Financial services represent one of the highest-stakes domains for AI agent deployment. Modern brokerage and wealth management platforms increasingly rely on AI-powered assistants to automate workflows spanning market research and analysis (fundamental research, portfolio monitoring, options analysis, risk assessment, client reporting) and trading operations (order execution, payment processing, multi-account management, client communications). These agents operate with access to highly sensitive data---portfolio holdings, account balances, client financial records---and can execute consequential, often irreversible actions: buying or selling securities, trading options, initiating fund transfers, and sending investment recommendations to clients.

The combination of real-time market data, multi-account management, and cross-platform integrations (email, messaging, payment systems) creates a broad attack surface. An adversary---whether a third-party attacker injecting malicious content into the agent's environment or a malicious user directly issuing instructions---can manipulate an agent into executing unauthorized trades, exfiltrating sensitive portfolio data, sending fraudulent communications to clients, or carrying out illegal financial schemes. The consequences include direct financial loss, regulatory violations (SEC, FINRA), legal liability, and reputational damage, compounded by the fact that most financial actions are irreversible once settled.

We design a comprehensive evaluation framework consisting of 600 tasks: 200 benign tasks across 15 categories of real-world financial workflows, 200 direct-threat tasks across 20 risk categories (malicious user), and 200 indirect-threat tasks across 13 risk categories (benign user, malicious environment). Risk categories are grounded in enforceable securities regulations from the SEC, FINRA, the Dodd-Frank Act, the Bank Secrecy Act, and the EU AI Act.