Research question
How should the security of tool-using agents be evaluated dynamically?
Key findings
- 97 realistic tasks and 629 security test cases across email, banking, travel and Slack environments - Best agents solved under 66% of tasks; injection attacks succeed on under 25% but defences trade utility