The paper was submitted on October 22, 2026.
The benchmark tests whether agents both detect persuasive phishing messages and refuse malicious requests. Its PhishOpt method optimizes reusable email-generation skills for individual agents under fixed benchmark and realism constraints. The authors also analyze attacks using Cialdini persuasion principles and construct a universal generation skill.
Across nine agents, four had phishing-detection rates below 10% and malicious-request compliance above 45%. The paper reports that agents can handle pre-existing phishing emails safely while remaining susceptible to attacks adapted to their behavior. It does not establish the security of specific deployed email products, real-world attack prevalence, or whether any mitigation eliminates the reported failures.