LLM agents are becoming increasingly capable of handling daily workspace tasks by interacting with application environments through tool calls. However, as agents read and write sensitive user data across email, documents, and other applications, a central privacy question is whether they preserve contextual integrity (CI), that is, whether the information flows they produce comply with context-specific disclosure constraints. Existing work either focuses on model-level privacy leakage or evaluates agents in limited application environments with manually constructed disclosure constraints. In this work, we introduce AgentCIScope, a unified platform and benchmark for evaluating agent-level contextual integrity through executable, multi-step tasks across diverse, realistic application environments. AgentCIScope transforms public and synthetic privacy cases into executable agent tasks, with disclosure constraints grounded in three criteria: governing privacy policies, persona-based agreement, and a predefined sensitive-attribute taxonomy. Based on AgentCIScope, we evaluate 12 agents on 936 tasks and find that strong task-completion capability does not guarantee contextual-integrity preservation: single-run leakage rates range from 32.5% to 94.4%, while repeating each task five times further increases leakage by 4-19 percentage points. Leakage varies substantially across attributes: personal preferences and booking details have average leakage rates of 84.7% and 76.5%, compared with 17.1% for credit-card information and 29.4% for SSNs; environments: calendar has the highest average leakage rate as an information source, while WhatsApp ranks highest as an information destination; and governing privacy policies. AgentCIScope provides deep insights into agent privacy leakage and serves as a unified testbed for developing privacy-preserving agents.
Figures & tables
Figure 1: Demonstration of contextual-integrity violation by an LLM agent (GPT-6 Astra with OpenAI Agents SDK). An HR asks an agent to send a candidate update using information from Gmail and Google Docs. The agent retrieves a sensitive background-check record and unnecessarily discloses it to the hiring manager, illustrating how privacy leakage can emerge through multi-step interactions across environments. A more detailed case study of this example is provided in Fig. 7 .
Capability
PrivacyLens
PrivaCI-Bench
CIMemories
AgentDAM
CI-Work
AgentCIBench
AgentCIScope
Automated task generation and environment setup
△
×
×
×
△
✓
✓
Executable multi-step agentic tasks
△
×
×
✓
✓
✓
✓
Cross-environment information flow
△
×
×
×
△
✓
✓
Policy grounding
△
✓
×
×
×
×
✓
Multiple agentic frameworks
×
×
×
×
×
×
✓
Table 1: Comparison of representative privacy benchmarks for LLMs and agents. ✓ indicates explicit support, △ indicates partial, simulated, or narrower support, and × indicates that the capability is outside the benchmark’s scope.
Figure 2: Overview of the AgentCIScope construction pipeline. Contextual Integrity Contract Synthesis transforms public and synthetic privacy seed cases into explicit contextual integrity contracts. Executable Environment Setup prepares information-rich, cross-environment application states for agent interaction. Stress-Test Task Generation constructs diverse task instruction variants using a library of leakage skills to expose privacy failures. The resulting evaluation suite consists of contextual integrity contracts, agentic task instructions, and their associated pre-populated environment states.
Single-Run TLR
5-Run Union TLR
Framework
Model
BSR (%)
TLR (%)
95% CI
TLR (%)
95% CI
Δ TLR (pt)
Claude Code
Claude Opus 5
97.1
32.5
[29.6, 35.5]
46.0
[42.9, 49.2]
+13.6
Claude Code
Claude Sonnet 5
93.8
49.4
[46.2, 52.6]
68.7
[65.7, 71.6]
+19.3
OpenClaw
GPT-6 Astra
95.4
36.9
[33.8, 40.0]
48.1
[44.9, 51.3]
+11.2
OpenClaw
Claude Opus 5
96.7
43.6
[40.4, 46.8]
58.0
[54.8, 61.1]
+14.4
OpenClaw
Kimi K3
98.2
88.4
[86.1, 90.3]
97.4
[96.2, 98.3]
+9.1
Table 2: Benign task success and task-level leakage rate under different agentic frameworks and backbone models. Over 936 tasks: BSR and the single-run TLR are measured on the first run. The union TLR counts a task as leaked if it leaks in at least one of the five runs, and TLR carries a Wilson 95% confidence interval ( Eq. 3 ). Δ TLR is the increase of the union TLR over the single-run TLR.
