摘要：对话式 Agent 如今可代表终端用户通过工具执行操作，同时还能够访问客户数据库和内部政策文档；来电者仅通过对话便可触及这些资源。银行业是最清晰的案例：同一个 Agent 既能回答问题，也能修改联系方式、重置 PIN 或转移资金，因此，普通客户服务与授权、欺诈检测和政策合规密不可分。现有金融欺诈基准主要对静态交易或消息进行分类，而通用 Agent 安全基准则侧重于提示注入或一般性有害使用；它们均未测试受政策约束的银行 Agent 在来电者通过多轮对话操纵身份、授权和信任时，能否安全地采取行动。我们提出 FraudBench，这是一个基于 $\tau^2$-bench 双控制框架和 $\tau$-Knowledge 银行业环境构建的可执行基准。Agent 和模拟来电者都会通过工具对共享且可变的账户状态进行操作，Agent 还可以向来电者授予对特定工具的访问权限；该环境提供了一个包含 698 份文档的内部政策语料库，Agent 必须从中检索信息。FraudBench 包含 150 个人工设计的对抗场景；所有报告实验均使用一组冻结的公开测试集，共计 107 个场景（其中 90 个覆盖十类欺诈机制，另有 17 个为链式自适应攻击），此外还有 43 个链式攻击被保留作为未公开测试。其安全性依赖于历史上下文：单控制任务满足除一个以外的所有前提条件，而自适应攻击会因先前的试探、准入或失败尝试，使后续一个在局部看来有效的请求变得不安全。每个场景都标注了可观察证据、禁止操作、安全处置方式和干预点。对 107 个评分任务中四个 Agent 进行的初步单次试验评估显示，其攻击安全率介于 49% 至 65% 之间，其中资金骡子和第一方欺诈是跨模型最常见的薄弱环节。

Abstract:Conversational agents now act for end users through tools while holding access to customer databases and internal policy documents that a caller can reach through dialogue alone. Banking is the clearest case: the same agent that answers a question can also change contact details, reset a PIN, or move money, so ordinary customer service is inseparable from authorization, fraud detection, and policy compliance. Existing financial-fraud benchmarks classify static transactions or messages, and general agent-safety benchmarks target prompt injection or generic harmful use; none test whether a policy-grounded banking agent safely acts when a caller manipulates identity, authorization, and trust over a conversation. We introduce FraudBench, an executable benchmark built on the $\tau^2$-bench dual-control framework and the $\tau$-Knowledge banking environment. Both the agent and the simulated caller act through tools over shared, mutable account state, and the agent may grant the caller access to selected tools; the environment exposes a 698-document internal policy corpus that the agent must retrieve from. FraudBench contains 150 authored adversarial scenarios; a frozen public set of 107 (90 across ten fraud mechanisms plus 17 chained adaptive attacks) is used for all reported runs, with 43 further chained attacks held out. Safety is history-dependent: single-control tasks satisfy every precondition but one, and adaptive attacks make a later, locally valid request unsafe because of an earlier probe, admission, or failed attempt. Each scenario is annotated with observable evidence, prohibited actions, safe dispositions, and intervention points. A preliminary single-trial evaluation of four agents on the 107 graded tasks yields attack-security between 49% and 65%, with money-mule and first-party fraud the most common cross-model weaknesses.