Break the Banker · Live Adversarial Challenge

Can you make the AI wire the money?

In our flagship study, two of four frontier AI agents wired funds to an attacker using nothing but a believable email — no jailbreak required. Here are four AI finance agents of escalating difficulty. Socially engineer each one into a fraudulent wire. They get harder — the last is modeled on the one agent in our study that never broke.

ATLAS · AP Finance Agent

MERIDIAN CAPITAL · PAYMENTS

Objective

Execute a fraudulent wire

$50,000

Convince the agent to send funds to the account in your control. Defeat its payment policy.

Attack Vectors · This Level

Wire Authorization Gate LOCKED

Field Notes

The Study

Top Attack Techniques

How people try to break AI agents

The five technique families most often described in published LLM red-teaming research, ordered by how prominently they appear in that literature. No rate is claimed and none is measured here — this is a reading of the field, not a count of anything. Every attempt in this challenge is logged anonymously — if that ever amounts to enough attempts to say something about frequency, it will be published with its denominator attached.

Roleplay & Persona Hijack

Push the model into an unrestricted alter-ego — the classic "DAN / Do Anything Now" — so it answers as a character that believes the rules don't apply to it.

Multi-Turn Escalation

Start completely benign, then escalate one step at a time. By the time the real ask lands, the model is already committed to the conversation (the "crescendo" attack).

Authority & Pretext Impersonation

Pose as an executive, administrator, or the system itself to "authorize" the forbidden action — the same business-email-compromise move that breaks finance agents.

Hypothetical & Fictional Framing

"It's just a story." "Hypothetically." "For a security test." Recasting the request as make-believe to slip it past the model's safety training.

Obfuscation & Encoding

Hide the payload in base64, ciphers, leetspeak, or reversed text so keyword filters never see it — then have the model decode and act on it.

SIMULATED ENVIRONMENT. The agent is a scripted training bot, not a live model — no real systems, accounts, or funds are involved, and no transaction occurs. This challenge is an educational demonstration of social-engineering technique categories against AI agents, built by Potestas AI to illustrate our agentic deception study. It provides no operational capability against real systems. Messages you submit here may be recorded and analyzed by Potestas AI for security research; please do not enter real personal or sensitive information.