VQV Signal
According to a post on X by @philiptorr, his group at Oxford and SoftServe released the TRAP benchmark. It hid instructions using Cialdini's persuasion tactics, such as fake admin notices and claims that "others already did this," inside realistic web pages. Across six models, about 25% of attempts worked. Attacks that fooled GPT-5, the hardest target at 13%, fooled weaker models 81–90% of the time.
According to a post on X by @philiptorr, his group at Oxford and SoftServe released the TRAP benchmark. It hid instructions using Cialdini's persuasion tactics, such as fake admin notices and claims that "others already did this," inside realistic web pages. Across six models, about 25% of attempts worked. Attacks that fooled GPT-5, the hardest target at 13%, fooled weaker models 81–90% of the time.
AI-assisted summary based on the listed source.
Oxford's @philiptorr shared the TRAP benchmark from his group and SoftServe, which hid instructions using Cialdini's persuasion tactics (fake admin notices, "others already did this") in realistic web pages. Across six models about 25% of attempts worked, and attacks that fooled GPT-5, the hardest target at 13%,...
Teams building AI agents that browse the web or act on pages may need to test for social-engineering-style prompt injection, not just obvious hidden commands. The post suggests the hardest model was not immune and that results can transfer to weaker models. Watch for the full TRAP paper and any published details on the fake-button results, which the snippet cuts off.
Security-conscious readers may want to review the source and watch for practical exposure or mitigation details.
VQV organizes public signals from inspectable sources. It does not independently verify the underlying report.
Signal Strength reflects source quality, relevance, freshness and evidence. Public Interest helps organize discovery; it is not proof of truth.
VQV surfaced this signal because it is recent, relevant to AI Security, connected to Scobleizer News Pulse (X).
No login, cookies, social SDKs, or automatic posting.
