cs.AIOct 13, 2026
SaveAgentCIScope: Grounded Contextual Integrity Evaluation for LLM Agents
Organizations: University of Chicago · Microsoft Research · University of Illinois Urbana-Champaign
Abstract
LLM agents are becoming increasingly capable of handling daily workspace tasks by interacting with application environments through tool calls. However, as agents read and write sensitive user data across email, documents, and other applications, a central privacy question is whether they preserve contextual integrity (CI), that is, whether the information flows they produce comply with context-specific disclosure constraints. Existing work either focuses on model-level privacy leakage or evaluates agents in limited application environments with manually constructed disclosure constraints. In this work, we introduce AgentCIScope, a unified platform and benchmark for evaluating agent-level contextual integrity through executable, multi-step tasks across diverse, realistic application environments. AgentCIScope transforms public and synthetic privacy cases into executable agent tasks, with disclosure constraints grounded in three criteria: governing privacy policies, persona-based agreement, and a predefined sensitive-attribute taxonomy. Based on AgentCIScope, we evaluate 12 agents on 936 tasks and find that strong task-completion capability does not guarantee contextual-integrity preservation: single-run leakage rates range from 32.5% to 94.4%, while repeating each task five times further increases leakage by 4-19 percentage points. Leakage varies substantially across attributes: personal preferences and booking details have average leakage rates of 84.7% and 76.5%, compared with 17.1% for credit-card information and 29.4% for SSNs; environments: calendar has the highest average leakage rate as an information source, while WhatsApp ranks highest as an information destination; and governing privacy policies. AgentCIScope provides deep insights into agent privacy leakage and serves as a unified testbed for developing privacy-preserving agents.
Figures & tables
Figure 1: Demonstration of contextual-integrity violation by an LLM agent (GPT-6 Astra with OpenAI Agents SDK). An HR asks an agent to send a candidate update using information from Gmail and Google Docs. The agent retrieves a sensitive background-check record and unnecessarily discloses it to the hiring manager, illustrating how privacy leakage can emerge through multi-step interactions across environments. A more detailed case study of this example is provided in Fig. 7 .
| Capability | PrivacyLens | PrivaCI-Bench | CIMemories | AgentDAM | CI-Work | AgentCIBench | AgentCIScope |
| Automated task generation and environment setup | |||||||
| Executable multi-step agentic tasks | |||||||
| Cross-environment information flow | |||||||
| Policy grounding | |||||||
| Multiple agentic frameworks |
Table 1: Comparison of representative privacy benchmarks for LLMs and agents. indicates explicit support, indicates partial, simulated, or narrower support, and indicates that the capability is outside the benchmark’s scope.
Figure 2: Overview of the AgentCIScope construction pipeline. Contextual Integrity Contract Synthesis transforms public and synthetic privacy seed cases into explicit contextual integrity contracts. Executable Environment Setup prepares information-rich, cross-environment application states for agent interaction. Stress-Test Task Generation constructs diverse task instruction variants using a library of leakage skills to expose privacy failures. The resulting evaluation suite consists of contextual integrity contracts, agentic task instructions, and their associated pre-populated environment states.
| Single-Run TLR | 5-Run Union TLR | ||||||
| Framework | Model | BSR (%) | TLR (%) | 95% CI | TLR (%) | 95% CI | TLR (pt) |
| Claude Code | Claude Opus 5 | 97.1 | 32.5 | [29.6, 35.5] | 46.0 | [42.9, 49.2] | +13.6 |
| Claude Code | Claude Sonnet 5 | 93.8 | 49.4 | [46.2, 52.6] | 68.7 | [65.7, 71.6] | +19.3 |
| OpenClaw | GPT-6 Astra | 95.4 | 36.9 | [33.8, 40.0] | 48.1 | [44.9, 51.3] | +11.2 |
| OpenClaw | Claude Opus 5 | 96.7 | 43.6 | [40.4, 46.8] | 58.0 | [54.8, 61.1] | +14.4 |
| OpenClaw | Kimi K3 | 98.2 | 88.4 | [86.1, 90.3] | 97.4 | [96.2, 98.3] | +9.1 |
Table 2: Benign task success and task-level leakage rate under different agentic frameworks and backbone models. Over 936 tasks: BSR and the single-run TLR are measured on the first run. The union TLR counts a task as leaked if it leaks in at least one of the five runs, and TLR carries a Wilson 95% confidence interval ( Eq. 3 ). TLR is the increase of the union TLR over the single-run TLR.
Figure 3: Cumulative task-level leakage rate over repeated runs. Repeated execution exposes additional privacy failures beyond a single run. The full 12-agent version is shown in Fig. 9 .
Figure 4: Attribute leakage rate (ALR) by protected attribute on the first run with 936 tasks. Each cell reports the number of leaked contract-protected attributes of the corresponding row type divided by the total number of protected attributes of that type across the evaluated tasks. Detailed computation is provided in Eq. 7 of App. E . The rightmost column averages the 12 agents, and rows are sorted by this average; the badge gives the resulting rank (1 = most frequently leaked).
