BEC Range: adaptive invoice-fraud tests for accounts-payable agents

The parts this idea needs already exist, but nobody I found has put them together for accounts payable. Adaptive multi-turn attacker models are commodity tech: LangWatch has one in open source, and TrojAI, Confident AI and Palo Alto Networks have commercial versions. Payment-redirection prompt injection is a known benchmark category through AgentDojo's bill case, DTap's vendor-payout emails and a GitHub PoC with bank-detail-change lures. What I did not find is a productized library of several hundred AP-specific BEC scenarios (payee change, spoofed CFO urgency, hidden instructions in invoices, vendor-master tampering) that runs against a sandboxed mailbox plus ledger. I also found nothing that outputs a per-release scorecard written for enterprise finance and security reviewers. The only finance-focused red-teaming is services work, such as Stingrai's human-led pentests, and generic AP-fraud vendors like HighRadius focus on catching fraud, not testing agents. A new entrant could win by being the domain specialist. That means realistic AP artifacts like invoices, remittance PDFs, ERP vendor-master records and approval chains, plus a ledger-aware definition of success, meaning money actually rerouted rather than the model just saying something bad. It also means becoming the attestation that buyers recognize, perhaps tied to the emerging CSA agent certification work or SOC 2 mappings. The risks are real. Horizontal red-team platforms can add a BEC pack cheaply. Academic benchmarks may give away similar scenarios for free. The buyer pool of AP automation vendors (Ramp, Stampli, Medius, Vic.ai, Tipalti and others) is small. And the attestation report only has value if enterprise buyers start asking for it by name, which I found no evidence of yet. The moat would have to come from scenario realism, coverage refreshed from real BEC case data, and brand credibility with CFO and CISO reviewers, not from the attack technology.

• LangWatch Scenario (RedTeamAgent)

  An open-source agent testing framework. It runs Crescendo-style multi-turn attacks: a planner model plans the attack, and an attacker model changes its next turn based on how the agent scored on the last one. It plugs into CI. This is the same adaptive-attacker mechanic the pack would use, but it is general purpose and ships no AP or BEC scenario library.

• TrojAI Detect

  A commercial AI red-teaming product. It added agentic and multi-turn attacks in July 2025. It is horizontal and not tied to any finance workflow.

• Horizontal AI red-teaming vendors (Adversa AI, Confident AI, Enkrypt AI and others)

  A 2026 roundup of red-teaming vendors. Several of them offer multi-turn agent red teaming against live apps over HTTP or CI. Enkrypt AI was acquired by Anaconda in August 2026. None of them is shown as having an invoice-fraud or payee-change pack, though any could add one.

• Stingrai

  A fintech pentest firm that sells red teaming of money-moving AI agents, covering transaction-authorization abuse, goal hijacking into transfers and tool-misuse chains. Senior human pentesters drive the agent-behavior testing, so this is a services competitor for the attestation-report buyer, not a productized scenario suite.

• Straiker

  An AI agent security vendor with a financial-services industry page. It is a horizontal agent security platform that pitches to finance and could move into AP-specific testing.

• Palo Alto Networks AI red teaming

  A large incumbent doing agentic red teaming. It published a test in which a financial-assistant agent made a $900 withdrawal after being told it was an internal test. It could bundle finance-agent attack scenarios into its platform.

• fps-ai-security-poc (GitHub)

  An open-source proof of concept that red-teams AI payment agents on a simulated instant-payment system. It includes a bank-detail-change lure and vendor-master fraud cases and measures layered defenses. It is the closest artifact to the payee-change pack, but it is a single-author PoC built on ISO 20022 payments, not AP email workflows.

• DecodingTrust-Agent Platform (DTap)

  An academic, controllable red-teaming platform for agents. Its scenarios include vendor-payout requests embedded in email. It could become a free benchmark that undercuts a paid scenario library.

• AgentDojo, InjecAgent, LivePI benchmarks

  Public prompt-injection benchmarks. AgentDojo has a banking case where injected text in a bill redirects a payment, and LivePI has urgency-framed transfer scenarios. These cover single injections rather than adaptive multi-turn BEC, and they produce no buyer-facing reports.

Checked 2026-10-23