National Institute of Information and Communications Technology (NICT)
AI Agent Email Testing Starts with Attacks
Before introducing AI agents into email operations, what is needed is not a demonstration of their convenience but testing that measures how badly they can be compromised by adversarial emails. The National Institute of Information and Communications Technology (NICT) and MITRE will hold a 24-hour competition in which agents that read and write email and connect to external tools are attacked in an isolated environment. If the agents can reject attacks and properly manage permissions and operation logs, accounting departments may be able to entrust them with sorting invoice emails.
If an AI only reads email, people can notice and stop mistakes. But when work is entrusted to an AI agent that reads email, searches internal data, and operates external services, malicious instructions in an email could make it perform actions it should not, or send information that should be protected outside the organization. Those introducing the technology will be giving the agent permissions without knowing what kinds of attacks will work or where existing safeguards will fail.
The Difference Between AI That Generates and AI That Acts
Conventional generative AI created text and other content in response to users’ instructions. AI agents execute tasks across email, internal data, and external services. A wrong decision could directly lead to an information leak or unauthorized operation.
Email is a difficult entry point. Because text and attachments arrive from outside, it is easy for untrusted instructions to get mixed in. Checking only whether the functions work is not enough to measure safety. It is necessary to test what happens when an attacker combines inputs, permissions, and connections to external tools.
Gathering Attacks in an Isolated Environment
The National Institute of Information and Communications Technology (NICT) and MITRE are launching a competition called “AI Breach Challenge,” which will attack AI agents responsible for email operations. The first event, “AI Breach Challenge 2026: Email Agent Security,” is scheduled to take place in Arlington, Virginia, United States, from December 16 to 17, 2026. The competition will run for 24 hours.
Participants will challenge agents that read and write email and connect to related tools in an isolated, controlled environment prepared by the organizers. Across multiple specified tasks, they will test attack techniques that cause unintended behavior or attempt to gain access to protected information.
The goal is not only to find examples of successful attacks. NICT and MITRE plan to investigate weaknesses and failure patterns that arise when tools and information are connected, as well as when defensive measures work and where their limits lie, and to use the findings in evaluation and defense technologies. Gathering attackers’ ideas under the same conditions will make it easier to reproduce and compare weaknesses. NICT established the AI Security Research Center CREATE in February 2025 and plans to continue holding competitions for other uses in the future.
Work That Could Be Entrusted to the Accounting Department
If this effort continues and produces reproducible attack patterns and testing methods, AI agents will no longer be treated as software that merely generates text. Instead, they will be systems with permissions that must have their safety tested before being introduced as business systems. Evaluations that use plausible responses alone as evidence of safety, and practices in which people check email instructions, attachments, and processing results every time, will become increasingly difficult to sustain.
In an accounting department, rather than transcribing invoice emails one by one, staff could approve only the candidates sorted according to internal rules by a tested agent. Such a scene can be envisioned only if the agent rejects instructions in malicious emails and properly manages permissions and operation logs. If discovered weaknesses cannot be reflected in product or organizational settings, only knowledge of attacks will grow ahead of the defenses.