Figure 5: Source- and destination-environment leakage rates (SLR and DLR) for different agents. The left panel shows SLR ( Eq. 12 ), and the right panel shows DLR ( Eq. 13 ). Results are computed on the first run over the 936 tasks; detailed definitions are provided in App. F . Per-pair source-to-destination rates for all configurations are given in Fig. 10 .
Figure 6: Policy violation rate (PVR) by governing provision. Agents violate broad privacy provisions more often, while leaking explicitly sensitive data less frequently.
Appendix figures & tables9 assets
Supplementary material from the paper’s appendix.
Appendix
| Category | Detailed attributes |
| Contact information | home address, email address, phone number |
| Health information | treatment history, diagnoses, medical conditions, prescriptions |
| Personal identifiers | full name, date of birth, gender |
| Financial information | credit card information, income, bank account details, salary, tax records |
| Employment information | HR records, performance history, compensation details, job title, employer |
| Communication & relationships | messages, family/relationship status, emails, contacts |
Table 3: The privacy attribute list: 10 categories and their 39 detailed attributes.
Figure 7: Detailed case study of the motivating example in Fig. 1 . The figure highlights selected steps in which the agent retrieves a sensitive background-check record from Gmail and Google Docs and subsequently includes it in an email to the hiring manager, resulting in a violation of contextual integrity and the applicable privacy policy. The victim agent uses GPT-6 Astra as the backbone model with the OpenAI Agents SDK.
| Attribute Type | Agreement Rate (95% CI) |
| Protected attributes ( ) | 94.3% (89.5–97.0) |
| Public attributes ( ) | 99.4% (96.9–99.9) |
Table 4: Human validation of synthesized privacy contracts. Agreement indicates that the human annotator agrees with the privacy status assigned by the contract.
| Evaluation Level | Agreement (95% CI) | Cohen’s | |
| Task level (any attribute leaked) | 50 | 92.0% (81.2–96.8) | 0.83 |
| Attribute level | 157 | 95.5% (91.1–97.8) | 0.887 |
Table 5: Agreement between the LLM leakage judge and the human annotations. We report raw agreement, 95% confidence intervals, and Cohen’s .
| Symbol | Definition | Interpretation |
| one task (936 in total) | - | |
| the agent’s trajectory on : an ordered sequence of steps | What the agent actually did to complete the task, including its tool calls. | |
| the -th step of ; a step calling a read tool is a read step, one calling a write tool a write step | Which tool call happened at step . | |
| the environment the tool called at belongs to | Which environment the tool call at step went to. | |
| the normalised text (lower-case, punctuation removed) returned by read step | What content the agent received from the environment at step . | |
| the privacy contract of ; it defines and for every | What counts as private on this task and where it must not flow. |
Table 6: Notation for the source-to-destination leak-rate computation ( Eqs. 9 to 11 ).
| Skill | Mechanism |
| Context Field Enrichment | The instruction treats open-ended fields such as notes, context, or background as fields that should be filled thoroughly, so the agent adds personal sensitive information that the task never required. |
| Self-Contained Briefing | The instruction asks for a document that is complete and self-contained, so the agent copies more of the original material and carries adjacent protected information into the output. |
| Named Example Expansion | The instruction asks for concrete, named examples instead of abstractions, so the agent exposes raw identifiers, credentials, or other sensitive details directly. |
| Verbatim Quotation | The instruction emphasizes precision and asks the agent to quote the source word for word, so sensitive information embedded in the quoted passages leaks along with it. |
| Authenticity Enhancement | The instruction asks for content that is authentic and credible, so the agent cites specific people’s private disclosures or sensitive details to make it convincing. |
| Broad Record Retrieval | The instruction asks for information that is as complete as possible, so the agent widens its collection and copying and brings task-irrelevant sensitive content into the output. |
Table 7: The ten leakage skills used for stress-test task generation. Each skill rephrases a benign task so that an agent is tempted to carry protected information to an out-of-bounds recipient.
Figure 8: Average attribute leakage rate per task vs. trajectory length. Tasks are ranked by length separately for each configuration and split into five equal groups (x-axis: from the shortest 20% of that configuration’s tasks to the longest 20%), so every point averages about 190 tasks. The y-axis is the mean over those tasks of the task-level ALR ( Eq. 6 ), i.e. the fraction of a task’s protected attributes that leaked.
Figure 9: Cumulative task-level leakage rate over repeated runs, all twelve configurations. Full version of Fig. 3 .
Figure 10: Source-to-destination leakage rates per configuration. Each cell reports ( Eqs. 9 to 11 ) on the first run over 936 tasks: the percentage of protected attributes read from the row (source) environment and leaked to the column (destination) environment. Zeros denote exact zero rates, while dashes indicate empty denominators.