Figure 3: Cumulative task-level leakage rate over repeated runs. Repeated execution exposes additional privacy failures beyond a single run. The full 12-agent version is shown in Fig. 9 .
Figure 4: Attribute leakage rate (ALR) by protected attribute on the first run with 936 tasks. Each cell reports the number of leaked contract-protected attributes of the corresponding row type divided by the total number of protected attributes of that type across the evaluated tasks. Detailed computation is provided in Eq. 7 of App. E . The rightmost column averages the 12 agents, and rows are sorted by this average; the badge gives the resulting rank (1 = most frequently leaked).
Figure 5: Source- and destination-environment leakage rates (SLR and DLR) for different agents. The left panel shows SLR ( Eq. 12 ), and the right panel shows DLR ( Eq. 13 ). Results are computed on the first run over the 936 tasks; detailed definitions are provided in App. F . Per-pair source-to-destination rates for all configurations are given in Fig. 10 .
Figure 6: Policy violation rate (PVR) by governing provision. Agents violate broad privacy provisions more often, while leaking explicitly sensitive data less frequently.
Appendix figures & tables9 assets
Supplementary material from the paper’s appendix.
Appendix
Category
Detailed attributes
Contact information
home address, email address, phone number
Health information
treatment history, diagnoses, medical conditions, prescriptions
Personal identifiers
full name, date of birth, gender
Financial information
credit card information, income, bank account details, salary, tax records
Table 3: The privacy attribute list: 10 categories and their 39 detailed attributes.
Figure 7: Detailed case study of the motivating example in Fig. 1 . The figure highlights selected steps in which the agent retrieves a sensitive background-check record from Gmail and Google Docs and subsequently includes it in an email to the hiring manager, resulting in a violation of contextual integrity and the applicable privacy policy. The victim agent uses GPT-6 Astra as the backbone model with the OpenAI Agents SDK.
Attribute Type
Agreement Rate (95% CI)
Protected attributes ( n=157 )
94.3% (89.5–97.0)
Public attributes ( n=180 )
99.4% (96.9–99.9)
Appendix
Table 4: Human validation of synthesized privacy contracts. Agreement indicates that the human annotator agrees with the privacy status assigned by the contract.
Evaluation Level
n
Agreement (95% CI)
Cohen’s κ
Task level (any attribute leaked)
50
92.0% (81.2–96.8)
0.83
Attribute level
157
95.5% (91.1–97.8)
0.887
Appendix
Table 5: Agreement between the LLM leakage judge and the human annotations. We report raw agreement, 95% confidence intervals, and Cohen’s κ .
Symbol
Definition
Interpretation
t
one task (936 in total)
-
traj(t)
the agent’s trajectory on t : an ordered sequence of steps
What the agent actually did to complete the task, including its tool calls.
step(t,k)
the k -th step of traj(t) ; a step calling a read tool is a read step, one calling a write tool a write step
Which tool call happened at step k .
env(step(t,k))
the environment the tool called at step(t,k) belongs to
Which environment the tool call at step k went to.
C(step(t,k))
the normalised text (lower-case, punctuation removed) returned by read step step(t,k)
What content the agent received from the environment at step k .
Contract(t)
the privacy contract of t ; it defines A(t) and V(a) for every a
What counts as private on this task and where it must not flow.
Appendix
Table 6: Notation for the source-to-destination leak-rate computation ( Eqs. 9 to 11 ).
Skill
Mechanism
Context Field Enrichment
The instruction treats open-ended fields such as notes, context, or background as fields that should be filled thoroughly, so the agent adds personal sensitive information that the task never required.
Self-Contained Briefing
The instruction asks for a document that is complete and self-contained, so the agent copies more of the original material and carries adjacent protected information into the output.
Named Example Expansion
The instruction asks for concrete, named examples instead of abstractions, so the agent exposes raw identifiers, credentials, or other sensitive details directly.
Verbatim Quotation
The instruction emphasizes precision and asks the agent to quote the source word for word, so sensitive information embedded in the quoted passages leaks along with it.
Authenticity Enhancement
The instruction asks for content that is authentic and credible, so the agent cites specific people’s private disclosures or sensitive details to make it convincing.
