Telecommunication service systems are widely used to support subscriber-facing operations such as account management, billing, outage handling, order fulfillment, technician scheduling, and customer support. Modern telecom platforms increasingly integrate AI agents to automate tasks including customer lookup, support-ticket handling, plan and order updates, service notifications, appointment coordination, and forum-based assistance.

These agents typically operate with access to highly sensitive subscriber data (e.g., phone numbers, service addresses, billing records, device and line information) and can execute high-impact operational actions (e.g., modifying accounts, issuing credits or refunds, changing service configurations, scheduling technician visits, or sending customer-facing communications). Because these systems sit at the intersection of customer support, financial workflows, and operational service management, failures in security enforcement can expose organizations to severe risks including privacy violations, fraud, account takeover, billing manipulation, operational disruption, and regulatory non-compliance.

We first design a comprehensive set of benign tasks for telecom service agents, covering 11 representative categories commonly encountered in real-world customer service workflows. Based on carrier privacy and service policies, as well as broader telecom security and compliance frameworks including 3GPP, O-RAN, NIST, and FCC guidance, we derive a set of 8 key security risk categories, instantiated into 11 concrete evaluation labels. Guided by these risks, we construct red-teaming tasks with malicious goals under two primary threat models to systematically evaluate the security robustness of telecom agents.