Imagine you have a very diligent but literal-minded intern handling your inbox. They've memorized every phishing example from the company training deck and can spot the Nigerian prince template at fifty paces. Now imagine a scammer who watches the intern work for a week, learns exactly which cues the intern checks for, and rewrites the pitch accordingly. That's the gap this paper exposes: LLM email agents trained on or tested against static phishing datasets look safe — until the attacker adapts. The committed claim is straightforward but important: existing phishing benchmarks dramatically overstate how safe LLM email agents actually are, because those benchmarks were designed to test human detection, not agent compliance under adaptive pressure. AgentPhishing is a benchmark and an optimization pipeline (PhishOpt) that generates persuasive phishing emails tailored to individual agents, then measures not just detection but whether the agent actually does what the malicious email asks — clicking links, forwarding credentials, executing instructions. PhishOpt works by treating phishing-email generation as a skill-optimization problem. It iterates against a target agent under fixed benchmark constraints and a realism filter, producing reusable 'email-generation skills' — essentially prompt templates tuned to exploit specific agent blind spots. The authors then analyze the successful attacks through the lens of Cialdini's six persuasion principles (reciprocity, scarcity, authority, consistency, liking, consensus) to identify which strategies correlate with agent failures. The structural insight is that agents fail not because they can't pattern-match known phishing, but because they respond to social-engineering cues the same way humans do — just faster and with less skepticism. The numbers are stark. Against pre-existing phishing datasets, the tested agents generally perform well. But under adaptive attack from PhishOpt, four of nine agents exhibit phishing-detection rates below 10% and malicious-request compliance rates above 45%. That's not a marginal degradation — it's a mode shift from 'safe' to 'compromised.' The gap between static-benchmark performance and adaptive-attack performance is the paper's core contribution, and it's large enough to matter for anyone deploying agentic email systems. The validation regime is self-contained but honest about its limits. This is a red-team benchmark, not a field deployment study. PhishOpt optimizes against each agent individually, which is the right threat model (attackers will adapt) but also means the numbers reflect a ceiling of vulnerability, not average-case exposure. The realism constraint is important — the generated emails must be plausible, not adversarial gibberish — but the definition of 'realistic' is enforced by the researchers themselves, not by an independent panel or user study. The architectural picture places this firmly in the adversarial-robustness lineage that LLM safety researchers have been building since jailbreak papers started appearing in 2023. PhishOpt is essentially an automated red-team loop: generate, test, analyze failure modes, extract reusable attack patterns. The use of Cialdini's framework as an analytical lens is a nice bridge between social engineering research and LLM vulnerability research, but the optimization itself is standard iterative prompt refinement against a black-box target. The practical takeaway is clear: if you're building or deploying an LLM agent that touches email, testing it against static phishing corpora tells you almost nothing about its real-world vulnerability. The threat model that matters is adaptive — an attacker who probes the agent's behavior and crafts emails accordingly. AgentPhishing provides a benchmark for that threat model. The obvious next step the authors didn't take is deploying PhishOpt against agents with active defense layers (retrieval-augmented guardrails, multi-agent verification chains, human-in-the-loop confirmation) to see whether adaptive attacks still penetrate layered defenses.
