Workflow agents are increasingly used to automate productivity and operational tasks across a wide range of digital platforms, including Gmail, Google Calendar, Google Forms, Google Docs, Slack, WhatsApp, Zoom, Databricks, Snowflake, Atlassian, and PayPal. These agents support common workplace functions such as email and messaging management, scheduling, document handling, task coordination, notification routing, structured data transfer, and routine content generation, often operating across multiple interconnected environments within a single workflow.

To construct realistic workflow tasks, we build the benchmark on sandbox environments that simulate real-world applications with highly similar user interfaces, functionally complete operations, and flexible data customization. This design allows us to preserve the structure and interaction patterns of real workflow systems while enabling controlled initialization of environment states, convenient customization of task data, and systematic construction of benign and adversarial scenarios.

Because workflow agents routinely process untrusted external content (e.g., emails, documents, forms, chat messages, tickets, and system outputs) while also interacting with sensitive data and action-taking tools, they expose a broad and realistic attack surface. In practice, these agents may read private messages, handle internal documents, query structured databases, update project systems, trigger notifications, or even initiate payment-related actions. When security enforcement is weak or inconsistent across connected environments, attackers may manipulate the agent into performing harmful actions such as phishing, spam dissemination, sensitive data leakage, destructive file operations, fraudulent payment requests, or deceptive cross-platform notifications. Such failures can lead to privacy violations, financial loss, operational disruption, legal exposure, and reputational damage.

To systematically study this domain, we design a benchmark that covers a diverse set of workflow environments and 5 aggregated benign task categories drawn from real-world automation scenarios. We further derive 9 key security risk categories from platform-specific policy documents across these environments, covering harms such as Financial Fraud, Unsafe Content, Data Exfiltration, Copyright / IP Infringement, Illegal Activity, Messaging Abuse, Misinformation, Sensitive File Deletion, and Bot Attack. Guided by these risks, we construct red-teaming tasks under two primary threat models, namely direct malicious prompting and indirect prompt injection through external workflow content, to systematically evaluate the security robustness of workflow agents.