverable and, in the same session, perform an unauthorized action in the workspace. Grading only the deliverable would miss the second half entirely.