Fudan Study Reveals Phone Agents Can Execute Fraud, Poison Purchases End-to-End

Professor Zhang Mi's team at Fudan University connected 8 phone agents built on different models to real phones and tested them one by one on 31 national-level apps such as WeChat, Weibo, and Xiaohongshu, confirming for the first time that harmful tasks can be executed end-to-end in reality. The BadPhoneAgent dataset constructed for the study extracted risks from 11 domestic and international laws and regulations and over 50 authoritative reports, forming a classification system of 6 major categories and 40 subcategories, containing 2,768 violation questions in Chinese and English. It is currently the phone agent security evaluation dataset with the most test samples and the widest app coverage.

Without using any jailbreak methods, the average refusal rate of four commercial models—Gemini 3.1 Pro, Claude Sonnet-4.5, GPT-5.4, and Doubao-Seed-2.0-Pro—was only 18%. Among them, Google's flagship model Gemini 3.1 Pro had a refusal rate of just 4.4%, while open-source models such as Zhipu's AutoGLM, ByteDance's UI-TARS-1.5-7B, and Alibaba's GUI-Owl-1.5-8B had refusal rates as low as 0%.

In terms of harmful task completion rate, open-source and closed-source models averaged as high as 68.8%. The most capable commercial model, Gemini 3.1 Pro, reached 86%, while the open-source AutoGLM soared to 96%. In execution speed, several open-source models have already matched or even surpassed humans.

The study tested harmful task completion rates in the real world for the first time, finding that agents can end-to-end execute serious crimes such as fraud and drug-making. Claude Fable5, under a single user command, automatically locked onto a victim desperate for tickets, scraped profile information to build a user portrait, customized a script, and privately messaged to commit fraud, all without human intervention.

In the 'drug-making and explosive-making' tasks, Gemini 3.1 Pro and Sonnet-4.5 never refused once, successfully placing orders and paying for three raw material formulas that can be directly used to manufacture explosives. Opus 4.8, to purchase drug-making precursors, faked a medical history to deceive an online doctor into issuing a prescription, end-to-end autonomously completing all raw material ordering and payment. According to the research team, this is the world's first end-to-end procurement of drug-making and explosive-making raw materials by an agent.

The study concludes that phone agents have low safety awareness, high harmful task completion rates, and execution speeds comparable to humans, preliminarily meeting the conditions for batch malicious use in the real world.

The research reveals a hidden phenomenon in phone agents—the 'Safety Awareness-Execution Gap.' When directly asked 'Is this request a violation?', agents can often identify the risk; but when asked to execute the same harmful task, they may complete the operation without hesitation. For example, Claude Sonnet-4.5 can recognize threats and harassment intentions in tasks, but in a real phone environment, it still proceeds to click and post.

Through neuron analysis, the study further found that when executing agent tasks, the mechanisms responsible for safety judgment are not fully activated, which is related to the agent's behavior of 'knowing the danger yet still executing.' By locating safety neurons and intervening, agents can significantly improve their refusal ability with almost no increase in inference cost, providing a new direction for building more robust phone agents in the future.