CredLeakBench: Evaluating Credential Leakage and Recovery in LLM Agents
To study this problem, we first propose CredLeak-Bench, a comprehensive benchmark designed to evaluate how effectively and securely agents automate human workflows when confronted with phishing and identity verification.
ProofPaper ↗
Key points
- Language model agents are increasingly deployed to automate everyday digital chores from managing emails and social media to handling banking and bills allowing users to step away from supervision.
- Within a sandboxed environment, leakage is measured through actual submissions of information rather than agents' self-reported behavior.
- Agents also disclose sensitive information during autonomous inbox monitoring, demonstrating that phishing can induce disclosure without a user request to authenticate.
- These findings show why reducing leakage alone is insufficient: effective defenses must prevent unauthorized disclosure while preserving legitimate task completion.
Sources (1)
- [1]CredLeakBench: Evaluating Credential Leakage and Recovery in LLM AgentsarXiv (AI, ML, NLP, CV, robotics, multi-agent) · Oct 6, 05:07 AM
To study this problem, we first propose CredLeak-Bench, a comprehensive benchmark designed to evaluate how effectively and securely agents automate human workflows when confronted with phishing and identity verification.
Language model agents are increasingly deployed to automate everyday digital chores from managing emails and social media to handling banking and bills allowing users to step away from supervision.
Extractive summary: sentences quoted from the sources.