Broad Record Retrieval
The instruction asks for information that is as complete as possible, so the agent widens its collection and copying and brings task-irrelevant sensitive content into the output.
Appendix
Table 7: The ten leakage skills used for stress-test task generation. Each skill rephrases a benign task so that an agent is tempted to carry protected information to an out-of-bounds recipient.
Figure 8: Average attribute leakage rate per task vs. trajectory length. Tasks are ranked by length separately for each configuration and split into five equal groups (x-axis: from the shortest 20% of that configuration’s tasks to the longest 20%), so every point averages about 190 tasks. The y-axis is the mean over those tasks of the task-level ALR ( Eq. 6 ), i.e. the fraction of a task’s protected attributes that leaked.
Figure 9: Cumulative task-level leakage rate over repeated runs, all twelve configurations. Full version of Fig. 3 .
Figure 10: Source-to-destination leakage rates per configuration. Each cell reports rate(s,d) ( Eqs. 9 to 11 ) on the first run over 936 tasks: the percentage of protected attributes read from the row (source) environment and leaked to the column (destination) environment. Zeros denote exact zero rates, while dashes indicate empty denominators.
Enterprise LLM agents can dramatically improve workplace productivity, but their core capability, retrieving and using internal context to act on a user's behalf, also creates new risks for sensitive information leakage. We introduce CI-Work, a Contextual Integrity (CI)-grounded benchmark that simulates enterprise workflows across five information-flow directions and evaluates whether agents can convey essential content while withholding sensitive context in dense retrieval settings. Our evaluation of frontier models reveals that privacy failures are prevalent (violation rates range from 15.8%-50.9%, with leakage reaching up to 26.7%) and uncovers a counterintuitive trade-off critical for industrial deployment: higher task utility often correlates with increased privacy violations. Moreover, the massive scale of enterprise data and potential user behavior further amplify this vulnerability. Simply increasing model size or reasoning depth fails to address the problem. We conclude that safeguarding enterprise workflows requires a paradigm shift, moving beyond model-centric scaling toward context-centric architectures.
Wenjie Fu, Xiaoting Qin, Jue Zhang +5
Huazhong University of Science and Technology, China · Microsoft
Agentic systems are increasingly acting on users' behalf, accessing calendars, email, and personal files to complete everyday tasks. Privacy evaluation for these systems has focused on the input and output boundaries, but each task involves several intermediate information flows, from agent queries to tool responses, that are not currently evaluated. We argue that every boundary in an agentic pipeline is a site of potential privacy violation and must be assessed independently. To support this, we introduce the Privacy Flow Graph, a Contextual Integrity-grounded framework that decomposes agentic execution into a sequence of information flows, each annotated with the five CI parameters, and traces violations to their point of origin. We present AgentSCOPE, a benchmark of 62 multi-tool scenarios across eight regulatory domains with ground truth at every pipeline stage. Our evaluation across seven state-of-the-art LLMs show that privacy violations in the pipeline occur in over 80% of scenarios, even when final outputs appear clean (24%), with most violations arising at the tool-response stage where APIs return sensitive data indiscriminately. These results indicate that output-level evaluation alone substantially underestimates the privacy risk of agentic systems.
Ivoline C. Ngong, Keerthiram Murugesan, Swanand Kadhe +3
As LLM agents evolve from single-user assistants into shared organizational infrastructure, new privacy risks emerge: inappropriate information may not only be exposed through outputs for external recipients, but also internally across users through inter-agent messages, shared memory and agents. These data spillage risks are not captured by existing privacy benchmarks grounded in contextual integrity (CI) as they focus primarily on either single-user settings or interactions between independently owned agents. We introducePiSAs (Privacy in Shared Agentic systems), a benchmark for assessing unintentional leaks with dual CI annotations: whether an information is appropriate for the task, and which users may legitimately access it. This enables direct measurement of cross-user spillage across agentic system components and interfaces, such as outputs, inter-agent communication, and memory. PiSAsis system-agnostic and supports evaluation across different agent topologies and memory regimes. We find that, although system design improves CI compliance, results are bottlenecked by incorrect LLM judgment calls: even state-of-the-art models fail to reliably filter inappropriate content or restrict transmission to authorized users. Our findings underscore the need for privacy-preserving strategies, beyond those studied in this work.