Letting the user act on the environment raises attack success from 26.9% to 41.1%.

DUMA-Bench extends tau²-bench with adversarial environments covering eight vulnerability classes including RAG poisoning, cross-agent manipulation and unsafe output handling, and argues most agent security evaluation assumes a passive user with static control. Under dual control, where agent and user both change shared environment state, attack success across 14 models from five families over eight domains climbs 14 points. Agent security is a property of the interaction loop, not of the model you picked. (arXiv 2609.24662)